Infected with FBI MoneyPak even in Safe Mode

mayday757 · January 19, 2013

Hello,

I am using Windows 7 64-bit and am infected with the FBI MoneyPak as of today. The lockout occurs even in safe mode. I have made multiple attempts to remove it, including running Malwarebytes. Initially I was able to get into SafeMode, but no longer.

Any assistance would be appreciated.

Thanks.

B

gringo_pr · January 20, 2013

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your malware problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

How to tell > 32 or 64 bit

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

- Startup Repair
  System Restore
  Windows Complete PC Restore
  Windows Memory Diagnostic Tool
  Command Prompt

[*]Select Command Prompt

[*]In the command window type in notepad and press Enter.

[*]The notepad opens. Under File menu select Open.

[*]Select "Computer" and find your flash drive letter and close the notepad.

[*]In the command window type e:\frst64.exe and press Enter

Note: Replace letter e with the drive letter of your flash drive.

[*]The tool will start to run.

[*]When the tool opens click Yes to disclaimer.

[*]First Press the Scan button.

[*]It will make a log (FRST.txt)

[*]Second Type the following in the edit box after "Search:". services.exe

[*]Click the Search button

[*]It will make a log (Search.txt)

I want you to poste Both the FRST.txt report and the Search.txt into your reply to me

Gringo

mayday757 · January 20, 2013

Hello Gringo. Thanks for the reply. Here is the FRST.txt

-------------------------------------------------------

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-01-2013

Ran by SYSTEM at 19-01-2013 20:11:36

Running from H:\

Windows 7 Ultimate (X64) OS Language: English(US)

The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [RunDLLEntry] C:\Windows\system32\RunDLL32.exe C:\Windows\system32\AmbRunE.dll,RunDLLEntry [17920 2009-02-26] (Creative Technology Ltd.)

HKLM\...\Run: [Logitech Download Assistant] C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch [1580368 2010-11-03] (Logitech, Inc.)

HKLM\...\Run: [LogiScrollApp] C:\Program Files\Logitech\ScrollApp\KhalScroll.exe [50456 2011-09-15] (Logitech, Inc.)

HKLM\...\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming [1744152 2011-10-07] (Logitech, Inc.)

HKLM\...\Run: [PocketCloud Location] "C:\Program Files (x86)\Wyse\PocketCloud Windows Companion\WyseBrowser.exe" [935312 2012-11-05] (Wyse Technology Inc.)

HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\mssecex.exe" -hide -runkey [x]

HKLM-x32\...\Run: [soundMAXPnP] C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1310720 2009-09-16] (Analog Devices, Inc.)

HKLM-x32\...\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe [36864 2009-07-12] ()

HKLM-x32\...\Run: [VolPanel] "C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe" /r [241789 2009-07-07] (Creative Technology Ltd)

HKLM-x32\...\Run: [updReg] C:\Windows\UpdReg.EXE [90112 2000-05-10] (Creative Technology Ltd.)

HKLM-x32\...\Run: [TweakIt Help] "C:\Program Files\ASUS\TweakIt\TweakIt.exe" -r [817152 2009-03-13] ()

HKLM-x32\...\Run: [updatePSTShortCut] "C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter" [210216 2009-02-03] (CyberLink Corp.)

HKLM-x32\...\Run: [bDRegion] C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [75048 2008-12-02] (cyberlink)

HKLM-x32\...\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-09-27] (Apple Inc.)

HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-11-28] (Apple Inc.)

HKLM-x32\...\Run: [RemoteControl8] "C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe" [91432 2009-07-16] (CyberLink Corp.)

HKLM-x32\...\Run: [PDVD8LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe" [50472 2009-04-15] (CyberLink Corp.)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [38872 2012-07-31] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [919008 2012-07-11] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" -minimized [522744 2012-06-07] (Cisco Systems, Inc.)

HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152544 2012-12-12] (Apple Inc.)

HKU\Brett\...\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden [2387968 2008-12-06] (Hewlett-Packard Company)

HKU\Brett\...\Run: [steam] "C:\Program Files (x86)\Steam\steam.exe" -silent [1354736 2012-12-08] (Valve Corporation)

HKU\Brett\...\Run: [Google Update] "C:\Users\Brett\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2010-12-12] (Google Inc.)

HKU\Brett\...\Run: [Audiogalaxy] "C:\Users\Brett\AppData\Local\Audiogalaxy\Audiogalaxy.exe" /startup [2955496 2011-12-13] (AG Entertainment Inc)

HKU\Brett\...\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59280 2012-11-28] (Apple Inc.)

HKU\Brett\...\Run: [igndlm.exe] C:\Program Files (x86)\Download Manager\DLM.exe /windowsstart /startifwork [1103216 2009-10-27] (IGN Entertainment)

HKU\Brett\...\Run: [WanderPlayer] "C:\Users\Brett\AppData\Local\Orthogonal Labs\WanderPlayer Desktop\Application\WanderPlayerLauncher.exe" [62232 2012-03-19] (Orthogonal Labs, Inc.)

HKU\Brett\...\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe [x]

HKU\Brett\...\Run: [skyDrive] "C:\Users\Brett\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe" /background [255992 2012-11-15] (Microsoft Corporation)

HKU\Brett\...\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59280 2012-11-28] (Apple Inc.)

