Jump to content

backdoor trojan problems


Recommended Posts

iv been reading on here and it seems like this is a rather commen problem...scanned with malwarebytes and it said there was a trojan i go to remove it and it didnt fix anything...iv done it about 3 times and its still comming back. Reading on other posts iv seen other people have had similar problems so i downloaded rougekiller and frst but i figured itd be best to post here before trying to fix it myself as i dont wanna fubar my computer.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_31

Run by Michael at 6:43:55 on 2012-08-11

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.8157.5881 [GMT -4:00]

.

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

C:\Windows\SysWOW64\svchost.exe -k Akamai

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe

c:\Program Files (x86)\Common Files\Dell\Advanced Networking Service\hnm_svc.exe

C:\Program Files (x86)\Common Files\McAfee\McProxy\McProxy.exe

C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\STService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\WUDFHost.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

C:\Windows\system32\SearchIndexer.exe

C:\Users\Michael\AppData\Local\Akamai\netsession_win.exe

C:\Users\Michael\AppData\Local\Akamai\netsession_win.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe

C:\Program Files (x86)\Dell Remote Access\ezi_ra.exe

C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\GameStop App\Now\GameStopNow.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\System32\vds.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Program Files (x86)\Common Files\mcafee\mna\mcnasvc.exe

C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

"C:\Windows\SysWOW64\svchost.exe" -k LocalServiceDns

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_270.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_270.exe

C:\Windows\system32\taskeng.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.bing.com/?pc=ZUGO&form=ZGAPHP

uInternet Settings,ProxyOverride = 127.0.0.1:9421;*.local;<local>?¦???????????????????????????=;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>

uURLSearchHooks: H - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - C:\Program Files (x86)\McAfee\MSK\mskapbho.dll

BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: {9D425283-D487-4337-BAB6-AB8354A81457} - No File

BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File

TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

TB: {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - No File

uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

uRun: [steam] "C:\Program Files (x86)\Steam\steam.exe" -silent

uRun: [GateWay] C:\Windows\system32\GateWayMain.exe

uRun: [PlayNC Launcher]

uRun: [Akamai NetSession Interface] "C:\Users\Michael\AppData\Local\Akamai\netsession_win.exe"

uRun: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

uRun: [speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup

mRun: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m

mRun: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter

mRun: [mcagent_exe] "C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe" /runkey

mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

mRun: [DivX Download Manager] "C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe" start

mRun: [AmazonGSDownloaderTray] C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start

mRun: [Aeria Ignite] "C:\Program Files (x86)\Aeria Games\Ignite\aeriaignite.exe" silent

mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe

StartupFolder: C:\Users\Michael\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\GAMEST~1.LNK - C:\Program Files (x86)\GameStop App\Now\GameStopNow.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLRE~1.LNK - c:\Windows\Installer\{F66A31D9-7831-4FBA-BA02-C411C0047CC5}\NewShortcut4_F66A31D978314FBABA02C411C0047CC5.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\WHITES~1.LNK - C:\Users\Michael\Downloads\WhiteSmokeWriterGeo5002_en.exe

uPolicies-explorer: HideSCAHealth = 1 (0x1)

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL

LSP: C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll

LSP: mswsock.dll

DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} - hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab

DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/uno1/GAME_UNO1.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

TCP: DhcpNameServer = 204.68.227.1 204.68.227.2

TCP: Interfaces\{06EDDBBE-690E-4481-BA23-7E035DA2501B} : DhcpNameServer = 204.68.227.1 204.68.227.2

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - C:\Program Files (x86)\McAfee\MSK\mskapbho.dll

BHO-X64: McAfee Phishing Filter - No File

BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: {9D425283-D487-4337-BAB6-AB8354A81457} - No File

BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO-X64: SkypeIEPluginBHO - No File

BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB-X64: {9D425283-D487-4337-BAB6-AB8354A81457} - No File

TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

TB-X64: {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - No File

mRun-x64: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m

mRun-x64: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter

mRun-x64: [mcagent_exe] "C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe" /runkey

mRun-x64: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

mRun-x64: [DivX Download Manager] "C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe" start

mRun-x64: [AmazonGSDownloaderTray] C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe

mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun-x64: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"

mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun-x64: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start

mRun-x64: [Aeria Ignite] "C:\Program Files (x86)\Aeria Games\Ignite\aeriaignite.exe" silent

mRunOnce-x64: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\nevcdzes.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.youtube.com/

FF - plugin: C:\Program Files (x86)\BYOND\bin\npbyond.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll

FF - plugin: C:\Program Files (x86)\Vizzed\Vizzed Retro Game Room\NpVizzedRgr.dll

FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll

FF - plugin: C:\Users\Michael\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_270.dll

.

============= SERVICES / DRIVERS ===============

.

R0 PCTCore;PCTools KDS;C:\Windows\system32\drivers\PCTCore64.sys --> C:\Windows\system32\drivers\PCTCore64.sys [?]

R0 pctDS;PC Tools Data Store;C:\Windows\system32\drivers\pctDS64.sys --> C:\Windows\system32\drivers\pctDS64.sys [?]

R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys --> C:\Windows\system32\DRIVERS\dtsoftbus01.sys [?]

R2 {1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7};Power Control [2011/06/23 07:24:48];C:\Program Files (x86)\CyberLink\PowerDVD DX\000.fcl [2011-6-23 146928]

R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2011-6-23 92160]

R2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe -k Akamai [2009-7-13 20992]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-6-27 2369960]

R2 McProxy;McAfee Proxy Service;C:\Program Files (x86)\Common Files\McAfee\McProxy\McProxy.exe [2009-10-8 359952]

R2 RtNdPt60;Realtek NDIS Protocol Driver;C:\Windows\system32\DRIVERS\RtNdPt60.sys --> C:\Windows\system32\DRIVERS\RtNdPt60.sys [?]

R2 sdAuxService;PC Tools Auxiliary Service;C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe [2011-2-2 366840]

R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;C:\Windows\system32\drivers\IntcHdmi.sys --> C:\Windows\system32\drivers\IntcHdmi.sys [?]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-6-27 116648]

S2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;system32\libusbd-nt.exe --> system32\libusbd-nt.exe [?]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-2-29 158856]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-12 250056]

S3 Amazon Download Agent;Amazon Download Agent;C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [2011-4-22 401920]

S3 cpudrv64;cpudrv64;C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [2011-6-2 17864]

S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-6-27 116648]

S3 MozillaMaintenance;Mozilla Maintenance Service;"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" --> C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [?]

S3 npggsvc;nProtect GameGuard Service;C:\Windows\system32\GameMon.des -service --> C:\Windows\system32\GameMon.des -service [?]

S3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);C:\Windows\system32\DRIVERS\RtTeam60.sys --> C:\Windows\system32\DRIVERS\RtTeam60.sys [?]

S3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);C:\Windows\system32\DRIVERS\RtVlan60.sys --> C:\Windows\system32\DRIVERS\RtVlan60.sys [?]

S3 sdCoreService;PC Tools Security Service;C:\Program Files (x86)\PC Tools Security\pctsSvc.exe [2011-2-2 1150936]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

.

=============== Created Last 30 ================

.

2012-08-11 09:27:30 -------- d-----w- C:\Users\Michael\AppData\Local\{3BF5B61F-5595-46E6-85B2-B4FDEFE05BB8}

2012-08-11 09:26:41 -------- d-----w- C:\Users\Michael\AppData\Local\{F812BC98-6D58-4ABC-AC42-9534B9A36CFE}

2012-08-10 20:09:26 -------- d-----w- C:\Users\Michael\AppData\Local\{74C8FCDE-A376-4346-89B6-993306FFE9AB}

2012-08-10 20:08:50 -------- d-----w- C:\Users\Michael\AppData\Local\{8B59C57A-A82C-48AA-B19C-91A25E4598BB}

2012-08-10 07:59:45 -------- d-sh--w- C:\Windows\SysWow64\%APPDATA%

2012-08-10 03:27:35 -------- d-----w- C:\Users\Michael\AppData\Local\Mozilla

2012-08-10 03:14:29 -------- d-----w- C:\Program Files (x86)\Aeria Games

2012-08-09 23:39:28 -------- d-----w- C:\Users\Michael\AppData\Local\{3C31E1C6-DBE7-4056-A885-A584D87DFA87}

2012-08-09 23:38:45 -------- d-----w- C:\Users\Michael\AppData\Local\{40CB89F5-F51C-4D1E-B941-690509A0D2D4}

2012-08-09 22:50:37 -------- d-----w- C:\Users\Michael\AppData\Local\{D01B9486-35B0-49DA-8990-DE13AE636559}

2012-08-09 22:50:15 -------- d-----w- C:\Users\Michael\AppData\Local\{3D5EE946-862F-40D1-B74E-2B6A63652EE9}

2012-08-09 14:51:08 -------- d-sh--w- C:\Windows\System32\%APPDATA%

2012-08-09 14:02:13 -------- d--h--w- C:\Users\Michael\AppData\Local\{8B767F75-8520-4ACD-8B25-119E6222029E}

2012-08-09 14:01:39 -------- d--h--w- C:\Users\Michael\AppData\Local\{9D0F5404-F4F2-48EE-A35D-F8C280149C14}

2012-08-09 02:01:27 -------- d--h--w- C:\Users\Michael\AppData\Local\{A1EDA719-43BE-4006-8A57-129EB995D4FE}

2012-08-09 02:00:55 -------- d--h--w- C:\Users\Michael\AppData\Local\{374A6C34-33CE-460F-B63B-DEE5AECEF476}

2012-08-08 14:00:44 -------- d--h--w- C:\Users\Michael\AppData\Local\{8322B0AB-6D56-4A23-B981-B34D0DC11B43}

2012-08-08 14:00:10 -------- d--h--w- C:\Users\Michael\AppData\Local\{E4C53996-BECF-4064-922F-3B6BEEBDDC85}

2012-08-08 01:59:59 -------- d--h--w- C:\Users\Michael\AppData\Local\{1E400C9E-FCCF-4C52-AAE3-0474A804B287}

2012-08-08 01:59:27 -------- d--h--w- C:\Users\Michael\AppData\Local\{804B0B9F-BA0B-4BC5-8E47-590E1ED529F2}

2012-08-07 13:59:15 -------- d--h--w- C:\Users\Michael\AppData\Local\{48966CF7-AB34-40CA-A149-4CED541A10C8}

2012-08-07 13:58:43 -------- d--h--w- C:\Users\Michael\AppData\Local\{2316D9A3-3995-4EB0-9C05-0D8D34DE6D68}

2012-08-07 01:58:31 -------- d--h--w- C:\Users\Michael\AppData\Local\{3AF4DC64-940B-4979-8368-7281267C8E52}

2012-08-07 01:57:58 -------- d--h--w- C:\Users\Michael\AppData\Local\{7BEE0AF5-CEB3-4FE5-A72A-3DB583AAE372}

2012-08-06 13:57:46 -------- d--h--w- C:\Users\Michael\AppData\Local\{7EB1A630-E558-4BBF-9693-2F5BCC1D0F7F}

2012-08-06 13:57:14 -------- d--h--w- C:\Users\Michael\AppData\Local\{83C7DD3D-CC54-4505-9136-598CA9F4CF28}

2012-08-06 01:57:03 -------- d--h--w- C:\Users\Michael\AppData\Local\{C436AA80-B031-4827-A37D-A648F6402321}

2012-08-06 01:56:29 -------- d--h--w- C:\Users\Michael\AppData\Local\{A4F77EEC-BA99-4E32-9D1E-1D1694F180FD}

2012-08-05 13:56:18 -------- d--h--w- C:\Users\Michael\AppData\Local\{C031809B-C84C-4326-BD14-449F5E8C2153}

2012-08-05 13:55:46 -------- d--h--w- C:\Users\Michael\AppData\Local\{693C942B-C723-453A-944A-EACE5022A07F}

2012-08-05 01:55:34 -------- d--h--w- C:\Users\Michael\AppData\Local\{35409FBA-5D53-41A2-BFAC-EF837B05E1B6}

2012-08-05 01:55:01 -------- d--h--w- C:\Users\Michael\AppData\Local\{265489AE-4081-4620-888A-FBC133CFA08F}

2012-08-04 13:54:49 -------- d--h--w- C:\Users\Michael\AppData\Local\{2B4A10DE-5CE0-4F49-A93D-F4628F2965B1}

2012-08-04 13:54:15 -------- d--h--w- C:\Users\Michael\AppData\Local\{B8B27B20-C798-4258-BA2F-34AA27C16A11}

2012-08-04 01:54:04 -------- d--h--w- C:\Users\Michael\AppData\Local\{BDE6A004-6451-4C25-8CD2-0C2738D8C331}

2012-08-04 01:53:31 -------- d--h--w- C:\Users\Michael\AppData\Local\{114471B2-B66B-4852-90A8-8029A407EA72}

2012-08-03 13:53:19 -------- d--h--w- C:\Users\Michael\AppData\Local\{A7291689-B01E-4419-8D4F-BE2D739539E3}

2012-08-03 13:52:46 -------- d--h--w- C:\Users\Michael\AppData\Local\{98B7CEC5-ADC5-4329-A34E-4B8F666DAD5B}

2012-08-03 01:52:34 -------- d--h--w- C:\Users\Michael\AppData\Local\{CD8B0EF2-71EA-47BF-A1D2-FA56E2D45286}

2012-08-03 01:52:01 -------- d--h--w- C:\Users\Michael\AppData\Local\{6A5ED17B-96E9-44A3-81A8-223CD10CBA34}

2012-08-02 13:51:49 -------- d--h--w- C:\Users\Michael\AppData\Local\{C93BD8DC-6D81-4FF8-A5C2-3C2CBF39013E}

2012-08-02 13:51:16 -------- d--h--w- C:\Users\Michael\AppData\Local\{778A73D7-14B9-463D-AE32-C74B40E67AFF}

