Locked out. Desktop hangs, no icons, stuck on spinning wheel -Safe Mode OK

disinfectPL · December 29, 2012

I am convinced I am infected ! This is my first time being shutdown like this...

1. The computer lags on the "Welcome" screen and desktop does not load... Wheel keeps on spinning and nothing else.

2. Safe Mode works. BUT, in safe mode, MBAM scan hangs on certain files....The computer just freezes. Same for Superantispyware and Bitdefender web scan. So I am pretty sure I am hosed...

3. Chameleon modes in MBAM also freeze the computer when scanner starts. Tried only first three steps in Chameleon help...

My logs are attached.

Thanks !

Attach.txt

DDS.txt

kevinf80 · December 29, 2012

There is a network proxy set in Firefox, it locates to somewhere in Madras, India. Did you set that or know about it?

Download Farbar Recovery Scan Tool on a clean PC (if possible) and save to a flash drive (memory stick). Use which ever of the folllowing is applicable to your system. (32 or 64 bit)

Download http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ <--- 64 bit version Save to USB flash drive

Download http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ <--- 32 bit version Save to USB Flash drive

Plug the flashdrive into the infected PC.

Enter System Recovery Options I give two methods, use whichever is convenient for you.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select Your Country as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select Your Country as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair

System Restore

Windows Complete PC Restore

Windows Memory Diagnostic Tool

Command Prompt

Select Command Prompt
In the command window type in notepad and press Enter.
The notepad opens. Under File menu select Open.
Select "Computer" and find your flash drive letter and close the notepad.
In the command window type e:\frst64 or e:\frst depending on your version. Press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

Kevin

disinfectPL · December 29, 2012

Hey... Thanks so much for the reply. Yes, the proxy was set by me.

Working on your instructions.

disinfectPL · December 29, 2012

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 28-12-2012

Ran by SYSTEM at 29-12-2012 10:39:36

Running from G:\

Windows 7 Home Premium (X64) OS Language: English(US)

The current controlset is ControlSet003

==================== Registry (Whitelisted) ===================

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

==================== Services (Whitelisted) ===================

4 !SASCORE; "C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE" [140672 2012-07-11] (SUPERAntiSpyware.com)

2 Crypkey License; crypserv.exe [122880 2008-05-07] (CrypKey (Canada) Ltd.)

2 Jamcast; "C:\Program Files (x86)\Jamcast\jamcastsvc.exe" [64240 2012-07-09] (Software Development Solutions, Inc.)

2 LkCitadelServer; C:\Windows\SysWOW64\lkcitdl.exe [695136 2010-10-27] (National Instruments, Inc.)

2 lkClassAds; C:\Windows\SysWOW64\lkads.exe [46192 2011-06-14] (National Instruments Corporation)

2 lkTimeSync; C:\Windows\SysWOW64\lktsrv.exe [56952 2011-06-14] (National Instruments Corporation)

2 M4LIC; "C:\Program Files (x86)\Common Files\Mediafour\M4LIC.EXE" [205312 2010-07-20] (Mediafour Corporation)

4 MacDrive8Service; "C:\Program Files\Mediafour\MacDrive 8\MacDrive8Service.exe" [149504 2010-10-08] (Mediafour Corporation)

2 mxssvr; "C:\Program Files (x86)\National Instruments\MAX\nimxs.exe" [12696 2011-06-14] (National Instruments Corporation)

2 NIApplicationWebServer; "C:\Program Files (x86)\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe" -user [50336 2011-05-27] (National Instruments Corporation)

4 NIApplicationWebServer64; "C:\Program Files\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe" -user [68256 2011-05-27] (National Instruments Corporation)

2 NIDomainService; "C:\Program Files (x86)\National Instruments\Shared\Security\nidmsrv.exe" [362104 2011-06-14] (National Instruments Corporation)

3 NILM License Manager; "C:\Program Files (x86)\National Instruments\Shared\License Manager\Bin\lmgrd.exe" [1427688 2010-08-02] (Macrovision Corporation)

2 nimDNSResponder; "C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe" [194224 2011-06-01] (National Instruments Corporation)

2 niSvcLoc; "C:\Program Files (x86)\National Instruments\Shared\NI WebServer\SystemWebServer.exe" -system [50328 2011-05-27] (National Instruments Corporation)

2 NITaggerService; "C:\Program Files (x86)\National Instruments\Shared\Tagger\tagsrv.exe" [676016 2011-06-14] (National Instruments Corporation)

2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [66872 2012-09-21] ()

2 ProtexisLicensing; C:\Windows\SysWOW64\PSIService.exe [177704 2007-06-05] ()

2 SSUService; C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe [370504 2012-03-14] (Splashtop Inc.)

==================== Drivers (Whitelisted) =====================

3 BTWUSB; C:\Windows\System32\Drivers\BTWUSB.sys [63744 2006-06-07] (Broadcom Corporation.)

1 CBDisk; C:\Windows\System32\Drivers\CBDisk.sys [70344 2010-05-12] (EldoS Corporation)

1 dtsoftbus01; C:\Windows\System32\Drivers\dtsoftbus01.sys [283200 2012-06-15] (DT Soft Ltd)

0 MDFSYSNT; C:\Windows\System32\Drivers\MDFSYSNT.sys [307888 2010-10-07] (Mediafour Corporation)

0 MDPMGRNT; C:\Windows\System32\Drivers\MDPMGRNT.sys [32424 2010-10-21] (Mediafour Corporation)

1 NetworkX; C:\Windows\system32\ckldrv.sys [28664 2008-03-17] ()

3 pwdrvio; \??\C:\Windows\system32\pwdrvio.sys [19936 2011-09-02] ()

3 pwdspio; \??\C:\Windows\system32\pwdspio.sys [13280 2011-09-02] ()

1 SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

1 SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

3 UBNRedir; C:\Windows\SysWow64\Drivers\UBNRedir.sys [6784 2011-12-31] (UniversalBox)

3 catchme; \??\C:\ComboFix\catchme.sys [x]

2 MCSTRM; [x]

==================== NetSvcs (Whitelisted) ====================

==================== One Month Created Files and Folders ========

2012-12-29 10:39 - 2012-12-29 10:39 - 00000000 ____D C:\FRST

2012-12-29 07:35 - 2012-12-29 07:35 - 01463381 ____A (Farbar) C:\Users\Dibbs\Downloads\FRST64.exe

2012-12-28 23:52 - 2012-12-28 23:52 - 00000000 __SHD C:\found.000

2012-12-28 22:06 - 2012-12-28 22:29 - 00000000 ____D C:\Windows\pss

2012-12-28 21:18 - 2012-12-28 21:21 - 105603488 ____A C:\Users\Dibbs\Downloads\avira_free_antivirus_en.exe

2012-12-28 20:41 - 2012-12-28 20:41 - 00003636 ____A C:\AdwCleaner[s2].txt

2012-12-28 20:40 - 2012-12-28 20:40 - 00550017 ____A C:\Users\Dibbs\Downloads\adwcleaner.exe

2012-12-28 20:40 - 2012-12-28 20:40 - 00039699 ____A C:\AdwCleaner[R1].txt

2012-12-28 19:11 - 2012-12-28 19:11 - 00028566 ____A C:\Users\Dibbs\Documents\Attach.txt

2012-12-28 19:11 - 2012-12-28 19:11 - 00018388 ____A C:\Users\Dibbs\Documents\DDS.txt

2012-12-28 19:10 - 2012-12-28 19:10 - 00028566 ____A C:\Users\Dibbs\Desktop\attach.txt

2012-12-28 19:10 - 2012-12-28 19:10 - 00018388 ____A C:\Users\Dibbs\Desktop\dds.txt

2012-12-28 18:37 - 2012-12-28 18:37 - 00000000 ____D C:\Users\Dibbs\AppData\Roaming\QuickScan

2012-12-28 18:02 - 2012-12-28 22:17 - 00001961 ____A C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

2012-12-28 18:02 - 2012-12-28 18:02 - 00000510 ____A C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task d986d00e-25d1-405b-96c2-dc3b8566477f.job

2012-12-28 18:02 - 2012-12-28 18:02 - 00000510 ____A C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 022ee9cf-c190-4db8-938c-6aec1c83e949.job

2012-12-28 18:02 - 2012-12-28 18:02 - 00000000 ____D C:\Users\Dibbs\AppData\Roaming\SUPERAntiSpyware.com

2012-12-28 18:02 - 2012-12-28 18:02 - 00000000 ____D C:\Users\All Users\SUPERAntiSpyware.com

2012-12-28 18:02 - 2012-12-28 18:02 - 00000000 ____D C:\Program Files\SUPERAntiSpyware

2012-12-28 17:53 - 2012-12-28 17:53 - 00001491 ____A C:\Users\Dibbs\Desktop\RKreport[3]_S_12282012_02d2053.txt

2012-12-28 17:53 - 2012-12-28 17:53 - 00001457 ____A C:\Users\Dibbs\Desktop\RKreport[4]_D_12282012_02d2053.txt

2012-12-28 17:51 - 2012-12-28 17:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2012-12-28 17:42 - 2012-12-28 17:42 - 00019990 ____A C:\ComboFix.txt

2012-12-28 17:20 - 2012-12-28 17:42 - 00000000 ____D C:\Qoobox

2012-12-28 17:20 - 2012-12-28 17:41 - 00000000 ____D C:\Windows\erdnt

2012-12-28 17:20 - 2011-06-25 22:45 - 00256000 ____A C:\Windows\PEV.exe

2012-12-28 17:20 - 2010-11-07 09:20 - 00208896 ____A C:\Windows\MBR.exe

2012-12-28 17:20 - 2009-04-19 20:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe

2012-12-28 17:20 - 2000-08-30 16:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe

2012-12-28 17:20 - 2000-08-30 16:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe

2012-12-28 17:20 - 2000-08-30 16:00 - 00098816 ____A C:\Windows\sed.exe

2012-12-28 17:20 - 2000-08-30 16:00 - 00080412 ____A C:\Windows\grep.exe

2012-12-28 17:20 - 2000-08-30 16:00 - 00068096 ____A C:\Windows\zip.exe

2012-12-28 17:14 - 2012-12-28 17:14 - 00000132 ____A C:\Users\Dibbs\Documents\CFScript.txt