HKU\Brett\...\Run: [ieodjrzotp] C:\Users\Brett\AppData\Roaming\phxzbypky [x]

Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

AppInit_DLLs:

Tcpip\..\Interfaces\{CD37F8D9-6986-4A52-B5CE-EA00FB043FB9}: [NameServer]8.8.8.8,8.8.8.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1

Startup: C:\Users\Brett\Start Menu\Programs\Startup\AutoHotkey.lnk

ShortcutTarget: AutoHotkey.lnk -> C:\Program Files\AutoHotkey\AutoHotkey.exe ()

Startup: C:\Users\Brett\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> (No File)

Startup: C:\Users\Brett\Start Menu\Programs\Startup\Launch Jawbone Updater.lnk

ShortcutTarget: Launch Jawbone Updater.lnk -> C:\Program Files (x86)\Jawbone\LaunchJU.exe ()

==================== Services (Whitelisted) ===================

2 AEADIFilters; C:\Windows\System32\AEADISRV.EXE [111616 2009-09-16] (Andrea Electronics Corporation)

2 AirPrint; C:\Program Files (x86)\AirPrint\airprint.exe -s [234784 2010-12-04] (Apple Inc.)

2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [108904 2013-01-19] (SurfRight B.V.)

2 MsMpSvc; "C:\Program Files\Microsoft Security Client\MsMpEng.exe" [22072 2012-09-12] (Microsoft Corporation)

3 NisSrv; "C:\Program Files\Microsoft Security Client\NisSrv.exe" [368896 2012-09-12] (Microsoft Corporation)

2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1494144 2012-09-11] (Microsoft Corporation)

2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2012-01-03] ()

2 ReflectService.exe; "C:\Program Files\Macrium\Reflect\ReflectService.exe" [302352 2012-12-24] ()

2 RichVideo; "C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe" [247152 2008-11-25] ()

2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [1021888 2012-10-10] (Enigma Software Group USA, LLC.)

2 TabletServiceWacom; C:\Windows\system32\Wacom_Tablet.exe [5521192 2009-11-24] (Wacom Technology, Corp.)

2 vmware-converter-agent; "C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe" -s "C:\ProgramData\VMware\VMware vCenter Converter Standalone\converter-agent.xml" [6285 2011-10-10] ()

2 vmware-converter-server; "C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe" -s "C:\ProgramData\VMware\VMware vCenter Converter Standalone\converter-server.xml" [4291 2011-10-10] ()

2 vmware-converter-worker; "C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe" -s "C:\ProgramData\VMware\VMware vCenter Converter Standalone\converter-worker.xml" [6897 2011-10-10] ()

2 vpnagent; "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe" [478712 2012-06-07] (Cisco Systems, Inc.)

2 WysePocketCloud; "C:\Program Files (x86)\Wyse\PocketCloud Windows Companion\PocketCloudService.exe" [191488 2012-11-05] ()

2 WyseRemoteAccess; "C:\Program Files (x86)\Wyse\PocketCloud Windows Companion\WyseRemoteAccess.exe" -service [1436160 2012-11-05] (Wyse Technology.)

3 rpcapd; "C:\Program Files (x86)\WinPcap\rpcapd.exe" -d -f "C:\Program Files (x86)\WinPcap\rpcapd.ini" [x]

==================== Drivers (Whitelisted) =====================

3 61883; C:\Windows\System32\Drivers\61883.sys [60288 2009-07-13] (Microsoft Corporation)

3 androidusb; C:\Windows\System32\Drivers\motoandroid.sys [31744 2009-07-10] (Motorola)

1 AsIO; C:\Windows\SysWow64\Drivers\AsIO.sys [13368 2009-04-05] ()

3 bmdrvr; C:\Windows\SysWow64\Drivers\bmdrvr.sys [74352 2011-03-14] (VMware, Inc.)

3 EsgScanner; C:\Windows\System32\Drivers\EsgScanner.sys [22704 2012-06-22] ()

3 EuMusDesignVirtualAudioCableWdm_jrm; C:\Windows\System32\DRIVERS\vacjrmkd.sys [56448 2009-11-16] ()

3 hitmanpro37; C:\Windows\System32\Drivers\hitmanpro37.sys [32152 2013-01-19] ()

3 leafnets; C:\Windows\System32\Drivers\leafnets.sys [29696 2011-05-26] (Leaf Networks)

3 libusb0; C:\Windows\System32\Drivers\libusb0.sys [52320 2012-09-26] (http://libusb-win32.sourceforge.net)

3 MCfilt; C:\Windows\System32\drivers\MCfilt64.sys [25600 2009-09-16] (Creative Technology Ltd.)

0 MpFilter; C:\Windows\System32\Drivers\MpFilter.sys [228768 2012-08-30] (Microsoft Corporation)

3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-05-13] ()

2 MySQL; "C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld" --defaults-file="C:\Program Files\MySQL\MySQL Server 5.1\my.ini" MySQL [8920 2010-12-12] ()

2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [128456 2012-08-30] (Microsoft Corporation)

2 NPF; C:\Windows\System32\Drivers\NPF.sys [35344 2010-06-25] (CACE Technologies, Inc.)

3 PSMounter; C:\Windows\System32\Drivers\PSMounter.sys [57536 2012-08-20] (Macrium Software)

3 PSVolAcc; C:\Windows\System32\Drivers\PSVolAcc.sys [14096 2012-12-24] (Paramount Software UK Ltd)

3 RTCore64; \??\C:\Program Files (x86)\MSI Afterburner\RTCore64.sys [13368 2012-01-06] ()

2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; \??\C:\Program Files (x86)\CyberLink\PowerDVD8\000.fcl [146928 2010-01-12] (CyberLink Corp.)