2012-08-02 01:51:05 -------- d--h--w- C:\Users\Michael\AppData\Local\{F3F1D829-2722-4AEE-B23F-F620EBE238D1}

2012-08-02 01:50:31 -------- d--h--w- C:\Users\Michael\AppData\Local\{31E0C173-7806-4F7F-B698-3B13CB2B667A}

2012-08-01 13:50:19 -------- d--h--w- C:\Users\Michael\AppData\Local\{4F8E872B-5754-4283-92EA-2A11AB2BDD85}

2012-08-01 13:49:46 -------- d--h--w- C:\Users\Michael\AppData\Local\{89D19DC8-EE26-4070-933C-911C18CC35C7}

2012-08-01 01:49:34 -------- d--h--w- C:\Users\Michael\AppData\Local\{040FCE48-DF46-4935-B257-ECF51ACE9958}

2012-08-01 01:49:00 -------- d--h--w- C:\Users\Michael\AppData\Local\{82D1CBC5-8DE7-43B8-82D9-B2DFDD335453}

2012-07-31 13:48:49 -------- d--h--w- C:\Users\Michael\AppData\Local\{46D870FA-FE40-4D01-B8B7-6B17603F6132}

2012-07-31 13:48:17 -------- d--h--w- C:\Users\Michael\AppData\Local\{8382E5A4-475D-4F2D-9F53-36C55EB92798}

2012-07-31 01:48:05 -------- d--h--w- C:\Users\Michael\AppData\Local\{59E89E9B-E87F-47BA-A9AD-DB011AC46209}

2012-07-31 01:47:33 -------- d--h--w- C:\Users\Michael\AppData\Local\{A9341B52-D75D-42F1-B4F8-979D173B2F5A}

2012-07-30 13:47:22 -------- d--h--w- C:\Users\Michael\AppData\Local\{F3E3A187-64F5-4E03-9950-ACBC4D135FB4}

2012-07-30 13:46:49 -------- d--h--w- C:\Users\Michael\AppData\Local\{25A2FCCA-8066-4740-A3AB-8126919971E6}

2012-07-30 01:46:38 -------- d--h--w- C:\Users\Michael\AppData\Local\{F3CB5CD3-C1C2-425C-AD39-7F1804A17988}

2012-07-30 01:46:04 -------- d--h--w- C:\Users\Michael\AppData\Local\{C2E1159B-D0A6-4D02-BACF-DDC0627E70F5}

2012-07-29 13:45:53 -------- d--h--w- C:\Users\Michael\AppData\Local\{F2311DC9-E2CE-411C-996E-61FB9F244679}

2012-07-29 13:45:21 -------- d--h--w- C:\Users\Michael\AppData\Local\{5E139895-A274-4704-B75B-7A2029CF825E}

2012-07-29 01:45:09 -------- d--h--w- C:\Users\Michael\AppData\Local\{F102563C-A0B6-4FE4-AB54-FABC54B1202A}

2012-07-29 01:44:43 -------- d--h--w- C:\Users\Michael\AppData\Local\{AA9BA8A8-4936-4396-9559-379BA694A6C2}

2012-07-28 07:58:52 -------- d--h--w- C:\Users\Michael\AppData\Local\{5FD4A065-65A7-4651-A78D-1A01C8930084}

2012-07-28 07:58:19 -------- d--h--w- C:\Users\Michael\AppData\Local\{CDE338C2-DD77-4BC5-9FD9-8DFA94A107B0}

2012-07-27 19:58:08 -------- d--h--w- C:\Users\Michael\AppData\Local\{E3A124B1-3090-440F-AE4C-C4F53D6972F1}

2012-07-27 19:57:35 -------- d--h--w- C:\Users\Michael\AppData\Local\{307CF855-3212-4548-AD4D-8B30E8BFB498}

2012-07-27 07:57:23 -------- d--h--w- C:\Users\Michael\AppData\Local\{E79E5CE5-44A3-4B65-B42B-AE89ECE8EB14}

2012-07-27 07:56:49 -------- d--h--w- C:\Users\Michael\AppData\Local\{FAF95B0D-E974-432E-9E86-A7D838FE76FD}

2012-07-26 19:56:37 -------- d--h--w- C:\Users\Michael\AppData\Local\{D32F07A8-DDAE-4304-95E0-BD31A4CD3480}

2012-07-26 19:56:05 -------- d--h--w- C:\Users\Michael\AppData\Local\{66CA3E71-A272-43A6-B0BB-4B5E7953B107}

2012-07-26 07:55:53 -------- d--h--w- C:\Users\Michael\AppData\Local\{2D613B42-F721-42F6-B5F8-B6E91F69B941}

2012-07-26 07:55:20 -------- d--h--w- C:\Users\Michael\AppData\Local\{A79B5BA1-6216-4B2D-8D51-4783AC9F593E}

2012-07-25 19:55:08 -------- d--h--w- C:\Users\Michael\AppData\Local\{F18EABAF-C642-482A-AF8B-6A01B8132733}

2012-07-25 19:54:35 -------- d--h--w- C:\Users\Michael\AppData\Local\{A47C691D-4FF0-4D1A-927D-71F414592B10}

2012-07-25 07:54:24 -------- d--h--w- C:\Users\Michael\AppData\Local\{26580309-2A65-4C1E-B853-A269DC419902}

2012-07-25 07:53:51 -------- d--h--w- C:\Users\Michael\AppData\Local\{ABED64D5-F639-4E9C-A187-6936D75A4AE0}

2012-07-24 19:53:38 -------- d--h--w- C:\Users\Michael\AppData\Local\{A2B8C81A-DF5A-4925-95C9-FD01FE5429E7}

2012-07-24 19:53:05 -------- d--h--w- C:\Users\Michael\AppData\Local\{8C60559E-A29B-43D7-B280-E5966B9C86E2}

2012-07-23 18:21:35 -------- d--h--w- C:\Users\Michael\AppData\Local\{6E87BEF3-9B05-4A1E-BEA9-C64EF052D8E6}

2012-07-23 18:21:02 -------- d--h--w- C:\Users\Michael\AppData\Local\{9ACA9593-D418-4700-93C8-4184787C7073}

2012-07-23 06:20:50 -------- d--h--w- C:\Users\Michael\AppData\Local\{E5D0B376-2701-4C1D-B031-487FD6D03A44}

2012-07-23 06:20:17 -------- d--h--w- C:\Users\Michael\AppData\Local\{8BEFDB54-1865-422A-BD69-CD7A7D409986}

2012-07-22 18:35:37 -------- d--h--w- C:\Users\Michael\AppData\Local\Fallout3

2012-07-22 18:20:05 -------- d--h--w- C:\Users\Michael\AppData\Local\{C1EB4EDA-1530-4B5C-9E3C-7A8E311CE18B}

2012-07-22 18:19:32 -------- d--h--w- C:\Users\Michael\AppData\Local\{59C0C184-1F65-437D-B40F-878FA07B8E63}

2012-07-22 06:19:19 -------- d--h--w- C:\Users\Michael\AppData\Local\{62044A88-70FA-434B-8188-9F6C5A478478}

2012-07-22 06:18:55 -------- d--h--w- C:\Users\Michael\AppData\Local\{24FE15E7-A42C-4AEE-9198-9C5E037B072F}

2012-07-21 18:18:43 -------- d--h--w- C:\Users\Michael\AppData\Local\{B723798D-F66A-43C7-AD24-FCCDBD4FB295}

2012-07-21 18:18:11 -------- d--h--w- C:\Users\Michael\AppData\Local\{33CEBAE1-A1BE-4B80-9BFB-928D0014036C}

2012-07-21 06:17:59 -------- d--h--w- C:\Users\Michael\AppData\Local\{F00A9F92-D26A-48E6-B0A1-EB14165A74A9}

2012-07-20 18:16:45 -------- d--h--w- C:\Users\Michael\AppData\Local\{3F6906DE-0984-4C20-9A15-813DEE74EB7A}

2012-07-20 18:15:53 -------- d--h--w- C:\Users\Michael\AppData\Local\{F11C793B-467D-4316-9FF7-9DDE7B95B429}

2012-07-20 05:36:34 -------- d--h--w- C:\Users\Michael\AppData\Local\{60373E65-5276-454B-8AB7-85717D2AA795}

2012-07-20 05:36:02 -------- d--h--w- C:\Users\Michael\AppData\Local\{D0C3E551-0E81-4D89-8B04-669C1242213C}

2012-07-19 17:35:49 -------- d--h--w- C:\Users\Michael\AppData\Local\{586C6DA2-0489-4FFE-BED9-31265FACDC14}

2012-07-19 17:35:17 -------- d--h--w- C:\Users\Michael\AppData\Local\{4B20965C-0B57-4DB5-A749-77CA2273DA95}

2012-07-19 05:35:05 -------- d--h--w- C:\Users\Michael\AppData\Local\{E3A08AF7-548B-4BE1-B8B5-2F23104E2AE2}

2012-07-19 05:34:32 -------- d--h--w- C:\Users\Michael\AppData\Local\{59608013-3640-41A9-B055-959C0FFC694E}

2012-07-18 17:34:21 -------- d--h--w- C:\Users\Michael\AppData\Local\{FF347192-F080-48D2-9AF9-B9ADECCCE1FA}

2012-07-18 17:33:47 -------- d--h--w- C:\Users\Michael\AppData\Local\{05169D71-794F-4CC1-8C27-1740B6B336FE}

2012-07-18 05:33:36 -------- d--h--w- C:\Users\Michael\AppData\Local\{7DDBFFB2-4C57-44E5-B71B-0F03F91E1096}

2012-07-18 05:33:02 -------- d--h--w- C:\Users\Michael\AppData\Local\{66EA78E4-7A89-4A8A-B262-C59B77A96D09}

2012-07-17 17:32:51 -------- d--h--w- C:\Users\Michael\AppData\Local\{F60C0665-2CC8-4AD8-991C-FE3047B52182}

2012-07-17 17:32:17 -------- d--h--w- C:\Users\Michael\AppData\Local\{D296ACD4-F0D0-4B6E-9AA4-1F443B92784A}

2012-07-17 05:32:03 -------- d--h--w- C:\Users\Michael\AppData\Local\{8E511B5B-E451-4C29-BA69-DE6CC3F9A5BD}

2012-07-17 05:31:30 -------- d--h--w- C:\Users\Michael\AppData\Local\{5A6271CF-A1C7-491C-952D-793B83BE345C}

2012-07-16 21:42:02 -------- d--h--w- C:\Users\Michael\AppData\Local\PCGen

2012-07-16 21:25:20 -------- d-----w- C:\Program Files\Oracle

2012-07-16 21:24:36 955888 ----a-w- C:\Windows\System32\npDeployJava1.dll

2012-07-16 21:24:36 839152 ----a-w- C:\Windows\System32\deployJava1.dll

2012-07-16 21:12:43 -------- d-----w- C:\Users\Michael\jdk1.7.0_05_combo

2012-07-16 17:31:18 -------- d--h--w- C:\Users\Michael\AppData\Local\{DE403065-1609-4AE4-9C02-20A20CC84BA3}

2012-07-16 17:30:45 -------- d--h--w- C:\Users\Michael\AppData\Local\{C899259A-6942-4F34-9198-C2880617A73A}

2012-07-16 05:30:34 -------- d--h--w- C:\Users\Michael\AppData\Local\{21653E8D-8975-4899-8F22-95AD53C44824}

2012-07-16 05:30:00 -------- d--h--w- C:\Users\Michael\AppData\Local\{60EC199A-F737-4A58-B1E9-FCD1AF3884E7}

2012-07-15 19:55:19 -------- d--h--w- C:\Users\Michael\AppData\Local\GameStop

2012-07-15 17:29:49 -------- d--h--w- C:\Users\Michael\AppData\Local\{A12D9C28-8B15-40DE-BCB7-E97B332A33E6}

2012-07-15 17:29:16 -------- d--h--w- C:\Users\Michael\AppData\Local\{324FBF4D-FEAE-4C44-BCAA-1A17FDCAAC6C}

2012-07-15 05:29:05 -------- d--h--w- C:\Users\Michael\AppData\Local\{2292C8AB-A3C0-4B7F-A779-CDD30733F104}

2012-07-15 05:28:30 -------- d--h--w- C:\Users\Michael\AppData\Local\{89F1892D-9146-477D-92E1-AE3935094E24}

2012-07-14 17:28:19 -------- d--h--w- C:\Users\Michael\AppData\Local\{B50EAF6B-561B-4646-92AD-5AFBFBAC8310}

2012-07-14 17:27:46 -------- d--h--w- C:\Users\Michael\AppData\Local\{81779320-438D-4F8E-8182-3676B71D6985}

2012-07-14 05:27:33 -------- d--h--w- C:\Users\Michael\AppData\Local\{AF38AAEF-1427-4398-9368-B64A4B3552B7}

2012-07-14 05:27:00 -------- d--h--w- C:\Users\Michael\AppData\Local\{4A3A9A71-7959-43F3-B2C9-2E600060DFCD}

2012-07-13 17:26:48 -------- d--h--w- C:\Users\Michael\AppData\Local\{BF6DC393-BEA1-41C0-9413-74B2F24DD622}

2012-07-13 17:26:15 -------- d--h--w- C:\Users\Michael\AppData\Local\{FB8AB212-39E6-459F-A5BB-30D52662AB78}

2012-07-13 05:26:03 -------- d--h--w- C:\Users\Michael\AppData\Local\{BA3F600E-FF1D-4EDE-A8D9-35DE8CE0E0A7}

2012-07-13 05:25:30 -------- d--h--w- C:\Users\Michael\AppData\Local\{C093335A-026C-44EA-BD1A-B6A71DAE6400}

2012-07-12 17:25:17 -------- d--h--w- C:\Users\Michael\AppData\Local\{C8C370E6-1824-40C3-ACCB-0BF3A70C05BF}

2012-07-12 17:24:45 -------- d--h--w- C:\Users\Michael\AppData\Local\{6AFEAEB9-EA9C-4664-9A2D-5CF170BD4D58}

.