2012-12-28 17:01 - 2012-12-28 17:01 - 00002162 ____A C:\Users\Dibbs\Desktop\RKreport[2]_D_12282012_02d2001.txt

2012-12-28 17:00 - 2012-12-28 17:00 - 00002107 ____A C:\Users\Dibbs\Desktop\RKreport[1]_S_12282012_02d2000.txt

2012-12-28 16:59 - 2012-12-28 17:53 - 00000000 ____D C:\Users\Dibbs\Desktop\RK_Quarantine

2012-12-28 16:57 - 2012-12-28 21:07 - 00000000 ____D C:\Users\Dibbs\AppData\Roaming\EurekaLog

2012-12-28 16:54 - 2012-12-28 16:57 - 00000000 ____D C:\Program Files (x86)\Your Uninstaller! 7

2012-12-28 16:54 - 2012-12-28 16:54 - 00001072 ____A C:\Users\Dibbs\Desktop\Your Unin-staller!.lnk

2012-12-28 16:54 - 2012-12-28 16:54 - 00000000 ____D C:\Users\Dibbs\AppData\Roaming\URSoft

2012-12-28 16:54 - 2012-12-28 16:54 - 00000000 ____D C:\Users\Dibbs\AppData\Roaming\Babylon

2012-12-28 16:54 - 2012-12-28 16:54 - 00000000 ____D C:\Users\Dibbs\AppData\Local\Babylon

2012-12-28 16:54 - 2012-12-28 16:54 - 00000000 ____D C:\Users\All Users\Babylon

2012-12-28 16:36 - 2012-12-28 16:36 - 00000513 ____A C:\Users\Dibbs\Documents\WinZip TrialPzy.txt

2012-12-28 16:34 - 2012-12-28 16:34 - 00368856 ____A (WinZip Computing) C:\Users\Dibbs\Downloads\WinZip170.exe

2012-12-28 14:46 - 2012-12-28 15:20 - 00000000 ___AD C:\Kaspersky Rescue Disk 10.0

2012-12-28 11:47 - 2012-12-28 11:47 - 00001264 ____A C:\Users\Dibbs\Desktop\Revo Uninstaller.lnk

2012-12-28 11:47 - 2012-12-28 11:47 - 00000000 ____D C:\Program Files (x86)\VS Revo Group

2012-12-28 11:46 - 2012-12-28 11:47 - 02617648 ____A (VS Revo Group Ltd.) C:\Users\Dibbs\Downloads\revosetup.exe

2012-12-28 08:08 - 2012-12-28 08:08 - 00000000 ____D C:\Users\Dibbs\AppData\Local\RadonLabs

2012-12-28 08:03 - 2010-03-15 01:31 - 00165376 ____A C:\Windows\SysWOW64\unrar.dll

2012-12-28 08:00 - 2012-12-28 08:00 - 00000536 ____A C:\Windows\NLSDownlevelMapping.log

2012-12-28 07:59 - 2012-12-28 11:03 - 00000000 ____D C:\Users\Dibbs\Documents\Multisoft

2012-12-28 07:56 - 2012-12-28 07:56 - 00000000 ____D C:\Users\Dibbs\Downloads\CityCarDriving.v.1.2.Eng

2012-12-28 07:50 - 2012-12-28 07:55 - 408504248 ____A C:\Users\Dibbs\Downloads\CityCarDriving.v.1.2.Eng.rar

2012-12-27 19:52 - 2012-12-27 20:05 - 00000000 ____D C:\Users\Dibbs\Desktop\4GB USB DRIVE RED

2012-12-27 19:50 - 2012-12-27 19:53 - 00000000 ____D C:\Users\Dibbs\Downloads\imageusb

2012-12-27 19:49 - 2012-12-27 19:49 - 00432327 ___RA C:\Users\Dibbs\Downloads\imageusb.zip

2012-12-26 12:22 - 2012-12-26 12:22 - 00002055 ____A C:\Users\Public\Desktop\Adobe Reader XI.lnk

2012-12-08 08:09 - 2012-12-15 16:19 - 00000000 ____D C:\Users\All Users\Pure Networks

2012-12-08 08:09 - 2009-07-07 11:48 - 00035376 ____A (Cisco Systems, Inc.) C:\Windows\System32\Drivers\purendis.sys

2012-12-08 08:09 - 2009-07-07 11:48 - 00033328 ____A (Cisco Systems, Inc.) C:\Windows\System32\Drivers\pnarp.sys

2012-12-04 19:11 - 2012-12-04 19:11 - 00000000 ____D C:\Program Files (x86)\Pure Networks

2012-12-04 17:33 - 2012-12-04 18:41 - 00000000 ____D C:\Users\Dibbs\Downloads\Cisco Network Magic Pro 5.5.9195 incl.Patch{H33T}{Easypath}

2012-12-04 16:50 - 2012-12-04 16:50 - 00000000 ___AH C:\Users\Dibbs\Documents\Default.rdp

2012-12-03 14:21 - 2012-12-03 14:59 - 00000021 ____A C:\Users\Dibbs\Documents\hertz.txt

2012-11-29 17:52 - 2012-11-29 17:52 - 00002515 ____A C:\Users\Public\Desktop\Skype.lnk

==================== One Month Modified Files and Folders =======

2012-12-29 07:37 - 2011-12-10 22:45 - 01117558 ____A C:\Windows\WindowsUpdate.log

2012-12-29 07:36 - 2009-07-13 21:13 - 00778150 ____A C:\Windows\System32\PerfStringBackup.INI

2012-12-29 07:35 - 2012-12-29 07:35 - 01463381 ____A (Farbar) C:\Users\Dibbs\Downloads\FRST64.exe

2012-12-29 07:35 - 2009-07-13 20:51 - 00117060 ____A C:\Windows\setupact.log

2012-12-29 07:33 - 2012-01-09 14:04 - 00000908 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1616424981-3898423210-350200610-1000UA.job

2012-12-29 03:33 - 2012-01-09 14:03 - 00000856 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1616424981-3898423210-350200610-1000Core.job

2012-12-28 23:52 - 2012-12-28 23:52 - 00000000 __SHD C:\found.000

2012-12-28 22:38 - 2009-07-13 20:45 - 00014592 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2012-12-28 22:38 - 2009-07-13 20:45 - 00014592 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2012-12-28 22:30 - 2011-12-11 00:50 - 00014136 ____A C:\Windows\error.log

2012-12-28 22:30 - 2011-12-11 00:50 - 00003276 ____A C:\Windows\errord.log

2012-12-28 22:30 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2012-12-28 22:29 - 2012-12-28 22:06 - 00000000 ____D C:\Windows\pss

2012-12-28 22:26 - 2011-12-27 19:10 - 00000000 ____D C:\Program Files (x86)\Steam

2012-12-28 22:19 - 2011-12-11 00:59 - 00406022 ____A C:\Windows\PFRO.log

2012-12-28 22:17 - 2012-12-28 18:02 - 00001961 ____A C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

2012-12-28 21:21 - 2012-12-28 21:18 - 105603488 ____A C:\Users\Dibbs\Downloads\avira_free_antivirus_en.exe

2012-12-28 21:07 - 2012-12-28 16:57 - 00000000 ____D C:\Users\Dibbs\AppData\Roaming\EurekaLog

2012-12-28 20:41 - 2012-12-28 20:41 - 00003636 ____A C:\AdwCleaner[s2].txt

2012-12-28 20:40 - 2012-12-28 20:40 - 00550017 ____A C:\Users\Dibbs\Downloads\adwcleaner.exe

2012-12-28 20:40 - 2012-12-28 20:40 - 00039699 ____A C:\AdwCleaner[R1].txt

2012-12-28 19:11 - 2012-12-28 19:11 - 00028566 ____A C:\Users\Dibbs\Documents\Attach.txt

2012-12-28 19:11 - 2012-12-28 19:11 - 00018388 ____A C:\Users\Dibbs\Documents\DDS.txt

2012-12-28 19:10 - 2012-12-28 19:10 - 00028566 ____A C:\Users\Dibbs\Desktop\attach.txt

2012-12-28 19:10 - 2012-12-28 19:10 - 00018388 ____A C:\Users\Dibbs\Desktop\dds.txt

2012-12-28 19:09 - 2012-07-26 15:27 - 00000000 ____D C:\Users\Dibbs\Downloads\TOSHIBA

2012-12-28 18:37 - 2012-12-28 18:37 - 00000000 ____D C:\Users\Dibbs\AppData\Roaming\QuickScan

2012-12-28 18:02 - 2012-12-28 18:02 - 00000510 ____A C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task d986d00e-25d1-405b-96c2-dc3b8566477f.job

2012-12-28 18:02 - 2012-12-28 18:02 - 00000510 ____A C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 022ee9cf-c190-4db8-938c-6aec1c83e949.job

2012-12-28 18:02 - 2012-12-28 18:02 - 00000000 ____D C:\Users\Dibbs\AppData\Roaming\SUPERAntiSpyware.com

2012-12-28 18:02 - 2012-12-28 18:02 - 00000000 ____D C:\Users\All Users\SUPERAntiSpyware.com

2012-12-28 18:02 - 2012-12-28 18:02 - 00000000 ____D C:\Program Files\SUPERAntiSpyware

2012-12-28 17:57 - 2012-12-28 17:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2012-12-28 17:57 - 2012-03-31 05:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2012-12-28 17:53 - 2012-12-28 17:53 - 00001491 ____A C:\Users\Dibbs\Desktop\RKreport[3]_S_12282012_02d2053.txt

2012-12-28 17:53 - 2012-12-28 17:53 - 00001457 ____A C:\Users\Dibbs\Desktop\RKreport[4]_D_12282012_02d2053.txt

2012-12-28 17:53 - 2012-12-28 16:59 - 00000000 ____D C:\Users\Dibbs\Desktop\RK_Quarantine