3 ALSysIO; \??\C:\Users\Brett\AppData\Local\Temp\ALSysIO64.sys [x]

3 AWEAlloc; C:\Windows\System32\DRIVERS\awealloc.sys [x]

3 Fwleaf; C:\Windows\System32\DRIVERS\fwleaf.sys [x]

3 GPU-Z; \??\C:\Users\Brett\AppData\Local\Temp\GPU-Z.sys [x]

3 lmimirr; C:\Windows\System32\DRIVERS\lmimirr.sys [x]

2 MCSTRM; [x]

3 PROCEXP151; \??\C:\Windows\system32\Drivers\PROCEXP151.SYS [x]

3 radpms; C:\Windows\System32\DRIVERS\radpms.sys [x]

3 Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys [x]

3 tsusbhub; C:\Windows\System32\drivers\tsusbhub.sys [x]

3 VGPU; C:\Windows\System32\drivers\rdvgkmd.sys [x]

0 vmci; C:\Windows\System32\DRIVERS\vmci.sys [x]

3 VMnetAdapter; C:\Windows\System32\DRIVERS\vmnetadapter.sys [x]

3 WPRO_41_1742; C:\Windows\System32\drivers\WPRO_41_1742.sys [x]

==================== NetSvcs (Whitelisted) ====================

==================== One Month Created Files and Folders ========

2013-01-19 17:06 - 2013-01-19 17:06 - 00032152 ____A C:\Windows\System32\Drivers\hitmanpro37.sys

2013-01-19 15:17 - 2013-01-19 15:17 - 00000400 ____A C:\Windows\System32\.crusader

2013-01-19 15:10 - 2013-01-19 15:10 - 00001897 ____A C:\Users\Public\Desktop\HitmanPro.lnk

2013-01-19 15:10 - 2013-01-19 15:10 - 00000000 ____D C:\Program Files\HitmanPro

2013-01-19 15:09 - 2013-01-19 15:18 - 00000000 ____D C:\Users\All Users\HitmanPro

2013-01-19 13:54 - 2013-01-19 13:54 - 00000354 ____A C:\Users\Brett\Downloads\Result.txt

2013-01-19 13:53 - 2013-01-19 13:53 - 00752287 ____A (Farbar) C:\Users\Brett\Downloads\MiniToolBox.exe

2013-01-19 12:52 - 2013-01-19 12:52 - 01007918 ____A C:\Users\Brett\Downloads\Picturescue.app.zip

2013-01-19 07:31 - 2013-01-19 07:31 - 00002258 ____A C:\Users\Brett\Desktop\SpyHunter.lnk

2013-01-19 07:31 - 2013-01-19 07:31 - 00000000 ____D C:\Windows\83B952C7F8F34CA3B4C533C85B24E478.TMP

2013-01-19 07:31 - 2013-01-19 07:31 - 00000000 ____D C:\sh4ldr

2013-01-19 07:31 - 2013-01-19 07:31 - 00000000 ____D C:\Program Files\Enigma Software Group

2013-01-19 07:31 - 2012-06-22 09:01 - 00022704 ____A C:\Windows\System32\Drivers\EsgScanner.sys

2013-01-19 07:30 - 2013-01-19 07:30 - 00726464 ____A (Enigma Software Group USA, LLC.) C:\Users\Brett\Downloads\SpyHunter-Installer.exe

2013-01-19 07:24 - 2013-01-19 07:24 - 00388608 ____A (Trend Micro Inc.) C:\Users\Brett\Downloads\HijackThis.exe

2013-01-19 07:24 - 2013-01-19 07:24 - 00018676 ____A C:\Users\Brett\Downloads\hijackthis.log

2013-01-19 07:15 - 2013-01-19 15:21 - 00114176 ____A (Bipiho) C:\Users\Brett\AppData\Local\phxzbypky.exe

2013-01-19 07:15 - 2013-01-19 15:08 - 00114176 ____A (Bipiho) C:\Users\All Users\phxzbypky.exe

2013-01-19 07:12 - 2013-01-19 07:12 - 00000000 ____D C:\Users\Brett\AppData\Local\{F7E734CA-88A9-47C1-BE62-2CAA7DDD1AB6}

2013-01-10 00:26 - 2013-01-10 00:26 - 00001450 ____A C:\Windows\PFRO.log

2013-01-09 16:49 - 2012-12-19 11:48 - 00237992 ____A (Oracle Corporation) C:\Windows\System32\Drivers\VBoxDrv.sys

2013-01-09 16:49 - 2012-12-19 11:47 - 00120232 ____A (Oracle Corporation) C:\Windows\System32\Drivers\VBoxUSBMon.sys

2013-01-09 16:48 - 2013-01-09 16:48 - 97461672 ____A (Oracle Corporation) C:\Users\Brett\Downloads\VirtualBox-4.2.6-82870-Win.exe

2013-01-09 16:42 - 2013-01-09 16:46 - 857088000 ____A C:\Users\Brett\Downloads\ubuntu-gnome-12.10.1-desktop-amd64.iso

2013-01-09 16:41 - 2013-01-09 16:41 - 00033091 ____A C:\Users\Brett\Downloads\ubuntu-gnome-12.10.1-desktop-amd64.iso.torrent