==================== Find3M ====================

.

2012-08-10 00:39:31 70344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-08-10 00:39:31 426184 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2012-06-12 03:02:52 3147264 ----a-w- C:\Windows\System32\win32k.sys

2012-06-06 05:50:50 2003968 ----a-w- C:\Windows\System32\msxml6.dll

2012-06-06 05:50:50 1880064 ----a-w- C:\Windows\System32\msxml3.dll

2012-06-06 05:09:46 1389568 ----a-w- C:\Windows\SysWow64\msxml6.dll

2012-06-06 05:09:46 1236992 ----a-w- C:\Windows\SysWow64\msxml3.dll

2012-06-02 22:15:31 2622464 ----a-w- C:\Windows\System32\wucltux.dll

2012-06-02 22:15:08 99840 ----a-w- C:\Windows\System32\wudriver.dll

2012-06-02 19:19:42 186752 ----a-w- C:\Windows\System32\wuwebv.dll

2012-06-02 19:15:12 36864 ----a-w- C:\Windows\System32\wuapp.exe

2012-06-02 12:12:17 2311680 ----a-w- C:\Windows\System32\jscript9.dll

2012-06-02 12:05:28 1392128 ----a-w- C:\Windows\System32\wininet.dll

2012-06-02 12:04:50 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl

2012-06-02 12:01:40 173056 ----a-w- C:\Windows\System32\ieUnatt.exe

2012-06-02 11:57:08 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

2012-06-02 08:33:25 1800192 ----a-w- C:\Windows\SysWow64\jscript9.dll

2012-06-02 08:25:08 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll

2012-06-02 08:25:03 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

2012-06-02 08:20:33 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

2012-06-02 08:16:52 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2012-06-02 05:38:26 95088 ----a-w- C:\Windows\System32\drivers\ksecdd.sys

2012-06-02 05:38:24 152432 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys

2012-06-02 05:37:45 459216 ----a-w- C:\Windows\System32\drivers\cng.sys

2012-06-02 05:27:02 340992 ----a-w- C:\Windows\System32\schannel.dll

2012-06-02 05:27:00 307200 ----a-w- C:\Windows\System32\ncrypt.dll

2012-06-02 04:48:39 22016 ----a-w- C:\Windows\SysWow64\secur32.dll

2012-06-02 04:48:35 225280 ----a-w- C:\Windows\SysWow64\schannel.dll

2012-06-02 04:47:31 219136 ----a-w- C:\Windows\SysWow64\ncrypt.dll

2012-06-02 04:42:51 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll

.

============= FINISH: 6:44:23.03 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows 7 Ultimate

Boot Device: \Device\HarddiskVolume3

Install Date: 11/16/2009 8:37:59 PM

System Uptime: 8/11/2012 5:24:12 AM (1 hours ago)

.

Motherboard: Dell Inc. | | 0M017G

Processor: Intel® Core™2 Quad CPU Q8300 @ 2.50GHz | CPU 1 | 2499/333mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 451 GiB total, 111.432 GiB free.

D: is CDROM ()

E: is CDROM ()

F: is Removable

G: is Removable

H: is Removable

I: is Removable

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP436: 5/19/2012 3:00:26 AM - Windows Update

RP437: 6/1/2012 2:15:00 AM - Installed NVIDIA PhysX

RP438: 6/1/2012 4:02:30 AM - Installed NVIDIA PhysX

RP439: 6/5/2012 3:00:11 AM - Windows Update

RP440: 6/7/2012 11:34:03 PM - Installed DirectX

RP441: 6/8/2012 4:30:45 PM - Windows Update

RP442: 6/12/2012 1:40:33 AM - Removed NVIDIA 3D Vision Controller Driver

RP443: 6/14/2012 3:00:28 AM - Windows Update

RP444: 6/21/2012 7:34:35 AM - Windows Live Essentials

RP445: 6/21/2012 7:35:48 AM - Installed DirectX

RP446: 6/21/2012 7:36:40 AM - Installed DirectX

RP447: 6/21/2012 7:37:45 AM - WLSetup

RP448: 6/27/2012 1:06:47 AM - Installed LogMeIn Hamachi

RP449: 7/12/2012 3:00:27 AM - Windows Update

RP450: 7/16/2012 5:20:30 PM - Installed Java SE Development Kit 7 Update 5 (64-bit)

RP451: 7/16/2012 5:23:18 PM - Installed Java™ 7 Update 5 (64-bit)

RP452: 7/16/2012 5:24:52 PM - Installed JavaFX 2.1.1 SDK (64-bit)

RP453: 7/16/2012 5:26:13 PM - Installed JavaFX 2.1.1 (64-bit)

RP454: 7/22/2012 2:32:02 PM - Installed DirectX

RP455: 7/22/2012 2:34:09 PM - Installed Microsoft Games for Windows - LIVE Redistributable

RP456: 7/22/2012 4:44:25 PM - Installed Microsoft Games for Windows - LIVE Redistributable

RP457: 7/25/2012 4:58:38 AM - Installed Fallout 3 - The Garden of Eden Creation Kit

RP458: 8/9/2012 7:01:28 PM - Restore Operation

RP459: 8/10/2012 7:25:46 PM - Removed Dell Dock

.

==== Installed Programs ======================

.

Update for Microsoft Office 2007 (KB2508958)

Acrobat.com

Adobe AIR

Adobe Community Help

Adobe Download Assistant

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader 9.2

Adobe Shockwave Player 11.6

Aeria Ignite

Akamai NetSession Interface

Akamai NetSession Interface Service

Alien Breed 2: Assault

Amazon Games & Software Downloader

Apple Application Support

Apple Software Update

Audacity 1.3.11 (Unicode)

AVS Update Manager 1.0

AVS Video Converter 6

AVS4YOU Software Navigator 1.4

Banctec Service Agreement

Bandisoft MPEG-1 Decoder

beanfun!

BitTorrent

Build Your Own Net Dream (remove only)

Champions Online: Bloodmoon Free Weekend

Character Builder

CLANNAD Full Voice 1.5

Click_App 1.0

Cognitive Tutor

Compatibility Pack for the 2007 Office system

Crazy Drake Special Edition

D3DX10

Dell-eBay

Dell DataSafe Local Backup

Dell DataSafe Local Backup - Support Software

Dell DataSafe Online

Dell Getting Started Guide

Dell Remote Access

Dell Support Center (Support Software)

Dell Video Chat

Demonstar Special Edition

DFOLauncher

Diagnostic Utility

DigimonBattle Beta

DoremiSoft AVI to MP4 Converter 1.0

Dungeons & Dragons Online ®: Eberron Unlimited ™ v01.12.00.803

Duty Calls

EasyBits GO

Eden Eternal

Galaxy of Games Gold Edition

Galaxy of Games Red Collection

Game Booster

GameStop App

Garry's Mod

Gateway

GDMO

Google Drive

Google Update Helper

GoToAssist 8.0.0.514

Grand Fantasia

Half-Life 2

Hedgewars, a free turn-based strategy game

History_ScreenSaver

ijji REACTOR

Intel® Graphics Media Accelerator Driver

IrisOnline

Java Auto Updater

Java™ 6 Update 31

Junk Mail filter update

Kaiba Corp Virtual Duel System 1.26

Katawa Shoujo

LAME v3.98.2 for Audacity

League of Legends

LibUSB-Win32-0.1.10.1

LogMeIn Hamachi

LucentHeart

Malwarebytes Anti-Malware version 1.61.0.1400

Medieval II: Total War

Medieval II: Total War Kingdoms

Metin2.us

Microsoft .NET Framework 1.1

Microsoft Games for Windows - LIVE Redistributable

Microsoft Games for Windows Marketplace

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Excel MUI (English) 2007

Microsoft Office Home and Student 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office PowerPoint Viewer 2007 (English)

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Suite Activation Assistant

Microsoft Office Word MUI (English) 2007

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Text-to-Speech Engine 4.0 (English)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319

Microsoft Works

Microsoft_VC80_ATL_x86

Microsoft_VC80_CRT_x86

Microsoft_VC80_MFC_x86

Microsoft_VC80_MFCLOC_x86

Microsoft_VC90_ATL_x86

Microsoft_VC90_CRT_x86

Microsoft_VC90_MFC_x86

Microsoft_VC90_MFCLOC_x86

Mozilla Firefox 14.0.1 (x86 en-US)

Mozilla Maintenance Service

MSVCRT

MSVCRT_amd64

NCsoft Launcher

Nexon Game Manager

OnLive

osu!

Pando Media Booster

PCGen5164

PlayItAll media player 1.0.5

Pokemon Online 1.0.30 Patch 1

Poker Night at the Inventory

Portal

Portal 2

PowerDVD DX

Puzzle Pirates

Quick PocketSetup Standard

QuickTime

Ragnarok Online

Realtek 8136 8168 8169 Ethernet Driver

Realtek Ethernet Network Card Diagnostic tool for Windows Vista

Realtek High Definition Audio Driver

RebirthRO

Redblade 1.3.0.16 RC 1

RemnantKnights 1.00406

RIFT

Roaring Dice

Roxio Creator Audio

Roxio Creator Copy

Roxio Creator Data

Roxio Creator DE

Roxio Creator Tools

Roxio Express Labeler 3

Roxio Update Manager

Runes of Magic

RustyHearts PWE

Safari

Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition

Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition

Security Update for Microsoft Office InfoPath 2007 (KB2596786) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition

Sid Meier's Civilization V

Skype Click to Call

Skype™ 5.8

Soldier Front

Solitairy Confinement

Source SDK Base

SpeedFan (remove only)

Speedy Eggbert Special Edition

Spyware Doctor 8.0

Star Wars: The Old Republic

Steam

Super Mario Bros. X version 1.3

swMSM

System Requirements Lab CYRI

System Requirements Lab for Intel

TERA

The Answer

TuneUp Companion 2.0.10

Unity Web Player

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office OneNote 2007 Help (KB963670)

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

Update Installer for WildTangent Games App

Ventrilo Client

Vindictus

Vizzed Retro Game Room

WildTangent Games

WildTangent Games App (Dell Games)

Windows Live Communications Platform

Windows Live Essentials

Windows Live Installer

Windows Live Mail

Windows Live Messenger

Windows Live Movie Maker

Windows Live OneCare safety scanner

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live Sync

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

WinRAR archiver

Yahoo! Detect

.

==== Event Viewer Messages From Past Week ========

.

8/9/2012 9:22:30 AM, Error: NetBT [4321] - The name "KELLIE-PC :0" could not be registered on the interface with IP address 192.168.1.103. The computer with the IP address 192.168.1.108 did not allow the name to be claimed by this computer.

8/9/2012 8:17:44 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Advanced Networking Service service to connect.

8/9/2012 8:17:11 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Apple Mobile Device service to connect.

8/9/2012 8:17:11 PM, Error: Service Control Manager [7000] - The Apple Mobile Device service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

8/9/2012 8:14:50 PM, Error: Service Control Manager [7034] - The Andrea RT Filters Service service terminated unexpectedly. It has done this 1 time(s).

8/5/2012 4:38:40 AM, Error: NetBT [4321] - The name "JAMESSAYLOR-PC :0" could not be registered on the interface with IP address 192.168.1.103. The computer with the IP address 192.168.1.111 did not allow the name to be claimed by this computer.

8/11/2012 5:45:44 AM, Error: NetBT [4321] - The name "KELLIE-PC :0" could not be registered on the interface with IP address 192.168.1.103. The computer with the IP address 192.168.1.104 did not allow the name to be claimed by this computer.

8/11/2012 5:27:21 AM, Error: Service Control Manager [7000] - The McAfee Services service failed to start due to the following error: The system cannot find the file specified.

8/11/2012 5:27:19 AM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.

8/11/2012 5:25:35 AM, Error: Service Control Manager [7023] - The Function Discovery Resource Publication service terminated with the following error: %%-2147024891

8/11/2012 5:25:35 AM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Resource Publication service which failed to start because of the following error: %%-2147024891

8/11/2012 5:24:41 AM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.

8/11/2012 5:24:37 AM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.

8/11/2012 5:24:37 AM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.

8/11/2012 5:24:37 AM, Error: Service Control Manager [7000] - The McAfee Anti-Spam Service service failed to start due to the following error: The system cannot find the file specified.

8/11/2012 5:24:37 AM, Error: Service Control Manager [7000] - The LibUsb-Win32 - Daemon, Version 0.1.10.1 service failed to start due to the following error: The system cannot find the file specified.

8/11/2012 5:24:37 AM, Error: Service Control Manager [7000] - The Htsysm service failed to start due to the following error: The system cannot find the file specified.

8/11/2012 5:24:28 AM, Error: Application Popup [1060] - \SystemRoot\SysWow64\drivers\libusb0.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

8/11/2012 4:44:27 AM, Error: Service Control Manager [7034] - The LogMeIn Hamachi Tunneling Engine service terminated unexpectedly. It has done this 1 time(s).

8/11/2012 3:11:42 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

8/11/2012 3:05:21 AM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.

8/11/2012 3:05:20 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

8/11/2012 3:05:17 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

8/11/2012 3:05:11 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}

8/11/2012 3:05:04 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache spldr Wanarpv6

8/11/2012 3:05:02 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.

8/10/2012 6:46:31 PM, Error: Service Control Manager [7034] - The PC Tools Auxiliary Service service terminated unexpectedly. It has done this 1 time(s).

8/10/2012 6:46:21 PM, Error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

8/10/2012 6:45:03 PM, Error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

.

==== End Of File ===========================

.

Link to post
Share on other sites

Welcome to the forum.