2012-12-28 17:42 - 2012-12-28 17:42 - 00019990 ____A C:\ComboFix.txt

2012-12-28 17:42 - 2012-12-28 17:20 - 00000000 ____D C:\Qoobox

2012-12-28 17:41 - 2012-12-28 17:20 - 00000000 ____D C:\Windows\erdnt

2012-12-28 17:40 - 2009-07-13 18:34 - 00000215 ____A C:\Windows\system.ini

2012-12-28 17:14 - 2012-12-28 17:14 - 00000132 ____A C:\Users\Dibbs\Documents\CFScript.txt

2012-12-28 17:01 - 2012-12-28 17:01 - 00002162 ____A C:\Users\Dibbs\Desktop\RKreport[2]_D_12282012_02d2001.txt

2012-12-28 17:00 - 2012-12-28 17:00 - 00002107 ____A C:\Users\Dibbs\Desktop\RKreport[1]_S_12282012_02d2000.txt

2012-12-28 16:57 - 2012-12-28 16:54 - 00000000 ____D C:\Program Files (x86)\Your Uninstaller! 7

2012-12-28 16:54 - 2012-12-28 16:54 - 00001072 ____A C:\Users\Dibbs\Desktop\Your Unin-staller!.lnk

2012-12-28 16:54 - 2012-12-28 16:54 - 00000000 ____D C:\Users\Dibbs\AppData\Roaming\URSoft

2012-12-28 16:54 - 2012-12-28 16:54 - 00000000 ____D C:\Users\Dibbs\AppData\Roaming\Babylon

2012-12-28 16:54 - 2012-12-28 16:54 - 00000000 ____D C:\Users\Dibbs\AppData\Local\Babylon

2012-12-28 16:54 - 2012-12-28 16:54 - 00000000 ____D C:\Users\All Users\Babylon

2012-12-28 16:36 - 2012-12-28 16:36 - 00000513 ____A C:\Users\Dibbs\Documents\WinZip TrialPzy.txt

2012-12-28 16:34 - 2012-12-28 16:34 - 00368856 ____A (WinZip Computing) C:\Users\Dibbs\Downloads\WinZip170.exe

2012-12-28 15:20 - 2012-12-28 14:46 - 00000000 ___AD C:\Kaspersky Rescue Disk 10.0

2012-12-28 11:49 - 2012-05-06 17:36 - 00870128 ____A C:\Users\Dibbs\AppData\Roaming\mcs.rma

2012-12-28 11:47 - 2012-12-28 11:47 - 00001264 ____A C:\Users\Dibbs\Desktop\Revo Uninstaller.lnk

2012-12-28 11:47 - 2012-12-28 11:47 - 00000000 ____D C:\Program Files (x86)\VS Revo Group

2012-12-28 11:47 - 2012-12-28 11:46 - 02617648 ____A (VS Revo Group Ltd.) C:\Users\Dibbs\Downloads\revosetup.exe

2012-12-28 11:46 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\Resources

2012-12-28 11:06 - 2012-06-02 11:25 - 00000000 ____D C:\Users\Dibbs\AppData\Roaming\DiskAid

2012-12-28 11:03 - 2012-12-28 07:59 - 00000000 ____D C:\Users\Dibbs\Documents\Multisoft

2012-12-28 08:08 - 2012-12-28 08:08 - 00000000 ____D C:\Users\Dibbs\AppData\Local\RadonLabs

2012-12-28 08:02 - 2011-12-23 12:32 - 00400029 ____A C:\Windows\DirectX.log

2012-12-28 08:00 - 2012-12-28 08:00 - 00000536 ____A C:\Windows\NLSDownlevelMapping.log

2012-12-28 07:56 - 2012-12-28 07:56 - 00000000 ____D C:\Users\Dibbs\Downloads\CityCarDriving.v.1.2.Eng

2012-12-28 07:56 - 2011-12-11 00:42 - 00000000 ____D C:\Users\Dibbs\AppData\Roaming\uTorrent

2012-12-28 07:55 - 2012-12-28 07:50 - 408504248 ____A C:\Users\Dibbs\Downloads\CityCarDriving.v.1.2.Eng.rar

2012-12-28 04:34 - 2011-12-27 16:52 - 00000000 ____D C:\Users\Dibbs\AppData\Local\CrashDumps

2012-12-28 04:14 - 2009-07-13 21:08 - 00029700 ____A C:\Windows\Tasks\SCHEDLGU.TXT

2012-12-27 21:47 - 2011-12-10 22:18 - 00000000 ____D C:\Users\Dibbs\AppData\Roaming\Skype

2012-12-27 20:05 - 2012-12-27 19:52 - 00000000 ____D C:\Users\Dibbs\Desktop\4GB USB DRIVE RED

2012-12-27 19:53 - 2012-12-27 19:50 - 00000000 ____D C:\Users\Dibbs\Downloads\imageusb

2012-12-27 19:49 - 2012-12-27 19:49 - 00432327 ___RA C:\Users\Dibbs\Downloads\imageusb.zip

2012-12-26 12:23 - 2011-12-11 15:36 - 00000000 ____D C:\Users\All Users\Adobe

2012-12-26 12:22 - 2012-12-26 12:22 - 00002055 ____A C:\Users\Public\Desktop\Adobe Reader XI.lnk

2012-12-26 12:22 - 2011-12-11 15:36 - 00000000 ____D C:\Program Files (x86)\Adobe

2012-12-21 14:35 - 2012-01-21 15:19 - 00000000 ____D C:\Users\Dibbs\AppData\Roaming\Spotify

2012-12-21 13:52 - 2012-07-02 14:18 - 00697272 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2012-12-21 13:52 - 2011-12-11 00:18 - 00073656 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2012-12-20 04:14 - 2009-07-13 20:45 - 03021104 ____A C:\Windows\System32\FNTCACHE.DAT

2012-12-15 16:19 - 2012-12-08 08:09 - 00000000 ____D C:\Users\All Users\Pure Networks

2012-12-12 12:52 - 2012-01-09 14:04 - 00002445 ____A C:\Users\Dibbs\Desktop\Google Chrome.lnk

2012-12-08 08:42 - 2012-05-20 17:08 - 05020203 ____A C:\formatter.log

2012-12-08 08:30 - 2012-02-13 18:16 - 00000000 ____D C:\Users\Dibbs\AppData\Local\Corel

2012-12-08 08:28 - 2012-02-13 18:17 - 00000952 __ASH C:\Windows\SysWOW64\KGyGaAvL.sys

2012-12-08 08:28 - 2011-12-11 15:06 - 00110080 ____A C:\Users\Dibbs\AppData\Local\GDIPFONTCACHEV1.DAT

2012-12-08 07:53 - 2009-07-13 20:46 - 00002304 ____A C:\Windows\DtcInstall.log

2012-12-08 07:41 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration

2012-12-07 17:17 - 2011-12-17 06:32 - 00000000 ____D C:\Users\Dibbs\Documents\WBFS Manager Covers

2012-12-04 19:11 - 2012-12-04 19:11 - 00000000 ____D C:\Program Files (x86)\Pure Networks

2012-12-04 18:41 - 2012-12-04 17:33 - 00000000 ____D C:\Users\Dibbs\Downloads\Cisco Network Magic Pro 5.5.9195 incl.Patch{H33T}{Easypath}

2012-12-04 17:04 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF

2012-12-04 16:50 - 2012-12-04 16:50 - 00000000 ___AH C:\Users\Dibbs\Documents\Default.rdp

2012-12-03 14:59 - 2012-12-03 14:21 - 00000021 ____A C:\Users\Dibbs\Documents\hertz.txt

2012-11-29 17:52 - 2012-11-29 17:52 - 00002515 ____A C:\Users\Public\Desktop\Skype.lnk

2012-11-29 17:52 - 2011-12-10 22:18 - 00000000 ___RD C:\Program Files (x86)\Skype

2012-11-29 17:52 - 2011-12-10 22:16 - 00000000 ____D C:\Users\All Users\Skype

==================== Known DLLs (Whitelisted) =================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2012-12-28 22:59:06

==================== Memory info ===========================

Percentage of memory in use: 15%

Total physical RAM: 3893.86 MB

Available physical RAM: 3274.33 MB

Total Pagefile: 3892.01 MB

Available Pagefile: 3258.38 MB

Total Virtual: 8192 MB

Available Virtual: 8191.9 MB

==================== Partitions =============================

1 Drive c: () (Fixed) (Total:337.41 GB) (Free:149.37 GB) NTFS

2 Drive e: (MACOS) (Fixed) (Total:128.21 GB) (Free:128.2 GB) FAT32 ==>[system with boot components (obtained from reading drive)]

4 Drive g: (USB20FD) (Removable) (Total:30.44 GB) (Free:30.44 GB) FAT32

6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

7 Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)]

Disk ### Status Size Free Dyn Gpt

-------- ------------- ------- ------- --- ---

Disk 0 Online 465 GB 8 MB

Disk 1 Online 30 GB 0 B

Disk 2 No Media 0 B 0 B

Partitions of Disk 0:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 100 MB 1024 KB

Partition 2 Primary 337 GB 101 MB

Partition 3 Primary 128 GB 337 GB

==================================================================================

Disk: 0

Partition 1

Type : 07

Hidden: No

Active: Yes

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 1 Y System Rese NTFS Partition 100 MB Healthy

=========================================================

Disk: 0

Partition 2

Type : 07

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 2 C NTFS Partition 337 GB Healthy

=========================================================

Disk: 0

Partition 3

Type : 0B

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 3 E MACOS FAT32 Partition 128 GB Healthy

=========================================================

Partitions of Disk 1:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 30 GB 18 MB

==================================================================================

Disk: 1

Partition 1

Type : 0C

Hidden: No

Active: Yes

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 4 G USB20FD FAT32 Removable 30 GB Healthy

=========================================================

Last Boot: 2012-12-25 06:44

==================== End Of Log =============================

disinfectPL · December 29, 2012

Well, well.......