2013-01-09 03:48 - 2012-12-07 05:20 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\Wpc.dll

2013-01-09 03:48 - 2012-12-07 05:15 - 02746368 ____A (Microsoft Corporation) C:\Windows\System32\gameux.dll

2013-01-09 03:48 - 2012-12-07 04:26 - 00308736 ____A (Microsoft Corporation) C:\Windows\SysWOW64\Wpc.dll

2013-01-09 03:48 - 2012-12-07 04:20 - 02576384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\gameux.dll

2013-01-09 03:48 - 2012-12-07 03:20 - 00045568 ____A (Microsoft) C:\Windows\System32\oflc-nz.rs

2013-01-09 03:48 - 2012-12-07 03:20 - 00044544 ____A (Microsoft) C:\Windows\System32\pegibbfc.rs

2013-01-09 03:48 - 2012-12-07 03:20 - 00043520 ____A (Microsoft) C:\Windows\System32\csrr.rs

2013-01-09 03:48 - 2012-12-07 03:20 - 00030720 ____A (Microsoft) C:\Windows\System32\usk.rs

2013-01-09 03:48 - 2012-12-07 03:20 - 00023552 ____A (Microsoft) C:\Windows\System32\oflc.rs

2013-01-09 03:48 - 2012-12-07 03:20 - 00020480 ____A (Microsoft) C:\Windows\System32\pegi-pt.rs

2013-01-09 03:48 - 2012-12-07 03:20 - 00020480 ____A (Microsoft) C:\Windows\System32\pegi-fi.rs

2013-01-09 03:48 - 2012-12-07 03:19 - 00055296 ____A (Microsoft) C:\Windows\System32\cero.rs

2013-01-09 03:48 - 2012-12-07 03:19 - 00051712 ____A (Microsoft) C:\Windows\System32\esrb.rs

2013-01-09 03:48 - 2012-12-07 03:19 - 00046592 ____A (Microsoft) C:\Windows\System32\fpb.rs

2013-01-09 03:48 - 2012-12-07 03:19 - 00040960 ____A (Microsoft) C:\Windows\System32\cob-au.rs

2013-01-09 03:48 - 2012-12-07 03:19 - 00021504 ____A (Microsoft) C:\Windows\System32\grb.rs

2013-01-09 03:48 - 2012-12-07 03:19 - 00020480 ____A (Microsoft) C:\Windows\System32\pegi.rs

2013-01-09 03:48 - 2012-12-07 03:19 - 00015360 ____A (Microsoft) C:\Windows\System32\djctq.rs

2013-01-09 03:48 - 2012-12-07 02:46 - 00055296 ____A (Microsoft) C:\Windows\SysWOW64\cero.rs

2013-01-09 03:48 - 2012-12-07 02:46 - 00051712 ____A (Microsoft) C:\Windows\SysWOW64\esrb.rs

2013-01-09 03:48 - 2012-12-07 02:46 - 00046592 ____A (Microsoft) C:\Windows\SysWOW64\fpb.rs

2013-01-09 03:48 - 2012-12-07 02:46 - 00045568 ____A (Microsoft) C:\Windows\SysWOW64\oflc-nz.rs

2013-01-09 03:48 - 2012-12-07 02:46 - 00044544 ____A (Microsoft) C:\Windows\SysWOW64\pegibbfc.rs

2013-01-09 03:48 - 2012-12-07 02:46 - 00043520 ____A (Microsoft) C:\Windows\SysWOW64\csrr.rs

2013-01-09 03:48 - 2012-12-07 02:46 - 00040960 ____A (Microsoft) C:\Windows\SysWOW64\cob-au.rs

2013-01-09 03:48 - 2012-12-07 02:46 - 00030720 ____A (Microsoft) C:\Windows\SysWOW64\usk.rs

2013-01-09 03:48 - 2012-12-07 02:46 - 00023552 ____A (Microsoft) C:\Windows\SysWOW64\oflc.rs

2013-01-09 03:48 - 2012-12-07 02:46 - 00021504 ____A (Microsoft) C:\Windows\SysWOW64\grb.rs

2013-01-09 03:48 - 2012-12-07 02:46 - 00020480 ____A (Microsoft) C:\Windows\SysWOW64\pegi-pt.rs

2013-01-09 03:48 - 2012-12-07 02:46 - 00020480 ____A (Microsoft) C:\Windows\SysWOW64\pegi-fi.rs

2013-01-09 03:48 - 2012-12-07 02:46 - 00020480 ____A (Microsoft) C:\Windows\SysWOW64\pegi.rs

2013-01-09 03:48 - 2012-12-07 02:46 - 00015360 ____A (Microsoft) C:\Windows\SysWOW64\djctq.rs

2013-01-09 03:48 - 2012-11-29 21:45 - 00362496 ____A (Microsoft Corporation) C:\Windows\System32\wow64win.dll

2013-01-09 03:48 - 2012-11-29 21:45 - 00243200 ____A (Microsoft Corporation) C:\Windows\System32\wow64.dll

2013-01-09 03:48 - 2012-11-29 21:45 - 00215040 ____A (Microsoft Corporation) C:\Windows\System32\winsrv.dll

2013-01-09 03:48 - 2012-11-29 21:45 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\wow64cpu.dll