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

Link to post
Share on other sites

RogueKiller V7.6.6 [08/10/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7600 ) 64 bits version

Started in : Normal mode

User: Michael [Admin rights]

Mode: Scan -- Date: 08/11/2012 06:59:37

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 7 ¤¤¤

[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND

[ZeroAccess] HKCR\[...]\InprocServer32 : (C:\Users\Michael\AppData\Local\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\n.) -> FOUND

[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FILE] @ : c:\windows\installer\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\@ --> FOUND

[ZeroAccess][FOLDER] U : c:\windows\installer\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\U --> FOUND

[ZeroAccess][FOLDER] L : c:\windows\installer\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\L --> FOUND

[ZeroAccess][FILE] @ : c:\users\michael\appdata\local\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\@ --> FOUND

[ZeroAccess][FOLDER] U : c:\users\michael\appdata\local\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\U --> FOUND

[ZeroAccess][FOLDER] L : c:\users\michael\appdata\local\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\L --> FOUND

[ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_32\desktop.ini --> FOUND

[ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_64\desktop.ini --> FOUND

[susp.ASLR][ASLR WIPED-OFF] services.exe : c:\windows\system32\services.exe --> FOUND

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

127.0.0.1 localhost

::1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD5000AAKS-75A7B2 ATA Device +++++

--- User ---

[MBR] 09a1db6b698473461dc9fc56bbac3912

[bSP] 346b64ba3606b9c23b53a66f6abcac30 : Windows 7 MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 62 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 129024 | Size: 15360 Mo

2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 31586304 | Size: 461516 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1].txt >>

RKreport[1].txt

Link to post
Share on other sites

Your computer is infected with a nasty rootkit. Please read the following information first.

You're infected with Rootkit.ZeroAccess, a BackDoor Trojan.

BACKDOOR WARNING

------------------------------

One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

http://www.dslreports.com/faq/10451

When Should I Format, How Should I Reinstall

http://www.dslreports.com/faq/10063

I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.

Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

-----------------------------------------

Please make sure system restore is running and create a new restore point before continuing!

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive. <-----

How to tell > 32 or 64 bit

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

On the System Recovery Options menu you will get the following options:



    • Startup Repair
      System Restore
      Windows Complete PC Restore
      Windows Memory Diagnostic Tool
      Command Prompt

    [*]Select Command Prompt

    [*]In the command window type in notepad and press Enter.

    [*]The notepad opens. Under File menu select Open.

    [*]Select "Computer" and find your flash drive letter and close the notepad.

    [*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

    Note: Replace letter e with the drive letter of your flash drive.

    [*]The tool will start to run.

    [*]When the tool opens click Yes to disclaimer.

    [*]Press Scan button.

    [*]FRST will let you know when the scan is complete and has written the FRST.txt to file, close out this message, then type the following into the search box:

    services.exe

    [*]Now press the Search button

    [*]When the search is complete, search.txt will also be written to your USB

    [*]Type exit and reboot the computer normally

    [*]Please copy and paste both logs in your reply.(FRST.txt and Search.txt)

MrC

Link to post
Share on other sites

Scan result of Farbar Recovery Scan Tool Version: 09-08-2012

Ran by SYSTEM at 11-08-2012 08:54:58

Running from G:\

Windows 7 Ultimate (X64) OS Language: English(US)

The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7970848 2009-07-14] (Realtek Semiconductor)

HKLM\...\Run: [igfxTray] C:\Windows\system32\igfxtray.exe [162584 2011-10-13] (Intel Corporation)

HKLM\...\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [386840 2011-10-13] (Intel Corporation)

HKLM\...\Run: [Persistence] C:\Windows\system32\igfxpers.exe [417560 2011-10-13] (Intel Corporation)

HKLM-x32\...\Run: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m [1779952 2009-07-07] ()

HKLM-x32\...\Run: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter [206064 2009-05-21] (SupportSoft, Inc.)

HKLM-x32\...\Run: [mcagent_exe] "C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe" /runkey [x]

HKLM-x32\...\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [47904 2010-09-21] (Apple Inc.)

HKLM-x32\...\Run: [DivX Download Manager] "C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe" start [x]

HKLM-x32\...\Run: [AmazonGSDownloaderTray] C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe [326144 2009-10-23] (Amazon.com)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35696 2009-10-03] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-02] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [140520 2009-06-24] (CyberLink Corp.)

HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-11-01] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2011-10-24] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2012-01-16] (Apple Inc.)

HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start [1996200 2012-06-27] (LogMeIn Inc.)

HKLM-x32\...\Run: [Aeria Ignite] "C:\Program Files (x86)\Aeria Games\Ignite\aeriaignite.exe" silent [1403032 2012-07-19] (Aeria Games & Entertainment)

HKU\Michael\...\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background [4280184 2012-03-08] (Microsoft Corporation)

HKU\Michael\...\Run: [steam] "C:\Program Files (x86)\Steam\steam.exe" -silent [1353080 2012-08-09] (Valve Corporation)

HKU\Michael\...\Run: [GateWay] C:\Windows\system32\GateWayMain.exe [x]

HKU\Michael\...\Run: [PlayNC Launcher] [x]

HKU\Michael\...\Run: [Akamai NetSession Interface] "C:\Users\Michael\AppData\Local\Akamai\netsession_win.exe" [4327744 2012-05-26] (Akamai Technologies, Inc)

HKU\Michael\...\Run: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [17148552 2012-02-29] (Skype Technologies S.A.)

HKU\Michael\...\Run: [speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup [44544 2009-07-13] (Microsoft Corporation)

HKLM-x32\...\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe [165104 2009-07-16] (Softthinks)

Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X]

Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation)

Tcpip\Parameters: [DhcpNameServer] 204.68.227.1 204.68.227.2

Startup: C:\Users\All Users\Start Menu\Programs\Startup\Dell Remote Access.lnk

ShortcutTarget: Dell Remote Access.lnk -> C:\Windows\Installer\{F66A31D9-7831-4FBA-BA02-C411C0047CC5}\NewShortcut4_F66A31D978314FBABA02C411C0047CC5.exe (Acresso Software Inc.)

Startup: C:\Users\All Users\Start Menu\Programs\Startup\WhiteSmoke Translator.lnk

ShortcutTarget: WhiteSmoke Translator.lnk -> (No File)

Startup: C:\Users\Michael\Start Menu\Programs\Startup\GameStop Now.lnk

ShortcutTarget: GameStop Now.lnk -> C:\Program Files (x86)\GameStop App\Now\GameStopNow.exe (GameStop Corp.)

==================== Services (Whitelisted) ======

2 Hamachi2Svc; "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe" -s [2369960 2012-06-27] (LogMeIn Inc.)

2 libusbd; C:\Windows\SysWow64\libusbd-nt.exe [18944 2005-03-09] (http://libusb-win32.sourceforge.net)

2 McNASvc; C:\Program Files (x86)\Common Files\mcafee\mna\mcnasvc.exe [2482848 2009-07-07] (McAfee, Inc.)

2 McProxy; C:\Program Files (x86)\Common Files\McAfee\McProxy\McProxy.exe [359952 2009-07-08] (McAfee, Inc.)

2 sdAuxService; C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe [366840 2010-03-15] (PC Tools)

3 sdCoreService; C:\Program Files (x86)\PC Tools Security\pctsSvc.exe [1150936 2010-11-19] (PC Tools)

3 stllssvr; "C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe" [74384 2008-03-24] (MicroVision Development, Inc.)

3 aspnet_state; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [x]

2 mcmscsvc; C:\Program Files (x86)\McAfee\MSC\mcmscsvc.exe [x]

3 MozillaMaintenance; "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" [x]

2 MSK80Service; "C:\Program Files (x86)\McAfee\MSK\MskSrver.exe" [x]

========================== Drivers (Whitelisted) =============

3 cpudrv64; \??\C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()

1 dtsoftbus01; C:\Windows\System32\Drivers\dtsoftbus01.sys [283200 2012-02-04] (DT Soft Ltd)

3 hamachi; C:\Windows\System32\Drivers\hamachi.sys [33856 2009-03-18] (LogMeIn, Inc.)

3 libusb0; C:\Windows\SysWow64\Drivers\libusb0.sys [33792 2005-03-09] ()

1 MPFP; C:\Windows\System32\Drivers\MPFP.sys [176144 2009-04-09] (McAfee, Inc.)

0 PCTCore; C:\Windows\System32\drivers\PCTCore64.sys [257232 2010-11-25] (PC Tools)

0 pctDS; C:\Windows\System32\drivers\pctDS64.sys [452872 2010-06-29] (PC Tools)

2 RtNdPt60; C:\Windows\System32\Drivers\RtNdPt60.sys [26624 2008-07-21] (Windows ® Codename Longhorn DDK provider)

3 RTTEAMPT; C:\Windows\System32\DRIVERS\RtTeam60.sys [43008 2008-10-24] (Realtek Corporation)

3 RTVLANPT; C:\Windows\System32\DRIVERS\RtVlan60.sys [24064 2007-12-03] (Windows ® Codename Longhorn DDK provider)

0 speedfan; C:\Windows\SysWow64\speedfan.sys [14104 2007-02-07] (Windows ® Server 2003 DDK provider)

2 {1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7}; \??\C:\Program Files (x86)\CyberLink\PowerDVD DX\000.fcl [146928 2009-06-24] (CyberLink Corp.)

3 dump_wmimmc; \??\C:\gPotato\IrisOnline\GameGuard\dump_wmimmc.sys [x]

3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]

2 Htsysm; \??\C:\Windows\system32\HtsysmNT.sys [x]

3 NPPTNT2; \??\C:\Windows\system32\npptNT2.sys [x]

3 X6va003; \??\C:\Users\Michael\AppData\Local\Temp\003F2B.tmp [x]

3 X6va005; \??\C:\Users\Michael\AppData\Local\Temp\005E5C1.tmp [x]

========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============

2012-08-11 02:59 - 2012-08-11 02:59 - 00002629 ____A C:\Users\Michael\Desktop\RKreport[1].txt

2012-08-11 02:17 - 2012-08-11 02:17 - 00607260 ____R (Swearware) C:\Users\Michael\Desktop\dds.scr

2012-08-11 02:17 - 2012-08-11 02:17 - 00607260 ____A (Swearware) C:\Users\Michael\Downloads\dds.scr

2012-08-11 01:58 - 2012-08-11 01:59 - 01439703 ____A (Farbar) C:\Users\Michael\Downloads\FRST64.exe

2012-08-11 01:57 - 2012-08-11 01:59 - 00000000 ____D C:\Users\Michael\Desktop\RK_Quarantine

2012-08-11 01:57 - 2012-08-11 01:57 - 01558528 ____A C:\Users\Michael\Desktop\RogueKiller.exe

2012-08-11 01:27 - 2012-08-11 01:27 - 00000000 ____D C:\Users\Michael\AppData\Local\{3BF5B61F-5595-46E6-85B2-B4FDEFE05BB8}

2012-08-11 01:26 - 2012-08-11 01:27 - 00000000 ____D C:\Users\Michael\AppData\Local\{F812BC98-6D58-4ABC-AC42-9534B9A36CFE}

2012-08-11 00:48 - 2012-08-11 00:49 - 16814136 ____A (Mozilla) C:\Users\Michael\Downloads\Firefox Setup 14.0.1.exe

2012-08-10 15:30 - 2012-08-10 23:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2012-08-10 15:30 - 2012-08-10 15:30 - 00001096 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk

2012-08-10 12:09 - 2012-08-10 12:09 - 00000000 ____D C:\Users\Michael\AppData\Local\{74C8FCDE-A376-4346-89B6-993306FFE9AB}

2012-08-10 12:08 - 2012-08-10 12:09 - 00000000 ____D C:\Users\Michael\AppData\Local\{8B59C57A-A82C-48AA-B19C-91A25E4598BB}

2012-08-09 23:59 - 2012-08-09 23:59 - 00000000 __SHD C:\Windows\SysWOW64\%APPDATA%

2012-08-09 19:27 - 2012-08-10 15:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2012-08-09 19:27 - 2012-08-09 19:27 - 00000000 ____D C:\Users\Michael\AppData\Roaming\Mozilla

2012-08-09 19:27 - 2012-08-09 19:27 - 00000000 ____D C:\Users\Michael\AppData\Local\Mozilla

2012-08-09 19:27 - 2012-08-09 19:27 - 00000000 ____D C:\Users\All Users\Mozilla

2012-08-09 19:26 - 2012-08-09 19:26 - 00000125 ____A C:\Users\Michael\AppData\Roaming\mbam.context.scan

2012-08-09 19:14 - 2012-08-09 19:14 - 00001990 ____A C:\Users\Public\Desktop\Aeria Ignite.lnk

2012-08-09 19:14 - 2012-08-09 19:14 - 00000000 ____D C:\Program Files (x86)\Aeria Games

2012-08-09 15:39 - 2012-08-09 15:39 - 00000000 ____D C:\Users\Michael\AppData\Local\{3C31E1C6-DBE7-4056-A885-A584D87DFA87}

2012-08-09 15:38 - 2012-08-09 15:39 - 00000000 ____D C:\Users\Michael\AppData\Local\{40CB89F5-F51C-4D1E-B941-690509A0D2D4}

2012-08-09 14:50 - 2012-08-09 14:50 - 00000000 ____D C:\Users\Michael\AppData\Local\{D01B9486-35B0-49DA-8990-DE13AE636559}

2012-08-09 14:50 - 2012-08-09 14:50 - 00000000 ____D C:\Users\Michael\AppData\Local\{3D5EE946-862F-40D1-B74E-2B6A63652EE9}

2012-08-09 06:51 - 2012-08-09 06:51 - 00000368 ____A C:\Users\All Users\VMx0JaHseUt3g1

2012-08-09 06:51 - 2012-08-09 06:51 - 00000072 ____A C:\Users\All Users\-VMx0JaHseUt3g1r

2012-08-09 06:51 - 2012-08-09 06:51 - 00000072 ____A C:\Users\All Users\-VMx0JaHseUt3g1

2012-08-09 06:51 - 2012-08-09 06:51 - 00000000 __SHD C:\Windows\System32\%APPDATA%

2012-08-09 06:02 - 2012-08-09 06:02 - 00000000 ___HD C:\Users\Michael\AppData\Local\{8B767F75-8520-4ACD-8B25-119E6222029E}