A selective startup fixed my problem !!!!! :huh: :huh: So by power of elimination the offending startup item turned out to be ..........Malwarebytes itself!! This was way surpisng to me .... I installed SuperAntipspyware then Avira and then used a Kaspersky disk, and all saw minor Ad-cookies and nothing else. Each one run separately.

Since I never have two AV programs together, this seemed that MBAM had gotten corrupted. So I cleaned out all caches, temp folders etc., removed all AV programs, rebooted.. And things were swimmingly good !!!

I then reinstalled MBAM, and ...... well it got stuck again during scan, and the very same symptoms came back !!!!!!!!!!!!!

This very odd, since MBAM has been my workhorse. I saw a general thread where a reseller indicated that the recent updates of MBAM were causing his clients computers to freeze. Maybe he is very right afterall.

I cannot continue using MBAM now. THE SCAN ABOVE WAS DONE AFTER i UNINSTALLED MBAM, so it may not show as present, but Superantispyware will show.

PLEASE can you verufy this issue...>!! Also, still, I would like to continue a full virus troubleshoot if OK with you.

Maurice Naggar · January 13, 2013

@ disinfectPL

Are you still with us? Do you still need help?

disinfectPL · January 14, 2013

Actually, since I did not get any reply I just gave up

I have uninstalled Malwarebytes on the above computer because of the freezing issue. I use Kaspersky instead. The older version still works on my other computer, and that is running OK. So I cannot instal the new versions at all.

Maurice Naggar · January 14, 2013

Please advise if the "desktop hangs/no icons/stuck spinning" have been ALL cleared up ?

What "older version" are you referring to?

Please do a NEW run of DDS and this time, COPY all contents & Paste in-line within main-body of reply box.

Download DDS and save it to your desktop from http://download.bleepingcomputer.com/sUBs/dds.com here

or http://download.bleepingcomputer.com/sUBs/dds.scr or

http://www.infospyware.net/sUBs/dds

Disable any script blocker if your antivirus/antimalware has it.

On Vista/ Windows 7/ Windows 8 do a RIGHT-click on dds and select Run As Administrator :excl:

On Windows XP double click dds to run the tool.

DDS will run in a command prompt window and will take 3 to 4 minutes or so.

Follow and answer the prompts as appropriate.

When done, DDS will open two (2) logs:
DDS.txt
Attach.txt
Save both reports to your desktop.

Please Copy & Paste contents of the following logs in your next reply:

DDS.txt

Attach.txt

disinfectPL · January 15, 2013

Thanks for your reply. Sorry, I did not check earlier.

Well the newest version has the Chameleon loader etc and blue icon. The earlier version is still with the red 'M' icon..!!!! Sorry, i am at work so I cannot give you exact version numbers.

Yes, the freezing still happens BUT when I try to scan.....it freezes even on quick scan and freezes the computer.

I can resend the log files when I get back home..... Thanks again.

Maurice Naggar · January 15, 2013

Remarks:

You should only have 1 MBAM installed, version 1.70.0.1100

Your system should not have 2.

If MBAM is getting stuck, I need for you to do any other steps/tools I outlined.

Regarding the DDS tool, I need a new run and then for you to copy/paste the new logs.

p.s.s. When starting a reply, you do not need (and I'd prefer you not use) the Quote button.

Just press the More Reply Options button at the bottom of forum window.

disinfectPL · January 16, 2013

Remarks:
You should only have 1 MBAM installed, version 1.70.0.1100
Your system should not have 2.
If MBAM is getting stuck, I need for you to do any other steps/tools I outlined.
Regarding the DDS tool, I need a new run and then for you to copy/paste the new logs.
p.s.s. When starting a reply, you do not need (and I'd prefer you not use) the Quote button.
Just press the More Reply Options button at the bottom of forum window.

Oh, come on now !! I am not that daft to have two versions of Malwarebytes installed on the same computer. :angry: I said "older version still works on my other computer". Installing the new version on any computer BY ITSELF gives the same problem.

Not every one who complains about any software is clueless......

disinfectPL · January 16, 2013

Awww..... sorry to blow off there. Will post scan logs.

Maurice Naggar · January 16, 2013

Yes, before flying off the handle, keep this in mind

a) I am helping you freely as a volunteer and on my own personal time

b) any preceding statements are & were made as neutral comments, without personal judgement.

disinfectPL · January 17, 2013

Sure. My apologies again. I am very aware of the way this forum works. Just a screw loose there !

ATTACH.txt

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume1

Install Date: 12/11/2011 2:36:43 AM

System Uptime: 12/28/2012 9:39:05 PM (1 hours ago)

.

Motherboard: Intel Corp. | | Base Board Product Name

Processor: Intel® Core™ i3 CPU M 350 @ 2.27GHz | CPU | 2261/1066mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 337 GiB total, 150.145 GiB free.

D: is CDROM ()

E: is FIXED (FAT32) - 128 GiB total, 128.196 GiB free.

F: is CDROM ()

G: is Removable

.

==== Disabled Device Manager Items =============

.

Class GUID:

Description:

Device ID: ACPI\QCI0701\2&DABA3FF&1

Manufacturer:

Name:

PNP Device ID: ACPI\QCI0701\2&DABA3FF&1

Service:

.

Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Description: Security Processor Loader Driver

Device ID: ROOT\LEGACY_SPLDR\0000

Manufacturer:

Name: Security Processor Loader Driver

PNP Device ID: ROOT\LEGACY_SPLDR\0000

Service: spldr

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

µTorrent

18 WoS Extreme Trucker 2 (v.1.0)

Adobe Acrobat X Pro

Adobe AIR

Adobe Anchor Service CS4

Adobe Anchor Service x64 CS4

Adobe Bridge CS4

Adobe CMaps CS4

Adobe CMaps x64 CS4

Adobe Color - Photoshop Specific CS4

Adobe Color EU Extra Settings CS4

Adobe Color JA Extra Settings CS4

Adobe Color NA Recommended Settings CS4

Adobe Color Video Profiles CS CS4

Adobe CSI CS4

Adobe CSI CS4 x64

Adobe Default Language CS4

Adobe Device Central CS4

Adobe Drive CS4

Adobe Drive CS4 x64

Adobe ExtendScript Toolkit CS4

Adobe Extension Manager CS4

Adobe Flash Player 11 ActiveX 64-bit

Adobe Flash Player 11 Plugin

Adobe Fonts All

Adobe Fonts All x64

Adobe Linguistics CS4

Adobe Linguistics CS4 x64

Adobe Media Player

Adobe Output Module

Adobe PDF Library Files CS4

Adobe PDF Library Files x64 CS4

Adobe Photoshop CS4

Adobe Photoshop CS4 (64 Bit)

Adobe Photoshop CS4 Support

Adobe Reader XI

Adobe Search for Help

Adobe Service Manager Extension

Adobe Setup

Adobe Shockwave Player 11.6

Adobe Type Support CS4

Adobe Type Support x64 CS4

Adobe Update Manager CS4

Adobe WinSoft Linguistics Plugin

Adobe WinSoft Linguistics Plugin x64

Adobe XMP Panels CS4

AdobeColorCommonSetCMYK

AdobeColorCommonSetRGB

Akamai NetSession Interface

Android SDK Tools

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ASUS Android USB Drivers

ASUS Sync

ASUS WebStorage

Audials

Audials TV

BELKIN Bluetooth Software 6.0.1.4400

Bonjour

CamToPrint

CDBurnerXP

Cisco Network Magic

Conexant HD Audio

Connect

Corel Clip Art

Corel Photo Album 7

Cytoscape 2.8.2

DAEMON Tools Lite

DiskAid 5.12

EASEUS Data Recovery Wizard Professional 5.5.1

EGAN WebStart

EPSON Printer Software

FlatOut Ultimate Carnage

Ford Racing 3

Form Pilot Pro version 2.27

GenePattern

geWorkbench_2.2.2

GIMP 2.6.11

Google Chrome

Google Talk Plugin

GTI Racing

ImgBurn

Intel® Graphics Media Accelerator Driver

iPhoneBrowser

iTunes

J-Express 2011

Jamcast

Java 7 Update 7 (64-bit)

Java Auto Updater

Java SE Development Kit 7 Update 7 (64-bit)

Java™ 6 Update 35

Java™ SE Development Kit 7 Update 2 (64-bit)

JavaFX 2.0.2 (64-bit)

JavaFX 2.0.2 SDK (64-bit)

kuler

LEGO MINDSTORMS NXT - English Language Pack

LEGO MINDSTORMS NXT Driver for x64

LEGO MINDSTORMS NXT Migration Package

LEGO MINDSTORMS NXT Patch v2.0f3

LEGO MINDSTORMS NXT Software v2.0

Logitech Vid HD

MacDrive 8

Malwarebytes Anti-Malware version 1.70.0.1100

MATLAB Component Runtime

MediaFACE

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Games for Windows - LIVE Redistributable

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office Groove MUI (English) 2007

Microsoft Office Groove Setup Metadata MUI (English) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office Office 64-bit Components 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared 64-bit MUI (English) 2007

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Visual C++ 2005 Redistributable (x64)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft_VC100_CRT_SP1_x64

Microsoft_VC100_CRT_SP1_x86

MiniTool Partition Wizard Home Edition 7.0

Mozilla Firefox 18.0 (x86 en-US)

Mozilla Maintenance Service

MSVC80_x64_v2

MSVC80_x86_v2

MSVC90_x64

MSVC90_x86

MSXML 4.0 SP3 Parser

National Instruments Software

NAVIGON Fresh 3.4.1

Need for Speed™ ProStreet

NI-RPC 4.2.2f0

NI-RPC 4.2.2f0 for 64 Bit Windows

NI-RPC 4.2.2f0 for Phar Lap ETS

NI Authentication 2.0

NI Authentication 2.0 (64-bit)

NI Curl 1.1

NI Curl 1.1 (64-bit)

NI DataSocket 4.9

NI DataSocket 4.9 (64-bit)

NI Error Reporting 2011

NI EulaDepot

NI GMP Windows 32-bit Installer 11.0.0

NI GMP Windows 64-bit Installer 11.0.0

NI Help Assistant

NI Help Assistant (64bit)

NI LabVIEW 2011 Deployable License

NI LabVIEW 2011 Deployment Framework

NI LabVIEW 2011 Real-Time NBFifo

NI LabVIEW 2011 Run-Time Engine Non-English Support.