2013-01-09 03:48 - 2012-11-29 21:43 - 00016384 ____A (Microsoft Corporation) C:\Windows\System32\ntvdm64.dll

2013-01-09 03:48 - 2012-11-29 21:41 - 01161216 ____A (Microsoft Corporation) C:\Windows\System32\kernel32.dll

2013-01-09 03:48 - 2012-11-29 21:41 - 00424448 ____A (Microsoft Corporation) C:\Windows\System32\KernelBase.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00006144 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00005120 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:54 - 00005120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2013-01-09 03:48 - 2012-11-29 20:53 - 01114112 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2013-01-09 03:48 - 2012-11-29 20:53 - 00274944 ____A (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00005120 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 19:23 - 00338432 ____A (Microsoft Corporation) C:\Windows\System32\conhost.exe

2013-01-09 03:48 - 2012-11-29 18:44 - 00025600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2013-01-09 03:48 - 2012-11-29 18:44 - 00014336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2013-01-09 03:48 - 2012-11-29 18:44 - 00007680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2013-01-09 03:48 - 2012-11-29 18:44 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2013-01-09 03:48 - 2012-11-29 18:38 - 00006144 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 18:38 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 18:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 18:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2013-01-09 03:48 - 2012-11-29 15:17 - 00420064 ____A C:\Windows\SysWOW64\locale.nls

2013-01-09 03:48 - 2012-11-29 15:15 - 00420064 ____A C:\Windows\System32\locale.nls

2013-01-09 03:48 - 2012-11-22 19:26 - 03149824 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2013-01-09 03:48 - 2012-11-22 19:13 - 00068608 ____A (Microsoft Corporation) C:\Windows\System32\taskhost.exe

2013-01-09 03:48 - 2012-11-21 21:44 - 00800768 ____A (Microsoft Corporation) C:\Windows\System32\usp10.dll

2013-01-09 03:48 - 2012-11-21 20:45 - 00626688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll

2013-01-09 03:48 - 2012-11-19 21:48 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll

2013-01-09 03:48 - 2012-11-19 20:51 - 00220160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2013-01-09 03:48 - 2012-11-08 21:45 - 00750592 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll

2013-01-09 03:48 - 2012-11-08 20:43 - 00492032 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll

2013-01-09 03:48 - 2012-10-31 21:43 - 02002432 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll

2013-01-09 03:48 - 2012-10-31 21:43 - 01882624 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll

2013-01-09 03:48 - 2012-10-31 20:47 - 01389568 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2013-01-09 03:48 - 2012-10-31 20:47 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2013-01-08 08:54 - 2013-01-08 08:55 - 00000000 ____D C:\Users\Brett\AppData\Local\{ABC68136-EEFF-4561-BAFB-D956994E4F21}

2013-01-07 20:54 - 2013-01-07 20:54 - 00000000 ____D C:\Users\Brett\AppData\Local\{6D8613B5-BE7B-43C9-A0F8-B8E4AFDC3D45}

2013-01-07 08:54 - 2013-01-07 08:54 - 00000000 ____D C:\Users\Brett\AppData\Local\{A0084E36-154F-474F-B560-AAC522197EE5}

2013-01-06 20:54 - 2013-01-06 20:54 - 00000000 ____D C:\Users\Brett\AppData\Local\{D3EC48BD-A503-4110-B6C0-E7C2BE2E33F4}

2013-01-06 08:54 - 2013-01-06 08:54 - 00000000 ____D C:\Users\Brett\AppData\Local\{7C4DAF84-6660-4B91-86CE-A724B14922D9}

2013-01-05 22:00 - 2013-01-19 17:06 - 00000392 ____A C:\Windows\setupact.log

2013-01-05 22:00 - 2013-01-05 22:00 - 00000000 ____A C:\Windows\setuperr.log

2013-01-05 20:53 - 2013-01-05 20:54 - 00000000 ____D C:\Users\Brett\AppData\Local\{5114E3FE-6887-4B81-8A0E-045D53EF153D}

2013-01-05 10:22 - 2013-01-05 10:39 - 00000000 ____D C:\Users\Brett\Desktop\taxes

2013-01-05 08:53 - 2013-01-05 08:53 - 00000000 ____D C:\Users\Brett\AppData\Local\{820424A2-C58B-42B1-9B7C-C53B797FEDA5}

2013-01-04 20:53 - 2013-01-04 20:53 - 00000000 ____D C:\Users\Brett\AppData\Local\{2F89A5FF-0D13-4857-B3AB-B4B9E7220F88}

2013-01-04 08:52 - 2013-01-04 08:52 - 00000000 ____D C:\Users\Brett\AppData\Local\{F9176825-6C30-42C8-948B-338F28F57181}

2013-01-02 11:38 - 2013-01-02 11:39 - 04178040 ____A (Piriform Ltd) C:\Users\Brett\Downloads\ccsetup326.exe

2013-01-02 09:31 - 2013-01-02 09:31 - 00000000 ____D C:\Users\Brett\AppData\Local\{0CC8CB50-D090-4427-982A-586316144F24}

2013-01-01 21:31 - 2013-01-01 21:31 - 00000000 ____D C:\Users\Brett\AppData\Local\{9AB1C9A6-ACF9-4EA9-B88E-766EBBC63389}

2013-01-01 09:31 - 2013-01-01 09:31 - 00000000 ____D C:\Users\Brett\AppData\Local\{1A418A78-BACF-47DC-9DBD-EC436F065B1A}