2012-08-09 06:01 - 2012-08-09 06:02 - 00000000 ___HD C:\Users\Michael\AppData\Local\{9D0F5404-F4F2-48EE-A35D-F8C280149C14}

2012-08-08 18:01 - 2012-08-08 18:01 - 00000000 ___HD C:\Users\Michael\AppData\Local\{A1EDA719-43BE-4006-8A57-129EB995D4FE}

2012-08-08 18:00 - 2012-08-08 18:01 - 00000000 ___HD C:\Users\Michael\AppData\Local\{374A6C34-33CE-460F-B63B-DEE5AECEF476}

2012-08-08 06:00 - 2012-08-08 06:00 - 00000000 ___HD C:\Users\Michael\AppData\Local\{E4C53996-BECF-4064-922F-3B6BEEBDDC85}

2012-08-08 06:00 - 2012-08-08 06:00 - 00000000 ___HD C:\Users\Michael\AppData\Local\{8322B0AB-6D56-4A23-B981-B34D0DC11B43}

2012-08-07 17:59 - 2012-08-07 18:00 - 00000000 ___HD C:\Users\Michael\AppData\Local\{1E400C9E-FCCF-4C52-AAE3-0474A804B287}

2012-08-07 17:59 - 2012-08-07 17:59 - 00000000 ___HD C:\Users\Michael\AppData\Local\{804B0B9F-BA0B-4BC5-8E47-590E1ED529F2}

2012-08-07 05:59 - 2012-08-07 05:59 - 00000000 ___HD C:\Users\Michael\AppData\Local\{48966CF7-AB34-40CA-A149-4CED541A10C8}

2012-08-07 05:58 - 2012-08-07 05:59 - 00000000 ___HD C:\Users\Michael\AppData\Local\{2316D9A3-3995-4EB0-9C05-0D8D34DE6D68}

2012-08-06 17:58 - 2012-08-06 17:58 - 00000000 ___HD C:\Users\Michael\AppData\Local\{3AF4DC64-940B-4979-8368-7281267C8E52}

2012-08-06 17:57 - 2012-08-06 17:58 - 00000000 ___HD C:\Users\Michael\AppData\Local\{7BEE0AF5-CEB3-4FE5-A72A-3DB583AAE372}

2012-08-06 05:57 - 2012-08-06 05:57 - 00000000 ___HD C:\Users\Michael\AppData\Local\{83C7DD3D-CC54-4505-9136-598CA9F4CF28}

2012-08-06 05:57 - 2012-08-06 05:57 - 00000000 ___HD C:\Users\Michael\AppData\Local\{7EB1A630-E558-4BBF-9693-2F5BCC1D0F7F}

2012-08-05 17:57 - 2012-08-05 17:57 - 00000000 ___HD C:\Users\Michael\AppData\Local\{C436AA80-B031-4827-A37D-A648F6402321}

2012-08-05 17:56 - 2012-08-05 17:57 - 00000000 ___HD C:\Users\Michael\AppData\Local\{A4F77EEC-BA99-4E32-9D1E-1D1694F180FD}

2012-08-05 05:56 - 2012-08-05 05:56 - 00000000 ___HD C:\Users\Michael\AppData\Local\{C031809B-C84C-4326-BD14-449F5E8C2153}

2012-08-05 05:55 - 2012-08-05 05:56 - 00000000 ___HD C:\Users\Michael\AppData\Local\{693C942B-C723-453A-944A-EACE5022A07F}

2012-08-04 17:55 - 2012-08-04 17:55 - 00000000 ___HD C:\Users\Michael\AppData\Local\{35409FBA-5D53-41A2-BFAC-EF837B05E1B6}

2012-08-04 17:55 - 2012-08-04 17:55 - 00000000 ___HD C:\Users\Michael\AppData\Local\{265489AE-4081-4620-888A-FBC133CFA08F}

2012-08-04 05:54 - 2012-08-04 05:54 - 00000000 ___HD C:\Users\Michael\AppData\Local\{B8B27B20-C798-4258-BA2F-34AA27C16A11}

2012-08-04 05:54 - 2012-08-04 05:54 - 00000000 ___HD C:\Users\Michael\AppData\Local\{2B4A10DE-5CE0-4F49-A93D-F4628F2965B1}

2012-08-03 17:54 - 2012-08-03 17:54 - 00000000 ___HD C:\Users\Michael\AppData\Local\{BDE6A004-6451-4C25-8CD2-0C2738D8C331}

2012-08-03 17:53 - 2012-08-03 17:54 - 00000000 ___HD C:\Users\Michael\AppData\Local\{114471B2-B66B-4852-90A8-8029A407EA72}

2012-08-03 05:53 - 2012-08-03 05:53 - 00000000 ___HD C:\Users\Michael\AppData\Local\{A7291689-B01E-4419-8D4F-BE2D739539E3}

2012-08-03 05:52 - 2012-08-03 05:53 - 00000000 ___HD C:\Users\Michael\AppData\Local\{98B7CEC5-ADC5-4329-A34E-4B8F666DAD5B}

2012-08-02 17:52 - 2012-08-02 17:52 - 00000000 ___HD C:\Users\Michael\AppData\Local\{CD8B0EF2-71EA-47BF-A1D2-FA56E2D45286}

2012-08-02 17:52 - 2012-08-02 17:52 - 00000000 ___HD C:\Users\Michael\AppData\Local\{6A5ED17B-96E9-44A3-81A8-223CD10CBA34}

2012-08-02 05:51 - 2012-08-02 05:51 - 00000000 ___HD C:\Users\Michael\AppData\Local\{C93BD8DC-6D81-4FF8-A5C2-3C2CBF39013E}

2012-08-02 05:51 - 2012-08-02 05:51 - 00000000 ___HD C:\Users\Michael\AppData\Local\{778A73D7-14B9-463D-AE32-C74B40E67AFF}

2012-08-02 03:31 - 2012-08-02 03:31 - 00000000 ____D C:\Users\Default\AppData\LocalGoogle

2012-08-02 03:31 - 2012-08-02 03:31 - 00000000 ____D C:\Users\Default\AppData\Local\Google

2012-08-02 03:31 - 2012-08-02 03:31 - 00000000 ____D C:\Users\Default User\AppData\LocalGoogle

2012-08-02 03:31 - 2012-08-02 03:31 - 00000000 ____D C:\Users\Default User\AppData\Local\Google

2012-08-01 17:51 - 2012-08-01 17:51 - 00000000 ___HD C:\Users\Michael\AppData\Local\{F3F1D829-2722-4AEE-B23F-F620EBE238D1}

2012-08-01 17:50 - 2012-08-01 17:51 - 00000000 ___HD C:\Users\Michael\AppData\Local\{31E0C173-7806-4F7F-B698-3B13CB2B667A}

2012-08-01 05:50 - 2012-08-01 05:50 - 00000000 ___HD C:\Users\Michael\AppData\Local\{4F8E872B-5754-4283-92EA-2A11AB2BDD85}

2012-08-01 05:49 - 2012-08-01 05:50 - 00000000 ___HD C:\Users\Michael\AppData\Local\{89D19DC8-EE26-4070-933C-911C18CC35C7}

2012-07-31 17:49 - 2012-07-31 17:49 - 00000000 ___HD C:\Users\Michael\AppData\Local\{82D1CBC5-8DE7-43B8-82D9-B2DFDD335453}

2012-07-31 17:49 - 2012-07-31 17:49 - 00000000 ___HD C:\Users\Michael\AppData\Local\{040FCE48-DF46-4935-B257-ECF51ACE9958}

2012-07-31 05:48 - 2012-07-31 05:48 - 00000000 ___HD C:\Users\Michael\AppData\Local\{8382E5A4-475D-4F2D-9F53-36C55EB92798}

2012-07-31 05:48 - 2012-07-31 05:48 - 00000000 ___HD C:\Users\Michael\AppData\Local\{46D870FA-FE40-4D01-B8B7-6B17603F6132}

2012-07-30 17:48 - 2012-07-30 17:48 - 00000000 ___HD C:\Users\Michael\AppData\Local\{59E89E9B-E87F-47BA-A9AD-DB011AC46209}

2012-07-30 17:47 - 2012-07-30 17:48 - 00000000 ___HD C:\Users\Michael\AppData\Local\{A9341B52-D75D-42F1-B4F8-979D173B2F5A}

2012-07-30 05:47 - 2012-07-30 05:47 - 00000000 ___HD C:\Users\Michael\AppData\Local\{F3E3A187-64F5-4E03-9950-ACBC4D135FB4}

2012-07-30 05:46 - 2012-07-30 05:47 - 00000000 ___HD C:\Users\Michael\AppData\Local\{25A2FCCA-8066-4740-A3AB-8126919971E6}

2012-07-29 17:46 - 2012-07-29 17:46 - 00000000 ___HD C:\Users\Michael\AppData\Local\{F3CB5CD3-C1C2-425C-AD39-7F1804A17988}

2012-07-29 17:46 - 2012-07-29 17:46 - 00000000 ___HD C:\Users\Michael\AppData\Local\{C2E1159B-D0A6-4D02-BACF-DDC0627E70F5}

2012-07-29 05:45 - 2012-07-29 05:46 - 00000000 ___HD C:\Users\Michael\AppData\Local\{F2311DC9-E2CE-411C-996E-61FB9F244679}

2012-07-29 05:45 - 2012-07-29 05:45 - 00000000 ___HD C:\Users\Michael\AppData\Local\{5E139895-A274-4704-B75B-7A2029CF825E}

2012-07-28 17:45 - 2012-07-28 17:45 - 00000000 ___HD C:\Users\Michael\AppData\Local\{F102563C-A0B6-4FE4-AB54-FABC54B1202A}

2012-07-28 17:44 - 2012-07-28 17:45 - 00000000 ___HD C:\Users\Michael\AppData\Local\{AA9BA8A8-4936-4396-9559-379BA694A6C2}

2012-07-27 23:58 - 2012-07-27 23:59 - 00000000 ___HD C:\Users\Michael\AppData\Local\{5FD4A065-65A7-4651-A78D-1A01C8930084}

2012-07-27 23:58 - 2012-07-27 23:58 - 00000000 ___HD C:\Users\Michael\AppData\Local\{CDE338C2-DD77-4BC5-9FD9-8DFA94A107B0}

2012-07-27 11:58 - 2012-07-27 11:58 - 00000000 ___HD C:\Users\Michael\AppData\Local\{E3A124B1-3090-440F-AE4C-C4F53D6972F1}

2012-07-27 11:57 - 2012-07-27 11:58 - 00000000 ___HD C:\Users\Michael\AppData\Local\{307CF855-3212-4548-AD4D-8B30E8BFB498}

2012-07-26 23:57 - 2012-07-26 23:57 - 00000000 ___HD C:\Users\Michael\AppData\Local\{E79E5CE5-44A3-4B65-B42B-AE89ECE8EB14}

2012-07-26 23:56 - 2012-07-26 23:57 - 00000000 ___HD C:\Users\Michael\AppData\Local\{FAF95B0D-E974-432E-9E86-A7D838FE76FD}

2012-07-26 11:56 - 2012-07-26 11:56 - 00000000 ___HD C:\Users\Michael\AppData\Local\{D32F07A8-DDAE-4304-95E0-BD31A4CD3480}

2012-07-26 11:56 - 2012-07-26 11:56 - 00000000 ___HD C:\Users\Michael\AppData\Local\{66CA3E71-A272-43A6-B0BB-4B5E7953B107}

2012-07-25 23:55 - 2012-07-25 23:56 - 00000000 ___HD C:\Users\Michael\AppData\Local\{2D613B42-F721-42F6-B5F8-B6E91F69B941}

2012-07-25 23:55 - 2012-07-25 23:55 - 00000000 ___HD C:\Users\Michael\AppData\Local\{A79B5BA1-6216-4B2D-8D51-4783AC9F593E}

2012-07-25 11:55 - 2012-07-25 11:55 - 00000000 ___HD C:\Users\Michael\AppData\Local\{F18EABAF-C642-482A-AF8B-6A01B8132733}

2012-07-25 11:54 - 2012-07-25 11:55 - 00000000 ___HD C:\Users\Michael\AppData\Local\{A47C691D-4FF0-4D1A-927D-71F414592B10}

2012-07-24 23:54 - 2012-07-24 23:54 - 00000000 ___HD C:\Users\Michael\AppData\Local\{26580309-2A65-4C1E-B853-A269DC419902}

2012-07-24 23:53 - 2012-07-24 23:54 - 00000000 ___HD C:\Users\Michael\AppData\Local\{ABED64D5-F639-4E9C-A187-6936D75A4AE0}

2012-07-24 11:53 - 2012-07-24 11:53 - 00000000 ___HD C:\Users\Michael\AppData\Local\{A2B8C81A-DF5A-4925-95C9-FD01FE5429E7}

2012-07-24 11:53 - 2012-07-24 11:53 - 00000000 ___HD C:\Users\Michael\AppData\Local\{8C60559E-A29B-43D7-B280-E5966B9C86E2}

2012-07-23 10:21 - 2012-07-23 10:21 - 00000000 ___HD C:\Users\Michael\AppData\Local\{9ACA9593-D418-4700-93C8-4184787C7073}

2012-07-23 10:21 - 2012-07-23 10:21 - 00000000 ___HD C:\Users\Michael\AppData\Local\{6E87BEF3-9B05-4A1E-BEA9-C64EF052D8E6}

2012-07-22 22:20 - 2012-07-22 22:20 - 00000000 ___HD C:\Users\Michael\AppData\Local\{E5D0B376-2701-4C1D-B031-487FD6D03A44}

2012-07-22 22:20 - 2012-07-22 22:20 - 00000000 ___HD C:\Users\Michael\AppData\Local\{8BEFDB54-1865-422A-BD69-CD7A7D409986}

2012-07-22 10:35 - 2012-07-22 10:39 - 00000000 ___HD C:\Users\Michael\AppData\Local\Fallout3