NI LabVIEW Run-Time Engine 2011

NI LabVIEW Run-Time Engine Interop 2011

NI LabVIEW Web Server for Run-Time Engine

NI LabWindows/CVI 2010 SP1 Low-Level Driver (Original)

NI LabWindows/CVI 2010 SP1 Low-Level Driver (Updated)

NI License Manager

NI Logos 5.3.0

NI Logos XT Support

NI Logos64 5.3.0

NI Logos64 XT Support

NI Math Kernel Libraries

NI Math Kernel Libraries (64-bit)

NI MDF Support

NI mDNS Responder 1.6 for Windows 64-bit

NI mDNS Responder 1.6.0

NI MXS 5.0.0

NI MXS 5.0.0 for 64 Bit Windows

NI OPC Support

NI SSL Support

NI SSL Support (64-bit)

NI System State Publisher

NI System State Publisher (64-bit)

NI System Web Server 2.0

NI System Web Server Base 2.0

NI System Web Server Base 2.0 (64-bit)

NI TDMS

NI TDMS (64-bit)

NI Trace Engine

NI Trace Engine (64-bit)

NI Uninstaller

NI USI 1.9.0

NI USI 1.9.0 64-Bit

NI Variable Engine (64-bit)

NI Variable Engine 2.5.0

NI VC2005MSMs x64

NI VC2005MSMs x86

NI VC2008MSMs x64

NI VC2008MSMs x86

NI Web Application Server 2.0

NI Web Application Server 2.0 (64-bit)

NI Xerces Delay Load 2.7.3

NI Xerces Delay Load 2.7.3 64-bit

Nokia Connectivity Cable Driver

Nokia Suite

OBO-Edit2 2.1.0

Octoshape add-in for Adobe Flash Player

Opera 12.00

PandoraRecovery (Remove Only)

PC Connectivity Solution

PDF Settings CS4

PFConfig 1.0.163

PhotoScape

Photoshop Camera Raw

Photoshop Camera Raw_x64

PowerISO

Pure Networks Platform

Realtek WLAN Driver

Revo Uninstaller 1.94

Rhapsody

RIM USB Driver 4.1.0

Router Screenshot Grabber 1.0.117

SAMSUNG USB Driver for Mobile Phones

SDFormatter

Skype Click to Call

Skype™ 6.0

Splashtop Streamer

Spotify

Steam

Stellar Phoenix Windows Data Recovery

Stellar Phoenix Windows v4.2

Suite Shared Configuration CS4

swMSM

Unity Web Player

UniversalBox

Universe Sandbox

WBFS Manager 3.0

WBFS Manager 4.0

WinDirStat 1.1.2

Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)

Windows Driver Package - UniversalBox Driver package (10/22/2009 2.06.00)

Windows Media Player Firefox Plugin

Windows Mobile Device Center

WinRAR 4.10 beta 5 (64-bit)

Xpand Rally

Your Uninstaller! 7

.

==== Event Viewer Messages From Past Week ========

.

12/28/2012 9:42:14 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}

12/28/2012 9:42:13 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}

12/28/2012 9:40:11 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.

12/28/2012 9:40:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

12/28/2012 9:40:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

12/28/2012 9:40:03 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

12/28/2012 9:39:54 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}

12/28/2012 9:39:45 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: CBDisk discache MDFSYSNT NetworkX SASDIFSV SASKUTIL SCDEmu spldr Wanarpv6

12/28/2012 9:37:11 PM, Error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0.

12/28/2012 9:23:36 PM, Error: Service Control Manager [7000] - The MCSTRM service failed to start due to the following error: The system cannot find the file specified.

12/28/2012 8:57:13 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: CBDisk discache MDFSYSNT NetworkX SCDEmu spldr Wanarpv6

12/28/2012 8:40:56 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

12/28/2012 8:40:26 PM, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

12/28/2012 8:20:30 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service VSS with arguments "" in order to run the server: {E579AB5F-1CC4-44B4-BED9-DE0991FF0623}

12/28/2012 7:57:54 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}

12/28/2012 7:36:31 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

12/28/2012 7:24:44 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service COMSysApp with arguments "" in order to run the server: {182C40F0-32E4-11D0-818B-00A0C9231C29}

12/28/2012 7:16:45 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.

12/28/2012 7:16:45 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Multimedia Class Scheduler service, but this action failed with the following error: An instance of the service is already running.

12/28/2012 7:16:45 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Extensible Authentication Protocol service, but this action failed with the following error: An instance of the service is already running.

12/28/2012 7:16:45 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Computer Browser service, but this action failed with the following error: An instance of the service is already running.

12/28/2012 7:15:45 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Server service, but this action failed with the following error: An instance of the service is already running.

12/28/2012 7:15:45 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Application Experience service, but this action failed with the following error: An instance of the service is already running.

12/28/2012 7:14:54 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Jamcast service to connect.

12/28/2012 7:14:54 PM, Error: Service Control Manager [7000] - The Jamcast service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

12/28/2012 7:14:45 AM, Error: Service Control Manager [7031] - The Windows Update service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

12/28/2012 7:14:45 AM, Error: Service Control Manager [7031] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

12/28/2012 7:14:45 AM, Error: Service Control Manager [7031] - The User Profile Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

12/28/2012 7:14:45 AM, Error: Service Control Manager [7031] - The Themes service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

12/28/2012 7:14:45 AM, Error: Service Control Manager [7031] - The Task Scheduler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

12/28/2012 7:14:45 AM, Error: Service Control Manager [7031] - The System Event Notification Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

12/28/2012 7:14:45 AM, Error: Service Control Manager [7031] - The Shell Hardware Detection service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

12/28/2012 7:14:45 AM, Error: Service Control Manager [7031] - The Server service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

12/28/2012 7:14:45 AM, Error: Service Control Manager [7031] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

12/28/2012 7:14:45 AM, Error: Service Control Manager [7031] - The IP Helper service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

12/28/2012 7:14:45 AM, Error: Service Control Manager [7031] - The IKE and AuthIP IPsec Keying Modules service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

12/28/2012 7:14:45 AM, Error: Service Control Manager [7031] - The Group Policy Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

12/28/2012 7:14:45 AM, Error: Service Control Manager [7031] - The Extensible Authentication Protocol service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

12/28/2012 7:14:45 AM, Error: Service Control Manager [7031] - The Computer Browser service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

12/28/2012 7:14:45 AM, Error: Service Control Manager [7031] - The Background Intelligent Transfer Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

12/28/2012 7:14:45 AM, Error: Service Control Manager [7031] - The Application Experience service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

12/28/2012 7:14:40 AM, Error: Service Control Manager [7034] - The Diagnostic System Host service terminated unexpectedly. It has done this 1 time(s).

12/28/2012 7:14:40 AM, Error: Service Control Manager [7031] - The WLAN AutoConfig service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

12/28/2012 7:14:40 AM, Error: Service Control Manager [7031] - The Windows Driver Foundation - User-mode Driver Framework service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

12/28/2012 7:14:40 AM, Error: Service Control Manager [7031] - The Windows Audio Endpoint Builder service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

12/28/2012 7:14:40 AM, Error: Service Control Manager [7031] - The Superfetch service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

12/28/2012 7:14:40 AM, Error: Service Control Manager [7031] - The Program Compatibility Assistant Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

12/28/2012 7:14:40 AM, Error: Service Control Manager [7031] - The Portable Device Enumerator Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

12/28/2012 7:14:40 AM, Error: Service Control Manager [7031] - The Network Connections service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.

12/28/2012 7:14:40 AM, Error: Service Control Manager [7031] - The Human Interface Device Access service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

12/28/2012 7:14:40 AM, Error: Service Control Manager [7031] - The Distributed Link Tracking Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

12/28/2012 7:14:40 AM, Error: Service Control Manager [7031] - The Desktop Window Manager Session Manager service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

12/28/2012 7:12:51 AM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

12/28/2012 7:12:18 AM, Error: volsnap [14] - The shadow copies of volume C: were aborted because of an IO failure on volume C:.

12/28/2012 2:56:19 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.

12/28/2012 2:49:12 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WcesComm with arguments "" in order to run the server: {FF4C4832-2BEA-4472-98A3-F931BEB8F62B}

12/28/2012 2:38:15 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.

12/28/2012 2:34:13 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}

12/28/2012 2:34:13 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}

12/28/2012 2:24:41 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD CBDisk DfsC discache MDFSYSNT NetBIOS NetBT NetworkX nsiproxy Psched rdbss SCDEmu spldr tdx vwififlt Wanarpv6 WfpLwf

12/28/2012 2:24:41 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

12/28/2012 2:24:41 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.

12/28/2012 2:24:41 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.

12/28/2012 2:24:41 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

12/28/2012 2:24:41 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

12/28/2012 2:24:41 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.

12/28/2012 2:24:41 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

12/28/2012 2:24:41 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

12/28/2012 2:24:41 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.

12/28/2012 2:24:41 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.

12/28/2012 11:36:10 AM, Error: Service Control Manager [7022] - The Windows Mobile-2003-based device connectivity service hung on starting.

12/28/2012 11:34:10 AM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.

12/28/2012 11:33:11 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the AudioEndpointBuilder service.

12/28/2012 11:32:41 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SENS service.

12/28/2012 11:32:11 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service.

12/28/2012 11:31:41 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the stisvc service.

12/28/2012 11:31:27 AM, Error: Service Control Manager [7022] - The Windows Search service hung on starting.

12/28/2012 11:31:11 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SysMain service.

12/28/2012 11:30:24 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the RapiMgr service.

12/28/2012 10:10:32 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.

12/28/2012 1:57:23 PM, Error: VDS Basic Provider [1] - Unexpected failure. Error code: D@01010004

12/28/2012 1:49:50 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Spooler service.

12/28/2012 1:49:20 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SplashtopRemoteService service.

12/28/2012 1:47:01 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the EapHost service.

12/28/2012 1:46:31 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WerSvc service.