2013-01-01 07:19 - 2013-01-19 06:28 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-01-01 07:19 - 2013-01-08 14:28 - 00697864 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-01-01 07:19 - 2013-01-08 14:28 - 00074248 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2012-12-31 21:30 - 2012-12-31 21:31 - 00000000 ____D C:\Users\Brett\AppData\Local\{5515CD1B-D9D6-4EC6-AF2B-1B3EA23EA27E}

2012-12-31 12:36 - 2012-12-31 12:36 - 33934236 ____A C:\Users\Brett\Downloads\pms-setup-windows-1.72.0.exe

2012-12-31 09:30 - 2012-12-31 09:30 - 00000000 ____D C:\Users\Brett\AppData\Local\{BD1E2AA5-E640-49A6-98F1-AE748215E094}

2012-12-30 21:30 - 2012-12-30 21:30 - 00000000 ____D C:\Users\Brett\AppData\Local\{22330CE7-E60D-4E10-8B4D-F00E0455A617}

2012-12-30 16:59 - 2012-11-28 07:35 - 00095184 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2012-12-30 16:59 - 2012-11-28 07:31 - 00174000 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2012-12-30 16:59 - 2012-11-28 07:31 - 00173992 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2012-12-30 16:58 - 2012-12-30 16:59 - 00004630 ____A C:\Windows\SysWOW64\jupdate-1.7.0_10-b18.log

2012-12-30 09:30 - 2012-12-30 09:30 - 00000000 ____D C:\Users\Brett\AppData\Local\{D73514ED-E845-4090-A082-665B47542E95}

2012-12-29 14:56 - 2012-12-29 14:56 - 00000000 ____D C:\Users\Brett\AppData\Local\{CC2F2519-E6FF-4164-8768-830F5DD011D8}

2012-12-28 12:08 - 2012-12-28 12:08 - 01222200 ____A (Orthogonal Labs, Inc.) C:\Users\Brett\Downloads\WanderPlayerSetup (2).exe

2012-12-27 12:30 - 2012-12-27 12:30 - 00000000 ____D C:\Users\Brett\AppData\Local\MetaGeek,_LLC

2012-12-27 12:17 - 2012-12-27 12:17 - 00000000 ____D C:\Windows\Options

2012-12-27 12:17 - 2012-12-27 12:17 - 00000000 ____D C:\Users\All Users\TP-LINK

2012-12-27 12:17 - 2011-09-07 01:52 - 00007944 ____A C:\Windows\System32\athrextx.cat

2012-12-27 12:17 - 2011-08-31 10:55 - 02736640 ____A (Atheros Communications, Inc.) C:\Windows\System32\Drivers\athrx.sys

2012-12-27 12:17 - 2011-08-31 10:55 - 02736640 ____A (Atheros Communications, Inc.) C:\Windows\System32\athrx.sys

2012-12-27 11:48 - 2012-12-27 11:48 - 00000051 ____A C:\Users\Brett\Desktop\speedtest.txt

2012-12-24 10:02 - 2012-12-24 09:25 - 00057616 ____A C:\Windows\System32\Drivers\psmounterex.sys

2012-12-24 10:02 - 2012-12-24 09:25 - 00014096 ____A (Paramount Software UK Ltd) C:\Windows\System32\Drivers\PSVolAcc.sys

2012-12-22 13:27 - 2012-12-22 13:27 - 00263186 ____A C:\Users\Brett\Desktop\Minecraft .exe

2012-12-22 12:58 - 2012-12-22 12:58 - 03787704 ____A (Piriform Ltd) C:\Users\Brett\Downloads\dfsetup212.exe

2012-12-21 00:00 - 2012-12-16 09:11 - 00046080 ____A (Adobe Systems) C:\Windows\System32\atmlib.dll

2012-12-21 00:00 - 2012-12-16 06:45 - 00367616 ____A (Adobe Systems Incorporated) C:\Windows\System32\atmfd.dll

2012-12-21 00:00 - 2012-12-16 06:13 - 00295424 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll

2012-12-21 00:00 - 2012-12-16 06:13 - 00034304 ____A (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll

2012-12-20 18:32 - 2012-12-20 18:35 - 11199532 ____A C:\Users\Brett\Downloads\E4442_Rampage_II_GENE_manual.zip

==================== One Month Modified Files and Folders =======

2013-01-19 17:06 - 2013-01-19 17:06 - 00032152 ____A C:\Windows\System32\Drivers\hitmanpro37.sys

2013-01-19 17:06 - 2013-01-05 22:00 - 00000392 ____A C:\Windows\setupact.log

2013-01-19 17:06 - 2009-12-25 13:11 - 00000000 ____D C:\Users\All Users\NVIDIA

2013-01-19 17:06 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2013-01-19 15:24 - 2009-07-13 20:45 - 00015328 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-01-19 15:24 - 2009-07-13 20:45 - 00015328 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-01-19 15:23 - 2012-08-04 15:00 - 00000000 ___RD C:\Users\Brett\SkyDrive

2013-01-19 15:22 - 2010-07-20 17:34 - 00000000 ___RD C:\Users\Brett\Documents\My Dropbox

2013-01-19 15:22 - 2010-07-20 17:33 - 00000000 ____D C:\Users\Brett\AppData\Roaming\Dropbox