2012-07-22 10:20 - 2012-07-22 10:20 - 00000000 ___HD C:\Users\Michael\AppData\Local\{C1EB4EDA-1530-4B5C-9E3C-7A8E311CE18B}

2012-07-22 10:19 - 2012-07-22 10:20 - 00000000 ___HD C:\Users\Michael\AppData\Local\{59C0C184-1F65-437D-B40F-878FA07B8E63}

2012-07-21 22:19 - 2012-07-21 22:19 - 00000000 ___HD C:\Users\Michael\AppData\Local\{62044A88-70FA-434B-8188-9F6C5A478478}

2012-07-21 22:18 - 2012-07-21 22:19 - 00000000 ___HD C:\Users\Michael\AppData\Local\{24FE15E7-A42C-4AEE-9198-9C5E037B072F}

2012-07-21 10:18 - 2012-07-21 10:18 - 00000000 ___HD C:\Users\Michael\AppData\Local\{B723798D-F66A-43C7-AD24-FCCDBD4FB295}

2012-07-21 10:18 - 2012-07-21 10:18 - 00000000 ___HD C:\Users\Michael\AppData\Local\{33CEBAE1-A1BE-4B80-9BFB-928D0014036C}

2012-07-20 22:17 - 2012-07-20 22:18 - 00000000 ___HD C:\Users\Michael\AppData\Local\{F00A9F92-D26A-48E6-B0A1-EB14165A74A9}

2012-07-20 10:16 - 2012-07-20 10:16 - 00000000 ___HD C:\Users\Michael\AppData\Local\{3F6906DE-0984-4C20-9A15-813DEE74EB7A}

2012-07-20 10:15 - 2012-07-20 22:17 - 00000000 ___HD C:\Users\Michael\AppData\Local\{F11C793B-467D-4316-9FF7-9DDE7B95B429}

2012-07-19 21:36 - 2012-07-19 21:36 - 00000000 ___HD C:\Users\Michael\AppData\Local\{D0C3E551-0E81-4D89-8B04-669C1242213C}

2012-07-19 21:36 - 2012-07-19 21:36 - 00000000 ___HD C:\Users\Michael\AppData\Local\{60373E65-5276-454B-8AB7-85717D2AA795}

2012-07-19 09:35 - 2012-07-19 09:35 - 00000000 ___HD C:\Users\Michael\AppData\Local\{586C6DA2-0489-4FFE-BED9-31265FACDC14}

2012-07-19 09:35 - 2012-07-19 09:35 - 00000000 ___HD C:\Users\Michael\AppData\Local\{4B20965C-0B57-4DB5-A749-77CA2273DA95}

2012-07-18 21:35 - 2012-07-18 21:35 - 00000000 ___HD C:\Users\Michael\AppData\Local\{E3A08AF7-548B-4BE1-B8B5-2F23104E2AE2}

2012-07-18 21:34 - 2012-07-18 21:35 - 00000000 ___HD C:\Users\Michael\AppData\Local\{59608013-3640-41A9-B055-959C0FFC694E}

2012-07-18 09:34 - 2012-07-18 09:34 - 00000000 ___HD C:\Users\Michael\AppData\Local\{FF347192-F080-48D2-9AF9-B9ADECCCE1FA}

2012-07-18 09:33 - 2012-07-18 09:34 - 00000000 ___HD C:\Users\Michael\AppData\Local\{05169D71-794F-4CC1-8C27-1740B6B336FE}

2012-07-17 21:33 - 2012-07-17 21:33 - 00000000 ___HD C:\Users\Michael\AppData\Local\{7DDBFFB2-4C57-44E5-B71B-0F03F91E1096}

2012-07-17 21:33 - 2012-07-17 21:33 - 00000000 ___HD C:\Users\Michael\AppData\Local\{66EA78E4-7A89-4A8A-B262-C59B77A96D09}

2012-07-17 09:32 - 2012-07-17 09:33 - 00000000 ___HD C:\Users\Michael\AppData\Local\{F60C0665-2CC8-4AD8-991C-FE3047B52182}

2012-07-17 09:32 - 2012-07-17 09:32 - 00000000 ___HD C:\Users\Michael\AppData\Local\{D296ACD4-F0D0-4B6E-9AA4-1F443B92784A}

2012-07-16 21:32 - 2012-07-16 21:32 - 00000000 ___HD C:\Users\Michael\AppData\Local\{8E511B5B-E451-4C29-BA69-DE6CC3F9A5BD}

2012-07-16 21:31 - 2012-07-16 21:32 - 00000000 ___HD C:\Users\Michael\AppData\Local\{5A6271CF-A1C7-491C-952D-793B83BE345C}

2012-07-16 13:42 - 2012-08-09 18:36 - 00000000 ___HD C:\Users\Michael\AppData\Local\PCGen

2012-07-16 13:25 - 2012-08-09 18:13 - 00000000 ____D C:\Program Files\Oracle

2012-07-16 13:24 - 2012-07-16 13:23 - 00955888 ____A (Oracle Corporation) C:\Windows\System32\npDeployJava1.dll

2012-07-16 13:24 - 2012-07-16 13:23 - 00839152 ____A (Oracle Corporation) C:\Windows\System32\deployJava1.dll

2012-07-16 13:24 - 2012-07-16 13:23 - 00268784 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe

2012-07-16 13:24 - 2012-07-16 13:23 - 00189424 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe

2012-07-16 13:24 - 2012-07-16 13:23 - 00188912 ____A (Oracle Corporation) C:\Windows\System32\java.exe

2012-07-16 13:12 - 2012-08-09 18:42 - 00000000 ____D C:\Users\Michael\jdk1.7.0_05_combo

2012-07-16 13:08 - 2012-07-16 13:12 - 96847848 ____A (Oracle Corporation) C:\Users\Michael\Downloads\jdk-7u5-windows-x64.exe

2012-07-16 13:06 - 2012-07-16 13:07 - 37765489 ____A C:\Users\Michael\Downloads\pcgen51715_win_install.exe

2012-07-16 09:31 - 2012-07-16 09:31 - 00000000 ___HD C:\Users\Michael\AppData\Local\{DE403065-1609-4AE4-9C02-20A20CC84BA3}

2012-07-16 09:30 - 2012-07-16 09:31 - 00000000 ___HD C:\Users\Michael\AppData\Local\{C899259A-6942-4F34-9198-C2880617A73A}

2012-07-15 21:30 - 2012-07-15 21:30 - 00000000 ___HD C:\Users\Michael\AppData\Local\{60EC199A-F737-4A58-B1E9-FCD1AF3884E7}

2012-07-15 21:30 - 2012-07-15 21:30 - 00000000 ___HD C:\Users\Michael\AppData\Local\{21653E8D-8975-4899-8F22-95AD53C44824}

2012-07-15 11:55 - 2012-07-15 11:55 - 00000000 ___HD C:\Users\Michael\AppData\Local\GameStop

2012-07-15 09:29 - 2012-07-15 09:29 - 00000000 ___HD C:\Users\Michael\AppData\Local\{A12D9C28-8B15-40DE-BCB7-E97B332A33E6}

2012-07-15 09:29 - 2012-07-15 09:29 - 00000000 ___HD C:\Users\Michael\AppData\Local\{324FBF4D-FEAE-4C44-BCAA-1A17FDCAAC6C}

2012-07-14 21:29 - 2012-07-14 21:29 - 00000000 ___HD C:\Users\Michael\AppData\Local\{2292C8AB-A3C0-4B7F-A779-CDD30733F104}

2012-07-14 21:28 - 2012-07-14 21:29 - 00000000 ___HD C:\Users\Michael\AppData\Local\{89F1892D-9146-477D-92E1-AE3935094E24}

2012-07-14 09:28 - 2012-07-14 09:28 - 00000000 ___HD C:\Users\Michael\AppData\Local\{B50EAF6B-561B-4646-92AD-5AFBFBAC8310}

2012-07-14 09:27 - 2012-07-14 09:28 - 00000000 ___HD C:\Users\Michael\AppData\Local\{81779320-438D-4F8E-8182-3676B71D6985}

2012-07-13 21:27 - 2012-07-13 21:27 - 00000000 ___HD C:\Users\Michael\AppData\Local\{AF38AAEF-1427-4398-9368-B64A4B3552B7}

2012-07-13 21:27 - 2012-07-13 21:27 - 00000000 ___HD C:\Users\Michael\AppData\Local\{4A3A9A71-7959-43F3-B2C9-2E600060DFCD}

2012-07-13 09:26 - 2012-07-13 09:26 - 00000000 ___HD C:\Users\Michael\AppData\Local\{FB8AB212-39E6-459F-A5BB-30D52662AB78}

2012-07-13 09:26 - 2012-07-13 09:26 - 00000000 ___HD C:\Users\Michael\AppData\Local\{BF6DC393-BEA1-41C0-9413-74B2F24DD622}

2012-07-12 21:26 - 2012-07-12 21:26 - 00000000 ___HD C:\Users\Michael\AppData\Local\{BA3F600E-FF1D-4EDE-A8D9-35DE8CE0E0A7}

2012-07-12 21:25 - 2012-07-12 21:26 - 00000000 ___HD C:\Users\Michael\AppData\Local\{C093335A-026C-44EA-BD1A-B6A71DAE6400}

2012-07-12 09:25 - 2012-07-12 09:25 - 00000000 ___HD C:\Users\Michael\AppData\Local\{C8C370E6-1824-40C3-ACCB-0BF3A70C05BF}

2012-07-12 09:24 - 2012-07-12 09:25 - 00000000 ___HD C:\Users\Michael\AppData\Local\{6AFEAEB9-EA9C-4664-9A2D-5CF170BD4D58}

2012-07-12 02:53 - 2012-07-12 02:53 - 00000165 ____A C:\Users\Michael\Documents\Cireb robe of useful items.txt

============ 3 Months Modified Files ========================

2012-08-11 04:49 - 2009-11-16 17:01 - 00011104 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2012-08-11 04:49 - 2009-11-16 17:01 - 00011104 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2012-08-11 04:42 - 2012-06-27 16:20 - 00000896 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2012-08-11 04:42 - 2009-10-07 20:34 - 00000288 ____A C:\Windows\Tasks\RtlNICDiagVistaStart.job

2012-08-11 04:42 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2012-08-11 04:42 - 2009-07-13 20:51 - 00308785 ____A C:\Windows\setupact.log

2012-08-11 04:39 - 2012-04-11 21:44 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2012-08-11 04:30 - 2012-06-27 16:20 - 00000900 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2012-08-11 02:59 - 2012-08-11 02:59 - 00002629 ____A C:\Users\Michael\Desktop\RKreport[1].txt

2012-08-11 02:19 - 2009-11-16 17:27 - 01366536 ____A C:\Windows\WindowsUpdate.log

2012-08-11 02:17 - 2012-08-11 02:17 - 00607260 ____R (Swearware) C:\Users\Michael\Desktop\dds.scr

2012-08-11 02:17 - 2012-08-11 02:17 - 00607260 ____A (Swearware) C:\Users\Michael\Downloads\dds.scr

2012-08-11 01:59 - 2012-08-11 01:58 - 01439703 ____A (Farbar) C:\Users\Michael\Downloads\FRST64.exe

2012-08-11 01:57 - 2012-08-11 01:57 - 01558528 ____A C:\Users\Michael\Desktop\RogueKiller.exe

2012-08-11 01:24 - 2009-11-16 17:18 - 00176548 ____A C:\Windows\PFRO.log

2012-08-11 00:49 - 2012-08-11 00:48 - 16814136 ____A (Mozilla) C:\Users\Michael\Downloads\Firefox Setup 14.0.1.exe

2012-08-10 15:30 - 2012-08-10 15:30 - 00001096 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk

2012-08-09 19:26 - 2012-08-09 19:26 - 00000125 ____A C:\Users\Michael\AppData\Roaming\mbam.context.scan

2012-08-09 19:14 - 2012-08-09 19:14 - 00001990 ____A C:\Users\Public\Desktop\Aeria Ignite.lnk

2012-08-09 16:39 - 2012-04-11 21:44 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2012-08-09 16:39 - 2012-04-11 21:44 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2012-08-09 06:51 - 2012-08-09 06:51 - 00000368 ____A C:\Users\All Users\VMx0JaHseUt3g1

2012-08-09 06:51 - 2012-08-09 06:51 - 00000072 ____A C:\Users\All Users\-VMx0JaHseUt3g1r

2012-08-09 06:51 - 2012-08-09 06:51 - 00000072 ____A C:\Users\All Users\-VMx0JaHseUt3g1

2012-07-16 13:23 - 2012-07-16 13:24 - 00955888 ____A (Oracle Corporation) C:\Windows\System32\npDeployJava1.dll

2012-07-16 13:23 - 2012-07-16 13:24 - 00839152 ____A (Oracle Corporation) C:\Windows\System32\deployJava1.dll

2012-07-16 13:23 - 2012-07-16 13:24 - 00268784 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe

2012-07-16 13:23 - 2012-07-16 13:24 - 00189424 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe

2012-07-16 13:23 - 2012-07-16 13:24 - 00188912 ____A (Oracle Corporation) C:\Windows\System32\java.exe

2012-07-16 13:12 - 2012-07-16 13:08 - 96847848 ____A (Oracle Corporation) C:\Users\Michael\Downloads\jdk-7u5-windows-x64.exe

2012-07-16 13:07 - 2012-07-16 13:06 - 37765489 ____A C:\Users\Michael\Downloads\pcgen51715_win_install.exe

2012-07-14 15:22 - 2011-11-04 17:07 - 00000644 ____A C:\Users\Michael\.drjava

2012-07-12 03:28 - 2009-07-13 21:13 - 00005556 ____A C:\Windows\System32\PerfStringBackup.INI

2012-07-12 03:22 - 2009-07-13 20:45 - 04901752 ____A C:\Windows\System32\FNTCACHE.DAT

2012-07-12 02:53 - 2012-07-12 02:53 - 00000165 ____A C:\Users\Michael\Documents\Cireb robe of useful items.txt