12/28/2012 1:46:31 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.

12/28/2012 1:28:05 AM, Error: Service Control Manager [7034] - The Pure Networks Platform Service service terminated unexpectedly. It has done this 1 time(s).

12/21/2012 9:08:25 PM, Error: NetBT [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.0.104. The computer with the IP address 192.168.0.102 did not allow the name to be claimed by this computer.

12/21/2012 3:14:30 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer HP-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{C708EEA2-D231-465D-BF71-4884588D68A5}. The master browser is stopping or an election is being forced.

.

==== End Of File ===========================

DDS.TXT

DDS (Ver_2012-11-20.01) - NTFS_AMD64 NETWORK

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_35

Run by Dibbs at 22:09:57 on 2012-12-28

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3894.2900 [GMT -5:00]

.

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\Explorer.EXE

C:\Windows\system32\ctfmon.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

uRun: [steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent

uRun: [spotify] "C:\Users\Dibbs\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart

uRun: [NokiaSuite.exe] C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe -tray

uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun

uRun: [spotify Web Helper] "C:\Users\Dibbs\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

uRun: [Akamai NetSession Interface] "C:\Users\Dibbs\AppData\Local\Akamai\netsession_win.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.110.223\AsusWSPanel.exe /S

mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

mRun: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

mRun: [MediaFace Integration] C:\Program Files (x86)\Fellowes\MediaFACE 5.0\SetHook.exe

mRun: [Corel Photo Downloader] "C:\Program Files (x86)\Corel\Corel Photo Album 7\Corel Photo Downloader.exe" -startup

mRun: [Corel File Shell Monitor] C:\Program Files (x86)\Corel\Corel Photo Album 7\CorelIOMonitor.exe

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE -startup

mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"

mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"

mRun: [Jamcast System Tray Utility] "C:\Program Files (x86)\Jamcast\jctray.exe"

mRun: [ASUS Sync Loader] "C:\Program Files (x86)\ASUS\ASUS Sync\asusUPCTLoader.exe" -startup

mRun: [nmctxth] "C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe"

mRunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files\Belkin\Bluetooth Software\BTTray.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\NIERRO~1.LNK - C:\Program Files (x86)\National Instruments\Shared\NI Error Reporting\nierserver.exe

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDrives = dword:0

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: Send image to &Bluetooth Device... - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm

IE: Send page to &Bluetooth Device... - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll

IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm

DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} - hxxp://quickscan.bitdefender.com/qsax/qsax.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

TCP: NameServer = 192.168.0.1

TCP: Interfaces\{C708EEA2-D231-465D-BF71-4884588D68A5} : DHCPNameServer = 192.168.0.1

TCP: Interfaces\{C708EEA2-D231-465D-BF71-4884588D68A5}\F6074796D657D677966696 : DHCPNameServer = 10.240.205.161 10.240.205.162

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\puresp4.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

SSODL: WebCheck - <orphaned>

SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

x64-BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

x64-BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

x64-Run: [cAudioFilterAgent] C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe

x64-Run: [smartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe /t

x64-Run: [MacDrive 8 application] "C:\Program Files\Mediafour\MacDrive 8\MacDrive.exe"

x64-Run: [Getting started with MacDrive 8] "C:\Program Files\Mediafour\MacDrive 8\MDGetStarted.exe" /auto

x64-Run: [Form Pilot Pro virtual printer agent] "C:\Program Files\Form Pilot Pro\fppragent.exe"

x64-Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe

x64-Run: [Corel Photo Downloader] "C:\Program Files (x86)\Corel\Corel Photo Album 7\Corel Photo Downloader.exe" -startup

x64-IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm

x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned>

x64-Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\amd64\puresp4.dll

x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - <orphaned>

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-Notify: igfxcui - igfxdev.dll

x64-SSODL: WebCheck - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Dibbs\AppData\Roaming\Mozilla\Firefox\Profiles\zpncz643.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.nytimes.com/

FF - prefs.js: network.proxy.ftp - 122.165.59.98

FF - prefs.js: network.proxy.ftp_port - 80

FF - prefs.js: network.proxy.http - 122.165.59.98

FF - prefs.js: network.proxy.http_port - 80

FF - prefs.js: network.proxy.socks - 122.165.59.98

FF - prefs.js: network.proxy.socks_port - 80

FF - prefs.js: network.proxy.ssl - 122.165.59.98

FF - prefs.js: network.proxy.ssl_port - 80

FF - prefs.js: network.proxy.type - 0

FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\nplv2011win32.dll

FF - plugin: C:\Users\Dibbs\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll

FF - plugin: C:\Users\Dibbs\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll

FF - plugin: C:\Users\Dibbs\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll

FF - plugin: C:\Users\Dibbs\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll

FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll

FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1166636.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll

FF - plugin: C:\Windows\SysWOW64\npdeployJava1.dll

FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

.

============= SERVICES / DRIVERS ===============

.

R0 MDPMGRNT;MacDrive Partition Driver;C:\Windows\System32\drivers\MDPMGRNT.SYS [2011-12-17 32424]

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2012-6-15 283200]

R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2012-7-11 140672]

R3 HECIx64;Intel® Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2009-9-17 56344]

R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2011-4-20 169584]

R3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;C:\Windows\System32\drivers\rtl8192se.sys [2011-12-11 946688]

S0 MDFSYSNT;MacDrive file system driver;C:\Windows\System32\drivers\MDFSYSNT.SYS [2010-10-7 307888]

S1 CBDisk;CBDisk;C:\Windows\System32\drivers\CBDisk.sys [2011-12-17 70344]

S1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]

S1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 Jamcast;Jamcast;C:\Program Files (x86)\Jamcast\jamcastsvc.exe [2012-7-9 64240]

S2 M4LIC;Mediafour M4LIC service;C:\Program Files (x86)\Common Files\Mediafour\M4LIC.EXE [2010-7-20 205312]

S2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-9-27 398184]

S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-9-27 682344]

S2 NIApplicationWebServer;NI Application Web Server;C:\Program Files (x86)\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe [2011-5-27 50336]

S2 nimDNSResponder;National Instruments mDNS Responder Service;C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe [2011-6-1 194224]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-11-9 160944]

S2 SplashtopRemoteService;Splashtop® Remote Service;C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe [2012-6-15 548264]

S2 SSUService;Splashtop Software Updater Service;C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe [2012-3-15 370504]

S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\Windows\System32\drivers\ssudbus.sys [2012-9-19 102368]

S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2012-1-10 1038088]

S3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2010-2-27 158976]

S3 LVRS64;Logitech RightSound Filter Driver;C:\Windows\System32\drivers\lvrs64.sys [2012-1-18 351136]

S3 LVUVC64;Logitech Webcam C260(UVC);C:\Windows\System32\drivers\lvuvc64.sys [2012-1-18 4865568]

S3 mbamchameleon;mbamchameleon;C:\Windows\System32\drivers\mbamchameleon.sys [2012-12-28 36680]

S3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2011-12-11 24176]

S3 nmwcdnsucx64;Nokia USB Flashing Generic;C:\Windows\System32\drivers\nmwcdnsucx64.sys [2011-11-1 12800]

S3 nmwcdnsux64;Nokia USB Flashing Phone Parent;C:\Windows\System32\drivers\nmwcdnsux64.sys [2011-11-1 171008]

S3 pwdrvio;pwdrvio;C:\Windows\System32\pwdrvio.sys [2011-12-17 19936]

S3 pwdspio;pwdspio;C:\Windows\System32\pwdspio.sys [2011-12-17 13280]

S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);C:\Windows\System32\drivers\ssudmdm.sys [2012-9-19 203104]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-2-15 52736]

S4 MacDrive8Service;MacDrive 8 service;C:\Program Files\Mediafour\MacDrive 8\MacDrive8Service.exe [2010-10-8 149504]

S4 NIApplicationWebServer64;NI Application Web Server (64-bit);C:\Program Files\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe [2011-5-27 68256]

.

=============== Created Last 30 ================

.

2012-12-29 02:37:00 -------- d-----w- C:\Users\Dibbs\AppData\Roaming\QuickScan

2012-12-29 02:16:59 36680 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys

2012-12-29 02:02:30 -------- d-----w- C:\Users\Dibbs\AppData\Roaming\SUPERAntiSpyware.com

2012-12-29 02:02:14 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com

2012-12-29 02:02:14 -------- d-----w- C:\Program Files\SUPERAntiSpyware

2012-12-29 01:57:24 -------- d-sh--w- C:\$RECYCLE.BIN

2012-12-29 01:20:28 98816 ----a-w- C:\Windows\sed.exe

2012-12-29 01:20:28 256000 ----a-w- C:\Windows\PEV.exe

2012-12-29 01:20:28 208896 ----a-w- C:\Windows\MBR.exe

2012-12-29 00:57:36 -------- d-----w- C:\Users\Dibbs\AppData\Roaming\EurekaLog

2012-12-29 00:54:42 -------- d-----w- C:\Users\Dibbs\AppData\Roaming\URSoft

2012-12-29 00:54:39 -------- d-----w- C:\Program Files (x86)\Your Uninstaller! 7

2012-12-29 00:54:28 -------- d-----w- C:\Users\Dibbs\AppData\Local\Babylon

2012-12-29 00:54:27 -------- d-----w- C:\Users\Dibbs\AppData\Roaming\Babylon

2012-12-29 00:54:27 -------- d-----w- C:\ProgramData\Babylon

2012-12-29 00:36:56 9125352 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{BAFC8448-AE01-4C5C-863D-ABFF87C948AC}\mpengine.dll

2012-12-28 19:47:15 -------- d-----w- C:\Program Files (x86)\VS Revo Group

2012-12-28 19:04:42 -------- d-----w- C:\Users\Dibbs\AppData\Local\Programs

2012-12-28 16:08:02 -------- d-----w- C:\Users\Dibbs\AppData\Local\RadonLabs

2012-12-28 16:03:20 165376 ----a-w- C:\Windows\SysWow64\unrar.dll

2012-12-08 16:09:27 33328 ----a-w- C:\Windows\System32\drivers\pnarp.sys

2012-12-08 16:09:20 35376 ----a-w- C:\Windows\System32\drivers\purendis.sys

2012-12-08 16:09:20 -------- d-----w- C:\Program Files (x86)\Common Files\Pure Networks Shared

2012-12-08 16:09:10 -------- d-----w- C:\ProgramData\Pure Networks

2012-12-05 03:11:29 -------- d-----w- C:\Program Files (x86)\Pure Networks

.

==================== Find3M ====================

.

2012-12-21 21:52:34 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-12-21 21:52:34 697272 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2012-12-14 21:49:28 24176 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-12-08 16:28:38 952 --sha-w- C:\Windows\SysWow64\KGyGaAvL.sys

2012-10-02 20:55:22 916456 ----a-w- C:\Windows\System32\deployJava1.dll

2012-10-02 20:55:22 108008 ----a-w- C:\Windows\System32\WindowsAccessBridge-64.dll

2012-10-02 20:55:22 1034216 ----a-w- C:\Windows\System32\npdeployJava1.dll

.

============= FINISH: 22:10:44.18 ===============

Edited January 17, 2013 by Maurice Naggar

Maurice Naggar · January 17, 2013

Your logs showed some peer-to-peer filesharing apps: µTorrent. I do not recommend the use of P-2-P programs since such filesharing/downloading from unknown sources is one of the leading causes of transmission of malware.

Risks of File-Sharing Technology.

P2P file sharing: Know the risks

Forum policy on peer-to-peer-programs:

If you're using Peer 2 Peer software such as uTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

http://forums.malwar...showtopic=97700

Confirm for me that you have removed µTorrent & any other peer-to-peer app.

2

Disable CD-ROM Emulation Software:

Please download the following tool DeFogger to your desktop.

Double click DeFogger to run the tool.

The application window will appear

Click the Disable button to disable your CD Emulation drivers.

Click Yes to continue

A 'Finished!' message will appear

Click OK

DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.

3

Unless I have mis-read the logs, this system does NOT have an installed & active Antivirus program :excl:

Download and install an antivirus program, and make sure that you keep it updated

New viruses come out every minute, so it is essential that you have the latest signatures for your antivirus program to provide you with the best possible protection from malicious software.

Two good antivirus programs free for non-commercial home use are Avira Free Antivirus and Microsoft Security Essentials

Note: You should only have one antivirus installed at a time. Having more than one antivirus program installed at once is likely to cause conflicts and may well decrease your overall protection as well as impairing the performance of your PC.

disinfectPL · January 18, 2013

OK.

1. No P2P - all removed.

2. I ran Defogger. It finished successfully. I then reinstalled MBAM. It again got stuck in middle of scan and computer froze. REbooted and uninstalled MBAM. Reboot was very slow and sluggish, until MBAM removed. Computer recovers.

3. The ran DDS.com.

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume1

Install Date: 12/11/2011 2:36:43 AM

System Uptime: 1/18/2013 6:06:02 PM (0 hours ago)

.

Motherboard: Intel Corp. | | Base Board Product Name

Processor: Intel® Core i3 CPU M 350 @ 2.27GHz | CPU | 2130/1066mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 337 GiB total, 134.685 GiB free.

D: is CDROM ()

E: is CDROM ()

F: is CDROM ()

G: is Removable

.

==== Disabled Device Manager Items =============

.

Class GUID:

Description:

Device ID: ACPI\QCI0701\2&DABA3FF&1

Manufacturer:

Name:

PNP Device ID: ACPI\QCI0701\2&DABA3FF&1

Service:

.

==== System Restore Points ===================

.

RP161: 1/15/2013 6:53:42 AM - Scheduled Checkpoint

.

==== Installed Programs ======================

.

«3D Èíñòðóêòîð 2.2.0 Äîìàøíÿÿ âåðñèÿ»

18 WoS Extreme Trucker 2 (v.1.0)

Adobe Acrobat X Pro

Adobe AIR

Adobe Anchor Service CS4

Adobe Anchor Service x64 CS4

Adobe Bridge CS4

Adobe CMaps CS4

Adobe CMaps x64 CS4

Adobe Color - Photoshop Specific CS4

Adobe Color EU Extra Settings CS4

Adobe Color JA Extra Settings CS4

Adobe Color NA Recommended Settings CS4

Adobe Color Video Profiles CS CS4

Adobe CSI CS4

Adobe CSI CS4 x64

Adobe Default Language CS4

Adobe Device Central CS4

Adobe Drive CS4

Adobe Drive CS4 x64

Adobe ExtendScript Toolkit CS4

Adobe Extension Manager CS4

Adobe Flash Player 11 ActiveX 64-bit

Adobe Flash Player 11 Plugin

Adobe Fonts All

Adobe Fonts All x64

Adobe Linguistics CS4

Adobe Linguistics CS4 x64

Adobe Media Player

Adobe Output Module

Adobe PDF Library Files CS4

Adobe PDF Library Files x64 CS4

Adobe Photoshop CS4

Adobe Photoshop CS4 (64 Bit)

Adobe Photoshop CS4 Support

Adobe Reader XI

Adobe Search for Help

Adobe Service Manager Extension

Adobe Setup

Adobe Shockwave Player 11.6

Adobe Type Support CS4

Adobe Type Support x64 CS4

Adobe Update Manager CS4

Adobe WinSoft Linguistics Plugin

Adobe WinSoft Linguistics Plugin x64

Adobe XMP Panels CS4

AdobeColorCommonSetCMYK

AdobeColorCommonSetRGB

Akamai NetSession Interface

Android SDK Tools

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ASUS Android USB Drivers

ASUS Sync

ASUS WebStorage

Audials

Audials TV

BELKIN Bluetooth Software 6.0.1.4400

Bonjour

Burnout Paradise The Ultimate Box

CamToPrint

CDBurnerXP

Cisco Network Magic

Conexant HD Audio

Connect

Corel Clip Art

Corel Photo Album 7

Cytoscape 2.8.2

DAEMON Tools Lite

DiskAid 5.12

EASEUS Data Recovery Wizard Professional 5.5.1

EGAN WebStart

eMusic Download Manager 6

EPSON Printer Software

FlatOut Ultimate Carnage

Ford Racing 3

Form Pilot Pro version 2.27

GenePattern

geWorkbench_2.2.2

GIMP 2.6.11

Google Chrome

Google Talk Plugin

GTI Racing

HP Officejet 4620 series Basic Device Software

HP Officejet 4620 series Help

HP Update

I.R.I.S. OCR

ImgBurn

Intel® Graphics Media Accelerator Driver

iPhoneBrowser

iTunes

J-Express 2011

Java 7 Update 7 (64-bit)

Java Auto Updater

Java SE Development Kit 7 Update 7 (64-bit)

Java 6 Update 35

Java SE Development Kit 7 Update 2 (64-bit)

JavaFX 2.0.2 (64-bit)

JavaFX 2.0.2 SDK (64-bit)

K-Lite Codec Pack 5.9.0 (Basic)

Kaspersky Internet Security 2013

kuler

LEGO MINDSTORMS NXT - English Language Pack

LEGO MINDSTORMS NXT Driver for x64

LEGO MINDSTORMS NXT Migration Package

LEGO MINDSTORMS NXT Patch v2.0f3

LEGO MINDSTORMS NXT Software v2.0

Logitech Vid HD

MacDrive 8

MATLAB Component Runtime

MediaFACE

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Games for Windows - LIVE Redistributable

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office Groove MUI (English) 2007

Microsoft Office Groove Setup Metadata MUI (English) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office Office 64-bit Components 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared 64-bit MUI (English) 2007

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Visual C++ 2005 Redistributable (x64)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft_VC100_CRT_SP1_x64

Microsoft_VC100_CRT_SP1_x86

MiniTool Partition Wizard Home Edition 7.0

Mozilla Firefox 19.0 (x86 en-US)

Mozilla Maintenance Service

MSVC80_x64_v2

MSVC80_x86_v2

MSVC90_x64

MSVC90_x86

MSXML 4.0 SP3 Parser

National Instruments Software

NAVIGON Fresh 3.4.1

Need for Speed™ ProStreet

NI-RPC 4.2.2f0

NI-RPC 4.2.2f0 for 64 Bit Windows

NI-RPC 4.2.2f0 for Phar Lap ETS

NI Authentication 2.0

NI Authentication 2.0 (64-bit)

NI Curl 1.1

NI Curl 1.1 (64-bit)

NI DataSocket 4.9

NI DataSocket 4.9 (64-bit)

NI Error Reporting 2011

NI EulaDepot

NI GMP Windows 32-bit Installer 11.0.0

NI GMP Windows 64-bit Installer 11.0.0

NI Help Assistant

NI Help Assistant (64bit)

NI LabVIEW 2011 Deployable License

NI LabVIEW 2011 Deployment Framework

NI LabVIEW 2011 Real-Time NBFifo

NI LabVIEW 2011 Run-Time Engine Non-English Support.