2012-06-29 22:54 - 2012-06-29 22:54 - 00276888 ____A C:\Windows\Minidump\063012-42198-01.dmp

2012-06-29 22:54 - 2009-11-11 00:28 - 358254938 ____A C:\Windows\MEMORY.DMP

2012-06-27 16:25 - 2012-06-27 16:25 - 00001707 ____A C:\Users\Michael\Desktop\Google Drive.lnk

2012-06-27 16:19 - 2012-06-27 16:19 - 00740104 ____A (Google Inc.) C:\Users\Michael\Downloads\googledrivesync.exe

2012-06-27 16:18 - 2012-03-02 13:19 - 00002230 ____A C:\Users\Public\Desktop\CLANNAD Full Voice.lnk

2012-06-27 16:09 - 2012-06-27 16:08 - 18492072 ____A (Dropbox, Inc.) C:\Users\Michael\Downloads\Dropbox 1.4.9.exe

2012-06-26 21:06 - 2012-06-26 21:06 - 03857920 ____A C:\Users\Michael\Downloads\hamachi.msi

2012-06-26 17:28 - 2012-06-26 17:28 - 02105768 ____A C:\Users\Michael\Downloads\BlacklightRetribution_EN_0970.RC2a.exe

2012-06-22 00:09 - 2012-06-22 00:09 - 01042146 ____A C:\Users\Michael\Downloads\5164_piazo_pathfinder_alpha_update_07.pcz

2012-06-22 00:07 - 2012-06-22 00:06 - 07221876 ____A (LWD Technology, Inc. ) C:\Users\Michael\Downloads\hl39_starter_win_install.exe

2012-06-21 03:36 - 2009-10-07 20:58 - 00454812 ____A C:\Windows\DirectX.log

2012-06-17 01:00 - 2012-06-17 01:00 - 00000693 ____A C:\Users\Michael\Desktop\AeriaGames - Shortcut.lnk

2012-06-11 21:55 - 2012-06-11 21:55 - 00018138 ____A C:\Windows\System32\results.xml

2012-06-11 21:51 - 2012-06-11 21:44 - 41827200 ____A (Intel Corporation) C:\Users\Michael\Downloads\Win7Vista_64_151718.exe

2012-06-11 20:43 - 2012-06-11 20:43 - 01702072 ____A C:\Windows\Minidump\061212-26239-01.dmp

2012-06-11 20:13 - 2012-06-11 20:11 - 00000000 ____A C:\t11c

2012-06-11 19:02 - 2012-07-11 23:04 - 03147264 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2012-06-11 18:22 - 2012-06-11 18:22 - 01635472 ____A C:\Windows\Minidump\061112-21918-01.dmp

2012-06-11 17:49 - 2012-06-11 17:49 - 00000000 ____A C:\t5rc

2012-06-11 16:30 - 2012-06-11 16:30 - 01279208 ____A C:\Windows\Minidump\061112-26176-01.dmp

2012-06-11 08:21 - 2012-06-10 03:31 - 00000000 ____A C:\t47o

2012-06-10 03:32 - 2012-06-10 03:32 - 00000000 ____A C:\t47o.1

2012-06-09 03:37 - 2012-06-09 03:37 - 01702072 ____A C:\Windows\Minidump\060912-28407-01.dmp

2012-06-09 03:19 - 2012-06-09 02:07 - 00000000 ____A C:\tsk

2012-06-08 21:30 - 2012-07-11 00:42 - 14165504 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll

2012-06-08 20:46 - 2012-07-11 00:42 - 12868608 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2012-06-08 02:39 - 2012-06-08 02:39 - 01280480 ____A C:\Windows\Minidump\060812-28704-01.dmp

2012-06-07 21:21 - 2012-06-07 15:56 - 3703966663 ____A (Nexon) C:\Users\Michael\Downloads\VindictusSetupV154.exe

2012-06-07 19:00 - 2012-06-07 19:00 - 00137216 ____A (GameStop Corporation) C:\Users\Michael\Downloads\GameStopApp_setup.exe

2012-06-06 19:11 - 2012-06-06 00:44 - 00001489 ____A C:\Users\Michael\Documents\Nuzlocke Plan.txt

2012-06-05 21:50 - 2012-07-11 00:42 - 02003968 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll

2012-06-05 21:50 - 2012-07-11 00:42 - 01880064 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll

2012-06-05 21:09 - 2012-07-11 00:42 - 01389568 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2012-06-05 21:09 - 2012-07-11 00:42 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2012-06-02 14:19 - 2012-06-08 12:32 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll

2012-06-02 14:19 - 2012-06-08 12:32 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe

2012-06-02 14:19 - 2012-06-08 12:32 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll

2012-06-02 14:19 - 2012-06-08 12:31 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll

2012-06-02 14:19 - 2012-06-08 12:31 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll

2012-06-02 14:15 - 2012-06-08 12:32 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll

2012-06-02 14:15 - 2012-06-08 12:31 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll

2012-06-02 11:19 - 2012-06-08 12:31 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll

2012-06-02 11:15 - 2012-06-08 12:31 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe

2012-06-02 04:49 - 2012-07-11 23:01 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2012-06-02 04:17 - 2012-07-11 23:01 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2012-06-02 04:12 - 2012-07-11 23:01 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2012-06-02 04:05 - 2012-07-11 23:01 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2012-06-02 04:05 - 2012-07-11 23:01 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2012-06-02 04:04 - 2012-07-11 23:01 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl

2012-06-02 04:04 - 2012-07-11 23:01 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll

2012-06-02 04:03 - 2012-07-11 23:01 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2012-06-02 04:01 - 2012-07-11 23:01 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe

2012-06-02 04:00 - 2012-07-11 23:01 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2012-06-02 03:59 - 2012-07-11 23:01 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2012-06-02 03:57 - 2012-07-11 23:01 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2012-06-02 03:57 - 2012-07-11 23:01 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll

2012-06-02 03:54 - 2012-07-11 23:01 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2012-06-02 01:07 - 2012-07-11 23:01 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2012-06-02 00:43 - 2012-07-11 23:01 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2012-06-02 00:33 - 2012-07-11 23:01 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2012-06-02 00:26 - 2012-07-11 23:01 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2012-06-02 00:25 - 2012-07-11 23:01 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2012-06-02 00:25 - 2012-07-11 23:01 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2012-06-02 00:23 - 2012-07-11 23:01 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2012-06-02 00:21 - 2012-07-11 23:01 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2012-06-02 00:20 - 2012-07-11 23:01 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2012-06-02 00:19 - 2012-07-11 23:01 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2012-06-02 00:19 - 2012-07-11 23:01 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2012-06-02 00:17 - 2012-07-11 23:01 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2012-06-02 00:16 - 2012-07-11 23:01 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2012-06-02 00:14 - 2012-07-11 23:01 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2012-06-01 21:38 - 2012-07-11 00:42 - 00152432 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys

2012-06-01 21:38 - 2012-07-11 00:42 - 00095088 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys

2012-06-01 21:37 - 2012-07-11 00:42 - 00459216 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys

2012-06-01 21:27 - 2012-07-11 00:42 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll

2012-06-01 21:27 - 2012-07-11 00:42 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll

2012-06-01 20:48 - 2012-07-11 00:42 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2012-06-01 20:48 - 2012-07-11 00:42 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2012-06-01 20:47 - 2012-07-11 00:42 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2012-06-01 20:42 - 2012-07-11 00:42 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2012-06-01 00:05 - 2012-06-01 00:05 - 00000749 ____A C:\Users\Michael\Desktop\RemnantKnights.lnk

2012-05-31 17:26 - 2012-05-31 17:26 - 00492664 ____A (Aeria Games) C:\Users\Michael\Downloads\grandfantasia_us_downloader.exe

2012-05-31 13:34 - 2012-05-31 13:34 - 00001382 ____A C:\Users\Michael\Documents\FumakageSuit.dmi

ZeroAccess:

C:\Windows\Installer\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}

C:\Windows\Installer\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\@

C:\Windows\Installer\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\L

C:\Windows\Installer\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\U

C:\Windows\Installer\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\L\00000004.@

C:\Windows\Installer\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\L\201d3dde

C:\Windows\Installer\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\U\00000004.@

C:\Windows\Installer\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\U\00000008.@

C:\Windows\Installer\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\U\000000cb.@

C:\Windows\Installer\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\U\80000000.@

C:\Windows\Installer\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\U\80000032.@

C:\Windows\Installer\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\U\80000064.@

ZeroAccess:

C:\Users\Michael\AppData\Local\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}

C:\Users\Michael\AppData\Local\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\@

C:\Users\Michael\AppData\Local\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\L

C:\Users\Michael\AppData\Local\{7348cf8b-85fb-0a40-34fb-f4432c110ad6}\U

ZeroAccess:

C:\Windows\assembly\GAC_32\Desktop.ini

ZeroAccess:

C:\Windows\assembly\GAC_64\Desktop.ini

========================= Known DLLs (Whitelisted) ============

========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe 014A9CB92514E27C0107614DF764BC06 ZeroAccess <==== ATTENTION!.

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK

========================= Memory info ======================

Percentage of memory in use: 10%

Total physical RAM: 8157.18 MB

Available physical RAM: 7323.54 MB

Total Pagefile: 8155.33 MB

Available Pagefile: 7321.53 MB

Total Virtual: 8192 MB

Available Virtual: 8191.9 MB

======================= Partitions =========================

1 Drive c: (OS) (Fixed) (Total:450.7 GB) (Free:110.41 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

2 Drive d: (RECOVERY) (Fixed) (Total:15 GB) (Free:4.41 GB) NTFS

5 Drive g: () (Removable) (Total:1.83 GB) (Free:1.39 GB) FAT

8 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Disk ### Status Size Free Dyn Gpt

-------- ------------- ------- ------- --- ---

Disk 0 Online 465 GB 0 B

Disk 1 No Media 0 B 0 B

Disk 2 Online 1876 MB 0 B

Disk 3 No Media 0 B 0 B

Disk 4 No Media 0 B 0 B

Partitions of Disk 0:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 OEM 62 MB 31 KB

Partition 2 Primary 15 GB 63 MB

Partition 3 Primary 450 GB 15 GB

==================================================================================

Disk: 0

Partition 1

Type : DE

Hidden: Yes

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 7 FAT Partition 62 MB Healthy Hidden

==================================================================================

Disk: 0

Partition 2

Type : 07

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 1 D RECOVERY NTFS Partition 15 GB Healthy

==================================================================================

Disk: 0

Partition 3

Type : 07

Hidden: No

Active: Yes

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 2 C OS NTFS Partition 450 GB Healthy

==================================================================================

Partitions of Disk 2:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 1875 MB 68 KB

==================================================================================

Disk: 2

Partition 1

Type : 06

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 4 G FAT Removable 1875 MB Healthy

==================================================================================

Last Boot: 2012-08-10 17:54

======================= End Of Log ==========================

Farbar Recovery Scan Tool Version: 09-08-2012

Ran by SYSTEM at 2012-08-11 08:55:40

Running from G:\

================== Search: "services.exe" ===================

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\System32\services.exe

[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 014A9CB92514E27C0107614DF764BC06

====== End Of Search ======

Link to post
Share on other sites

OK, here you go......Please carefully carry out this procedure!!!!!!

Please download the attached fixlist.txt and copy it to your flashdrive.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options. (as you did before)

Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

MrC

Link to post
Share on other sites

Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 09-08-2012

Ran by SYSTEM at 2012-08-11 09:24:32 Run:1

Running from F:\

==============================================

C:\Windows\Installer\{7348cf8b-85fb-0a40-34fb-f4432c110ad6} moved successfully.

C:\Users\Michael\AppData\Local\{7348cf8b-85fb-0a40-34fb-f4432c110ad6} moved successfully.

C:\Windows\assembly\GAC_32\Desktop.ini moved successfully.

C:\Windows\assembly\GAC_64\Desktop.ini moved successfully.

C:\Windows\System32\services.exe moved successfully.

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe copied successfully to C:\Windows\System32\services.exe

==== End of Fixlog ====

Link to post
Share on other sites

Well Done, lets run ComboFix to clear up any leftovers.

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Link to post
Share on other sites

ComboFix 12-08-09.01 - Michael 08/11/2012 9:47.1.4 - x64

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.8157.6759 [GMT -4:00]

Running from: c:\users\Michael\Desktop\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\install.exe

c:\program files (x86)\Search Toolbar

c:\program files (x86)\Search Toolbar\SearchToolbar.dll

c:\programdata\DynuEncrypt.dll

c:\programdata\VMx0JaHseUt3g1

c:\users\Michael\AppData\Local\assembly\tmp

c:\users\Michael\AppData\Local\TempDIR

c:\users\Michael\AppData\Roaming\Local

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\.ddr

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\172886.avi.ddr

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\173043.avi.ddr

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\173051.avi.ddr

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\173906.avi.ddr

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\195102.avi.ddr

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\cawdvvgmwkgl.avi.ddr

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\ifxzzdpxvhdu.avi.ddr

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\plysgrentrsl.avi.ddr

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(2)

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\172886.avi

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\173043.avi

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\173051.avi

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\173906.avi

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\195102.avi

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\cawdvvgmwkgl.avi

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\ifxzzdpxvhdu.avi

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\liblertmwzrs.avi(2).ddp

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\liblertmwzrs.avi(3).ddp

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\liblertmwzrs.avi(4).ddp

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\liblertmwzrs.avi.ddp

c:\users\Michael\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\plysgrentrsl.avi

c:\windows\SysWow64\URTTemp

c:\windows\SysWow64\URTTemp\regtlib.exe

.

.

((((((((((((((((((((((((( Files Created from 2012-07-11 to 2012-08-11 )))))))))))))))))))))))))))))))

.

.