NI LabVIEW Run-Time Engine 2011

NI LabVIEW Run-Time Engine Interop 2011

NI LabVIEW Web Server for Run-Time Engine

NI LabWindows/CVI 2010 SP1 Low-Level Driver (Original)

NI LabWindows/CVI 2010 SP1 Low-Level Driver (Updated)

NI License Manager

NI Logos 5.3.0

NI Logos XT Support

NI Logos64 5.3.0

NI Logos64 XT Support

NI Math Kernel Libraries

NI Math Kernel Libraries (64-bit)

NI MDF Support

NI mDNS Responder 1.6 for Windows 64-bit

NI mDNS Responder 1.6.0

NI MXS 5.0.0

NI MXS 5.0.0 for 64 Bit Windows

NI OPC Support

NI SSL Support

NI SSL Support (64-bit)

NI System State Publisher

NI System State Publisher (64-bit)

NI System Web Server 2.0

NI System Web Server Base 2.0

NI System Web Server Base 2.0 (64-bit)

NI TDMS

NI TDMS (64-bit)

NI Trace Engine

NI Trace Engine (64-bit)

NI Uninstaller

NI USI 1.9.0

NI USI 1.9.0 64-Bit

NI Variable Engine (64-bit)

NI Variable Engine 2.5.0

NI VC2005MSMs x64

NI VC2005MSMs x86

NI VC2008MSMs x64

NI VC2008MSMs x86

NI Web Application Server 2.0

NI Web Application Server 2.0 (64-bit)

NI Xerces Delay Load 2.7.3

NI Xerces Delay Load 2.7.3 64-bit

Nokia Connectivity Cable Driver

Nokia Suite

OBO-Edit2 2.1.0

Octoshape add-in for Adobe Flash Player

Opera 12.12

PandoraRecovery (Remove Only)

PC Connectivity Solution

PDF Settings CS4

PFConfig 1.0.163

PhotoScape

Photoshop Camera Raw

Photoshop Camera Raw_x64

PowerISO

Pure Networks Platform

Realtek WLAN Driver

Revo Uninstaller 1.94

Rhapsody

RIM USB Driver 4.1.0

Router Screenshot Grabber 1.0.117

SAMSUNG USB Driver for Mobile Phones

SDFormatter

Skype Click to Call

Skype™ 6.0

Splashtop Streamer

Spotify

Steam

Stellar Phoenix Windows Data Recovery

Stellar Phoenix Windows v4.2

Suite Shared Configuration CS4

swMSM

Unity Web Player

UniversalBox

Universe Sandbox

VLC media player 2.0.5

WBFS Manager 3.0

WBFS Manager 4.0

WinDirStat 1.1.2

Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)

Windows Driver Package - UniversalBox Driver package (10/22/2009 2.06.00)

Windows Media Player Firefox Plugin

Windows Mobile Device Center

WinRAR 4.10 beta 5 (64-bit)

Xpand Rally

Your Uninstaller! 7

.

==== Event Viewer Messages From Past Week ========

.

1/18/2013 6:06:25 PM, Error: Service Control Manager [7000] - The MCSTRM service failed to start due to the following error: The system cannot find the file specified.

1/18/2013 6:04:54 PM, Error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0.

1/14/2013 11:20:39 AM, Error: volsnap [14] - The shadow copies of volume C: were aborted because of an IO failure on volume C:.

1/13/2013 9:35:36 AM, Error: Service Control Manager [7034] - The Pure Networks Platform Service service terminated unexpectedly. It has done this 1 time(s).

.

==== End Of File ===========================

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_35

Run by Dibbs at 18:14:16 on 2013-01-18

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3894.1727 [GMT -5:00]

.

AV: Kaspersky Internet Security *Enabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}

SP: Kaspersky Internet Security *Enabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Kaspersky Internet Security *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\crypserv.exe

C:\Windows\SysWOW64\lkads.exe

C:\Program Files (x86)\Common Files\Mediafour\M4LIC.EXE

C:\Program Files (x86)\National Instruments\MAX\nimxs.exe

C:\Program Files (x86)\National Instruments\Shared\Security\nidmsrv.exe

C:\Program Files (x86)\National Instruments\Shared\NI WebServer\SystemWebServer.exe

C:\Program Files (x86)\National Instruments\Shared\Tagger\tagsrv.exe

C:\Windows\SysWOW64\PnkBstrA.exe

C:\Windows\SysWOW64\PSIService.exe

C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe

C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\SysWOW64\lkcitdl.exe

C:\Windows\SysWOW64\lktsrv.exe

C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe

C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe

C:\Program Files (x86)\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe

C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\WUDFHost.exe

C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Program Files\Mediafour\MacDrive 8\MacDrive.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files (x86)\Corel\Corel Photo Album 7\Corel Photo Downloader.exe

C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe

C:\Program Files (x86)\Corel\Corel Photo Album 7\CorelIOMonitor.exe

C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe

C:\Program Files\Belkin\Bluetooth Software\BTTray.exe

C:\Program Files (x86)\National Instruments\Shared\NI Error Reporting\nierserver.exe

C:\Windows\system32\RunDll32.exe

C:\Program Files (x86)\PowerISO\PWRISOVM.EXE

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\HP\HP Officejet 4620 series\Bin\HPNetworkCommunicatorCom.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\HP\HP Officejet 4620 series\Bin\HPNetworkCommunicator.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\system32\svchost.exe -k WindowsMobile

C:\Windows\system32\sppsvc.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Content Blocker Plugin: {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll

BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

BHO: Virtual Keyboard Plugin: {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO: Safe Money Plugin: {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll

BHO: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: URL Advisor Plugin: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll

BHO: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

uRun: [Akamai NetSession Interface] "C:\Users\Dibbs\AppData\Local\Akamai\netsession_win.exe"

uRun: [HP Officejet 4620 series (NET)] "C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN29S215PP05RT:NW" -scfn "HP Officejet 4620 series (NET)" -AutoStart 1

uRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"

mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"

mRun: [Corel File Shell Monitor] C:\Program Files (x86)\Corel\Corel Photo Album 7\CorelIOMonitor.exe

mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe

mRun: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe"

mRun: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE -startup

dRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

StartupFolder: C:\Users\Dibbs\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\MONITO~1.LNK - C:\Windows\System32\RunDll32.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files\Belkin\Bluetooth Software\BTTray.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\NIERRO~1.LNK - C:\Program Files (x86)\National Instruments\Shared\NI Error Reporting\nierserver.exe

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDrives = dword:0

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: Add to Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ie_banner_deny.htm

IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: Send image to &Bluetooth Device... - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm

IE: Send page to &Bluetooth Device... - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm

IE: {0C4CC089-D306-440D-9772-464E226F6539} - {0BA14598-4178-4CE5-B1F1-B5C6408A3F2E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll

IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm

IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll

DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} - hxxp://quickscan.bitdefender.com/qsax/qsax.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

TCP: NameServer = 192.168.0.1

TCP: Interfaces\{C708EEA2-D231-465D-BF71-4884588D68A5} : DHCPNameServer = 192.168.0.1

TCP: Interfaces\{C708EEA2-D231-465D-BF71-4884588D68A5}\F6074796D657D677966696 : DHCPNameServer = 10.240.205.161 10.240.205.162

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\puresp4.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

SSODL: WebCheck - <orphaned>

SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

x64-BHO: Content Blocker Plugin: {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll

x64-BHO: Virtual Keyboard Plugin: {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll

x64-BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

x64-BHO: Safe Money Plugin: {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll

x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

x64-BHO: URL Advisor Plugin: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll

x64-Run: [cAudioFilterAgent] C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe

x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

x64-Run: [MacDrive 8 application] "C:\Program Files\Mediafour\MacDrive 8\MacDrive.exe"

x64-Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe

x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

x64-Run: [Corel Photo Downloader] "C:\Program Files (x86)\Corel\Corel Photo Album 7\Corel Photo Downloader.exe" -startup

x64-IE: {0C4CC089-D306-440D-9772-464E226F6539} - {0BA14598-4178-4CE5-B1F1-B5C6408A3F2E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll

x64-IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm

x64-IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll

x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned>

x64-Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\amd64\puresp4.dll

x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - <orphaned>

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-Notify: igfxcui - igfxdev.dll

x64-SSODL: WebCheck - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Dibbs\AppData\Roaming\Mozilla\Firefox\Profiles\zpncz643.default\

FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\eMusic Download Manager 6\npEMusic602.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\nplv2011win32.dll

FF - plugin: C:\Users\Dibbs\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll

FF - plugin: C:\Users\Dibbs\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll

FF - plugin: C:\Users\Dibbs\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll

FF - plugin: C:\Users\Dibbs\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll

FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll

FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1166636.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll

FF - plugin: C:\Windows\SysWOW64\npdeployJava1.dll

FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

FF - ExtSQL: 2012-12-29 19:33; anti_banner@kaspersky.com; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com

FF - ExtSQL: 2012-12-29 19:33; content_blocker@kaspersky.com; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com

FF - ExtSQL: 2012-12-29 19:33; online_banking@kaspersky.com; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com

FF - ExtSQL: 2012-12-29 19:33; url_advisor@kaspersky.com; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com

FF - ExtSQL: 2012-12-29 19:33; virtual_keyboard@kaspersky.com; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com

.

============= SERVICES / DRIVERS ===============

.

R0 MDFSYSNT;MacDrive file system driver;C:\Windows\System32\drivers\MDFSYSNT.SYS [2010-10-7 307888]

R0 MDPMGRNT;MacDrive Partition Driver;C:\Windows\System32\drivers\MDPMGRNT.SYS [2011-12-17 32424]

R1 CBDisk;CBDisk;C:\Windows\System32\drivers\CBDisk.sys [2011-12-17 70344]

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2012-6-15 283200]

R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\System32\drivers\klim6.sys [2012-8-2 28504]

R1 kltdi;kltdi;C:\Windows\System32\drivers\kltdi.sys [2012-6-8 54104]

R1 kneps;kneps;C:\Windows\System32\drivers\kneps.sys [2012-8-13 178008]

R2 AVP;Kaspersky Anti-Virus Service;C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe -r --> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe -r [?]

R2 M4LIC;Mediafour M4LIC service;C:\Program Files (x86)\Common Files\Mediafour\M4LIC.EXE [2010-7-20 205312]

R2 NIApplicationWebServer;NI Application Web Server;C:\Program Files (x86)\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe [2011-5-27 50336]

R2 nimDNSResponder;National Instruments mDNS Responder Service;C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe [2011-6-1 194224]

R2 SplashtopRemoteService;Splashtop® Remote Service;C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe [2012-6-15 548264]

R2 SSUService;Splashtop Software Updater Service;C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe [2012-3-15 370504]

R3 HECIx64;Intel® Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2009-9-17 56344]

R3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2010-2-27 158976]

R3 klkbdflt;Kaspersky Lab KLKBDFLT;C:\Windows\System32\drivers\klkbdflt.sys [2012-10-25 29016]

R3 klmouflt;Kaspersky Lab KLMOUFLT;C:\Windows\System32\drivers\klmouflt.sys [2012-10-25 29528]