2012-08-11 16:52 . 2012-08-11 16:53 -------- d-----w- C:\FRST

2012-08-11 13:58 . 2012-08-11 13:58 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-08-10 23:30 . 2012-08-11 07:04 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service

2012-08-10 07:59 . 2012-08-10 07:59 -------- d-sh--w- c:\windows\SysWow64\%APPDATA%

2012-08-10 03:27 . 2012-08-10 03:27 -------- d-----w- c:\users\Michael\AppData\Local\Mozilla

2012-08-10 03:14 . 2012-08-10 03:14 -------- d-----w- c:\program files (x86)\Aeria Games

2012-08-09 14:51 . 2012-08-09 14:51 -------- d-sh--w- c:\windows\system32\%APPDATA%

2012-08-02 11:31 . 2012-08-02 11:31 -------- d-----w- c:\users\Default\AppData\Local\Google

2012-07-22 18:35 . 2012-07-22 18:39 -------- d--h--w- c:\users\Michael\AppData\Local\Fallout3

2012-07-16 21:42 . 2012-08-10 02:36 -------- d--h--w- c:\users\Michael\AppData\Local\PCGen

2012-07-16 21:25 . 2012-08-10 02:13 -------- d-----w- c:\program files\Oracle

2012-07-16 21:24 . 2012-07-16 21:23 955888 ----a-w- c:\windows\system32\npDeployJava1.dll

2012-07-16 21:24 . 2012-07-16 21:23 839152 ----a-w- c:\windows\system32\deployJava1.dll

2012-07-16 21:24 . 2012-07-16 21:23 268784 ----a-w- c:\windows\system32\javaws.exe

2012-07-16 21:24 . 2012-07-16 21:23 189424 ----a-w- c:\windows\system32\javaw.exe

2012-07-16 21:24 . 2012-07-16 21:23 188912 ----a-w- c:\windows\system32\java.exe

2012-07-16 21:12 . 2012-08-10 02:42 -------- d-----w- c:\users\Michael\jdk1.7.0_05_combo

2012-07-15 19:55 . 2012-07-15 19:55 -------- d--h--w- c:\users\Michael\AppData\Local\GameStop

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-08-10 00:39 . 2012-04-12 05:44 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-08-10 00:39 . 2012-04-12 05:44 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-06-12 03:02 . 2012-07-12 07:04 3147264 ----a-w- c:\windows\system32\win32k.sys

2012-06-09 05:30 . 2012-07-11 08:42 14165504 ----a-w- c:\windows\system32\shell32.dll

2012-06-06 05:50 . 2012-07-11 08:42 2003968 ----a-w- c:\windows\system32\msxml6.dll

2012-06-06 05:50 . 2012-07-11 08:42 1880064 ----a-w- c:\windows\system32\msxml3.dll

2012-06-06 05:09 . 2012-07-11 08:42 1389568 ----a-w- c:\windows\SysWow64\msxml6.dll

2012-06-06 05:09 . 2012-07-11 08:42 1236992 ----a-w- c:\windows\SysWow64\msxml3.dll

2012-06-02 22:19 . 2012-06-08 20:31 38424 ----a-w- c:\windows\system32\wups.dll

2012-06-02 22:19 . 2012-06-08 20:32 2428952 ----a-w- c:\windows\system32\wuaueng.dll

2012-06-02 22:19 . 2012-06-08 20:32 57880 ----a-w- c:\windows\system32\wuauclt.exe

2012-06-02 22:19 . 2012-06-08 20:32 44056 ----a-w- c:\windows\system32\wups2.dll

2012-06-02 22:19 . 2012-06-08 20:31 701976 ----a-w- c:\windows\system32\wuapi.dll

2012-06-02 22:15 . 2012-06-08 20:32 2622464 ----a-w- c:\windows\system32\wucltux.dll

2012-06-02 22:15 . 2012-06-08 20:31 99840 ----a-w- c:\windows\system32\wudriver.dll

2012-06-02 19:19 . 2012-06-08 20:31 186752 ----a-w- c:\windows\system32\wuwebv.dll

2012-06-02 19:15 . 2012-06-08 20:31 36864 ----a-w- c:\windows\system32\wuapp.exe

2012-06-02 12:49 . 2012-07-12 07:01 17807360 ----a-w- c:\windows\system32\mshtml.dll

2012-06-02 12:17 . 2012-07-12 07:01 10924032 ----a-w- c:\windows\system32\ieframe.dll

2012-06-02 12:12 . 2012-07-12 07:01 2311680 ----a-w- c:\windows\system32\jscript9.dll

2012-06-02 12:05 . 2012-07-12 07:01 1346048 ----a-w- c:\windows\system32\urlmon.dll

2012-06-02 12:05 . 2012-07-12 07:01 1392128 ----a-w- c:\windows\system32\wininet.dll

2012-06-02 12:04 . 2012-07-12 07:01 1494528 ----a-w- c:\windows\system32\inetcpl.cpl

2012-06-02 12:04 . 2012-07-12 07:01 237056 ----a-w- c:\windows\system32\url.dll

2012-06-02 12:03 . 2012-07-12 07:01 85504 ----a-w- c:\windows\system32\jsproxy.dll

2012-06-02 12:01 . 2012-07-12 07:01 173056 ----a-w- c:\windows\system32\ieUnatt.exe

2012-06-02 12:00 . 2012-07-12 07:01 818688 ----a-w- c:\windows\system32\jscript.dll

2012-06-02 11:59 . 2012-07-12 07:01 2144768 ----a-w- c:\windows\system32\iertutil.dll

2012-06-02 11:57 . 2012-07-12 07:01 96768 ----a-w- c:\windows\system32\mshtmled.dll

2012-06-02 11:57 . 2012-07-12 07:01 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2012-06-02 11:54 . 2012-07-12 07:01 248320 ----a-w- c:\windows\system32\ieui.dll

2012-06-02 08:33 . 2012-07-12 07:01 1800192 ----a-w- c:\windows\SysWow64\jscript9.dll

2012-06-02 08:25 . 2012-07-12 07:01 1129472 ----a-w- c:\windows\SysWow64\wininet.dll

2012-06-02 08:25 . 2012-07-12 07:01 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2012-06-02 08:20 . 2012-07-12 07:01 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2012-06-02 08:16 . 2012-07-12 07:01 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

2012-06-02 05:38 . 2012-07-11 08:42 95088 ----a-w- c:\windows\system32\drivers\ksecdd.sys

2012-06-02 05:38 . 2012-07-11 08:42 152432 ----a-w- c:\windows\system32\drivers\ksecpkg.sys

2012-06-02 05:37 . 2012-07-11 08:42 459216 ----a-w- c:\windows\system32\drivers\cng.sys

2012-06-02 05:27 . 2012-07-11 08:42 340992 ----a-w- c:\windows\system32\schannel.dll

2012-06-02 05:27 . 2012-07-11 08:42 307200 ----a-w- c:\windows\system32\ncrypt.dll

2012-06-02 04:48 . 2012-07-11 08:42 22016 ----a-w- c:\windows\SysWow64\secur32.dll

2012-06-02 04:48 . 2012-07-11 08:42 225280 ----a-w- c:\windows\SysWow64\schannel.dll

2012-06-02 04:47 . 2012-07-11 08:42 219136 ----a-w- c:\windows\SysWow64\ncrypt.dll

2012-06-02 04:42 . 2012-07-11 08:42 96768 ----a-w- c:\windows\SysWow64\sspicli.dll

2012-05-18 12:34 . 2012-03-03 22:54 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll

2012-05-18 12:33 . 2012-03-03 22:54 4283672 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll

2012-05-18 12:33 . 2012-03-03 22:53 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Steam"="c:\program files (x86)\Steam\steam.exe" [2012-08-09 1353080]

"Akamai NetSession Interface"="c:\users\Michael\AppData\Local\Akamai\netsession_win.exe" [2012-05-26 4327744]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-02-29 17148552]

"Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2009-07-14 44544]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Dell DataSafe Online"="c:\program files (x86)\Dell DataSafe Online\DataSafeOnline.exe" [2009-07-07 1779952]

"DellSupportCenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]

"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-22 47904]

"AmazonGSDownloaderTray"="c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe" [2009-10-23 326144]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-06-25 140520]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-01-16 421736]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-06-27 1996200]

"Aeria Ignite"="c:\program files (x86)\Aeria Games\Ignite\aeriaignite.exe" [2012-07-20 1403032]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]

"Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe" [2009-07-16 165104]

.

c:\users\Michael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

GameStop Now.lnk - c:\program files (x86)\GameStop App\Now\GameStopNow.exe [2012-5-14 2039536]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Dell Remote Access.lnk - c:\windows\Installer\{F66A31D9-7831-4FBA-BA02-C411C0047CC5}\NewShortcut4_F66A31D978314FBABA02C411C0047CC5.exe [2009-10-8 53248]

WhiteSmoke Translator.lnk - c:\users\Michael\Downloads\WhiteSmokeWriterGeo5002_en.exe [N/A]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

@="Service"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-28 116648]

R2 Htsysm;Htsysm;c:\windows\system32\HtsysmNT.sys [x]

R2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;c:\windows\system32\libusbd-nt.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-10 250056]

R3 Amazon Download Agent;Amazon Download Agent;c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [2009-10-23 401920]

R3 cpudrv64;cpudrv64;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys [2011-06-02 17864]

R3 dump_wmimmc;dump_wmimmc;c:\gpotato\IrisOnline\GameGuard\dump_wmimmc.sys [x]

R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]

R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-28 116648]

R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [x]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [x]

R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]

R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2008-10-24 43008]

R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys [2007-12-03 24064]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-08-02 51712]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-04-08 1255736]

R3 X6va003;X6va003;c:\users\Michael\AppData\Local\Temp\003F2B.tmp [x]

R3 X6va005;X6va005;c:\users\Michael\AppData\Local\Temp\005E5C1.tmp [x]

S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore64.sys [2010-11-25 257232]

S0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS64.sys [2010-06-29 452872]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-07-12 55856]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-02-05 283200]

S2 {1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7};Power Control [2011/06/23 07:24];c:\program files (x86)\CyberLink\PowerDVD DX\000.fcl [2009-06-25 00:19 146928]

S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-03-31 92160]

S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]

S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-06-27 2369960]

S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [2008-07-21 26624]

S2 sdAuxService;PC Tools Auxiliary Service;c:\program files (x86)\PC Tools Security\pctsAuxs.exe [2010-03-15 366840]

S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2010-03-15 145408]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-05-23 215040]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

Akamai REG_MULTI_SZ Akamai

.

Contents of the 'Scheduled Tasks' folder

.

2012-08-11 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 00:39]

.

2012-08-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-28 00:20]

.

2012-08-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-28 00:20]

.

2012-08-11 c:\windows\Tasks\RtlNICDiagVistaStart.job

- c:\program files (x86)\Realtek\RTNICDiag\RTNICDiag.exe [2009-10-08 11:18]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]

2012-07-20 19:17 755544 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]

2012-07-20 19:17 755544 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]

2012-07-20 19:17 755544 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]

2012-07-20 19:17 755544 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-14 7970848]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-10-13 162584]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-10-13 386840]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-10-13 417560]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.bing.com/?pc=ZUGO&form=ZGAPHP

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = 127.0.0.1:9421;*.local;<local>?¦???????????????????????????=;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>;<local>

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000

LSP: c:\program files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll

FF - ProfilePath - c:\users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\nevcdzes.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.youtube.com/

.

- - - - ORPHANS REMOVED - - - -

.

Wow6432Node-HKCU-Run-GateWay - c:\windows\system32\GateWayMain.exe

Wow6432Node-HKCU-Run-PlayNC Launcher - (no file)

Wow6432Node-HKLM-Run-mcagent_exe - c:\program files (x86)\McAfee.com\Agent\mcagent.exe

Wow6432Node-HKLM-Run-DivX Download Manager - c:\program files (x86)\DivX\DivX Plus Web Player\DDmService.exe

SafeBoot-MCODS

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{88C7F2AA-F93F-432C-8F0E-B7D85967A527} - (no file)

AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

.

.

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]

"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va003]

"ImagePath"="\??\c:\users\Michael\AppData\Local\Temp\003F2B.tmp"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va005]

"ImagePath"="\??\c:\users\Michael\AppData\Local\Temp\005E5C1.tmp"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\{1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7}]

"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD DX\000.fcl"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-3772619801-2602282460-1019856820-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.Email.1"

.

[HKEY_USERS\S-1-5-21-3772619801-2602282460-1019856820-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Common Files\Dell\Advanced Networking Service\hnm_svc.exe

c:\program files (x86)\Common Files\McAfee\McProxy\McProxy.exe

c:\program files (x86)\Dell DataSafe Local Backup\Components\scheduler\STService.exe

c:\program files (x86)\Dell Remote Access\ezi_ra.exe

c:\program files (x86)\Common Files\mcafee\mna\mcnasvc.exe

c:\program files (x86)\Dell Support Center\bin\sprtsvc.exe

.

**************************************************************************

.

Completion time: 2012-08-11 10:12:18 - machine was rebooted

ComboFix-quarantined-files.txt 2012-08-11 14:12

.

Pre-Run: 118,286,721,024 bytes free

Post-Run: 120,430,960,640 bytes free

.

- - End Of File - - 78A811025B7C65B9BF5FAB55E54516C1

Link to post
Share on other sites

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org

Database version: v2012.08.09.11

Windows 7 x64 NTFS

Internet Explorer 9.0.8112.16421

Michael :: MICHAEL-PC [administrator]

8/11/2012 10:48:03 AM

mbam-log-2012-08-11 (10-48-03).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 200420

Time elapsed: 3 minute(s), 35 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

everything seems to be working the way it should things seem a bit faster now and im no longer getting redirected when i search things and i havent seen any new tabs opening so it seems it worked

Link to post
Share on other sites

Great thumbsup.gif

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

cf2.jpg

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)

---------------------------------

Please download OTL from one of the links below: (you may already have OTL on the system)

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

http://www.itxassociates.com/OT-Tools/OTL.exe

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, etc....

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

Link to post
Share on other sites

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.