2013-01-19 15:22 - 2009-12-25 13:57 - 00000000 ____D C:\Program Files (x86)\Steam

2013-01-19 15:21 - 2013-01-19 07:15 - 00114176 ____A (Bipiho) C:\Users\Brett\AppData\Local\phxzbypky.exe

2013-01-19 15:21 - 2009-12-30 13:57 - 00000000 ____D C:\Users\Brett\AppData\Roaming\WTablet

2013-01-19 15:19 - 2009-12-26 04:17 - 01457470 ____A C:\Windows\WindowsUpdate.log

2013-01-19 15:18 - 2013-01-19 15:09 - 00000000 ____D C:\Users\All Users\HitmanPro

2013-01-19 15:17 - 2013-01-19 15:17 - 00000400 ____A C:\Windows\System32\.crusader

2013-01-19 15:15 - 2009-07-13 21:13 - 00779266 ____A C:\Windows\System32\PerfStringBackup.INI

2013-01-19 15:14 - 2011-09-24 07:01 - 00000000 ____D C:\Users\Brett\AppData\Local\Audiogalaxy

2013-01-19 15:10 - 2013-01-19 15:10 - 00001897 ____A C:\Users\Public\Desktop\HitmanPro.lnk

2013-01-19 15:10 - 2013-01-19 15:10 - 00000000 ____D C:\Program Files\HitmanPro

2013-01-19 15:10 - 2012-04-11 23:20 - 00000000 ____D C:\users\Away

2013-01-19 15:08 - 2013-01-19 07:15 - 00114176 ____A (Bipiho) C:\Users\All Users\phxzbypky.exe

2013-01-19 14:42 - 2010-12-12 07:52 - 00000908 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4033335850-2353387393-3453094550-1001UA.job

2013-01-19 13:54 - 2013-01-19 13:54 - 00000354 ____A C:\Users\Brett\Downloads\Result.txt

2013-01-19 13:53 - 2013-01-19 13:53 - 00752287 ____A (Farbar) C:\Users\Brett\Downloads\MiniToolBox.exe

2013-01-19 13:37 - 2010-09-26 14:00 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-01-19 12:52 - 2013-01-19 12:52 - 01007918 ____A C:\Users\Brett\Downloads\Picturescue.app.zip

2013-01-19 12:27 - 2012-09-04 11:19 - 00001073 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-01-19 07:31 - 2013-01-19 07:31 - 00002258 ____A C:\Users\Brett\Desktop\SpyHunter.lnk

2013-01-19 07:31 - 2013-01-19 07:31 - 00000000 ____D C:\Windows\83B952C7F8F34CA3B4C533C85B24E478.TMP

2013-01-19 07:31 - 2013-01-19 07:31 - 00000000 ____D C:\sh4ldr

2013-01-19 07:31 - 2013-01-19 07:31 - 00000000 ____D C:\Program Files\Enigma Software Group

2013-01-19 07:30 - 2013-01-19 07:30 - 00726464 ____A (Enigma Software Group USA, LLC.) C:\Users\Brett\Downloads\SpyHunter-Installer.exe

2013-01-19 07:24 - 2013-01-19 07:24 - 00388608 ____A (Trend Micro Inc.) C:\Users\Brett\Downloads\HijackThis.exe

2013-01-19 07:24 - 2013-01-19 07:24 - 00018676 ____A C:\Users\Brett\Downloads\hijackthis.log

2013-01-19 07:19 - 2012-01-02 10:25 - 00275456 __ASH C:\Users\Brett\Desktop\Thumbs.db

2013-01-19 07:12 - 2013-01-19 07:12 - 00000000 ____D C:\Users\Brett\AppData\Local\{F7E734CA-88A9-47C1-BE62-2CAA7DDD1AB6}

2013-01-19 07:10 - 2010-12-12 12:08 - 00000000 ____D C:\Users\Brett\AppData\Roaming\Delicious IE Extension

2013-01-19 06:33 - 2010-02-14 09:11 - 00000000 ____D C:\Users\Brett\AppData\Roaming\.purple

2013-01-19 06:28 - 2013-01-01 07:19 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-01-19 03:36 - 2011-12-05 16:32 - 00000402 ____A C:\Windows\Tasks\Incremental.job

2013-01-18 20:33 - 2012-10-28 14:14 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-01-18 11:42 - 2010-12-12 07:52 - 00000856 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4033335850-2353387393-3453094550-1001Core.job

2013-01-14 03:37 - 2012-01-12 12:17 - 00000410 ____A C:\Windows\Tasks\Full.job

2013-01-10 01:16 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache

2013-01-10 00:27 - 2009-07-13 20:45 - 00473736 ____A C:\Windows\System32\FNTCACHE.DAT

2013-01-10 00:26 - 2013-01-10 00:26 - 00001450 ____A C:\Windows\PFRO.log

2013-01-10 00:09 - 2010-09-02 17:20 - 00772990 ____A C:\Windows\SysWOW64\PerfStringBackup.INI

2013-01-10 00:04 - 2009-12-25 12:35 - 67599240 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe

2013-01-09 18:21 - 2010-05-17 16:54 - 00000000 ____D C:\Users\Brett\.VirtualBox

2013-01-09 16:50 - 2011-04-09 21:00 - 00000000 ____D C:\Users\Brett\VirtualBox VMs

2013-01-09 16:49 - 2012-09-09 09:45 - 00001076 ____A C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk

2013-01-09 16:48 - 2013-01-09 16:48 - 97461672 ____A (Oracle Corporation) C:\Users\Brett\Downloads\VirtualBox-4.2.6-82870-Win.exe

2013-01-09 16:48 - 2010-07-05 16:05 - 00000000 ____D C:\Users\Brett\AppData\Roaming\uTorrent

2013-01-09 16:46 - 2013-01-09 16:42 - 857088000 ____A C:\Users\Brett\Downloads\ubuntu-gnome-12.10.1-desktop-amd64.iso

2013-01-09 16:41 - 2013-01-09 16:41 - 00033091 ____A C:\Users\Brett\Downloads\ubuntu-gnome-12.10.1-desktop-amd64.iso.torrent

2013-01-08 14:28 - 2013-01-01 07:19 - 00697864 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-01-08 14:28 - 2013-01-01 07:19 - 00074248 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-01-08 08:55 - 2013-01-08 08:54 - 00000000 ____D C:\Users\Brett\AppData\Local\{ABC68136-EEFF-4561-BAFB-D956994E4F21}

2013-01-07 20:54 - 2013-01-07 20:54 - 00000000 ____D C:\Users\Brett\AppData\Local\{6D8613B5-BE7B-43C9-A0F8-B8E4AFDC3D45}

2013-01-07 08:54 - 2013-01-07 08:54 - 00000000 ____D C:\Users\Brett\AppData\Local\{A0084E36-154F-474F-B560-AAC522197EE5}

2013-01-06 20:54 - 2013-01-06 20:54 - 00000000 ____D C:\Users\Brett\AppData\Local\{D3EC48BD-A503-4110-B6C0-E7C2BE2E33F4}

2013-01-06 08:54 - 2013-01-06 08:54 - 00000000 ____D C:\Users\Brett\AppData\Local\{7C4DAF84-6660-4B91-86CE-A724B14922D9}

2013-01-05 22:00 - 2013-01-05 22:00 - 00000000 ____A C:\Windows\setuperr.log

2013-01-05 20:54 - 2013-01-05 20:53 - 00000000 ____D C:\Users\Brett\AppData\Local\{5114E3FE-6887-4B81-8A0E-045D53EF153D}

2013-01-05 10:39 - 2013-01-05 10:22 - 00000000 ____D C:\Users\Brett\Desktop\taxes

2013-01-05 08:53 - 2013-01-05 08:53 - 00000000 ____D C:\Users\Brett\AppData\Local\{820424A2-C58B-42B1-9B7C-C53B797FEDA5}

2013-01-04 20:53 - 2013-01-04 20:53 - 00000000 ____D C:\Users\Brett\AppData\Local\{2F89A5FF-0D13-4857-B3AB-B4B9E7220F88}

2013-01-04 08:52 - 2013-01-04 08:52 - 00000000 ____D C:\Users\Brett\AppData\Local\{F9176825-6C30-42C8-948B-338F28F57181}

2013-01-02 11:39 - 2013-01-02 11:38 - 04178040 ____A (Piriform Ltd) C:\Users\Brett\Downloads\ccsetup326.exe

2013-01-02 11:39 - 2012-06-21 14:54 - 00000981 ____A C:\Users\Public\Desktop\CCleaner.lnk

2013-01-02 11:39 - 2010-08-22 12:07 - 00000000 ____D C:\Program Files (x86)\CCleaner

2013-01-02 09:31 - 2013-01-02 09:31 - 00000000 ____D C:\Users\Brett\AppData\Local\{0CC8CB50-D090-4427-982A-586316144F24}

2013-01-01 21:31 - 2013-01-01 21:31 - 00000000 ____D C:\Users\Brett\AppData\Local\{9AB1C9A6-ACF9-4EA9-B88E-766EBBC63389}

2013-01-01 09:31 - 2013-01-01 09:31 - 00000000 ____D C:\Users\Brett\AppData\Local\{1A418A78-BACF-47DC-9DBD-EC436F065B1A}

2012-12-31 21:31 - 2012-12-31 21:30 - 00000000 ____D C:\Users\Brett\AppData\Local\{5515CD1B-D9D6-4EC6-AF2B-1B3EA23EA27E}

2012-12-31 14:21 - 2010-10-21 15:49 - 00000000 ____D C:\Users\Brett\AppData\Local\Windows Live

2012-12-31 12:47 - 2012-03-12 15:17 - 00000000 ____D C:\Users\All Users\PMS

2012-12-31 12:40 - 2012-04-03 15:20 - 00000000 ____D C:\Program Files (x86)\PS3 Media Server

2012-12-31 12:36 - 2012-12-31 12:36 - 33934236 ____A C:\Users\Brett\Downloads\pms-setup-windows-1.72.0.exe

2012-12-31 09:30 - 2012-12-31 09:30 - 00000000 ____D C:\Users\Brett\AppData\Local\{BD1E2AA5-E640-49A6-98F1-AE748215E094}

2012-12-30 21:30 - 2012-12-30 21:30 - 00000000 ____D C:\Users\Brett\AppData\Local\{22330CE7-E60D-4E10-8B4D-F00E0455A617}

2012-12-30 16:59 - 2012-12-30 16:58 - 00004630 ____A C:\Windows\SysWOW64\jupdate-1.7.0_10-b18.log

2012-12-30 16:59 - 2010-01-06 19:22 - 00000000 ____D C:\Program Files (x86)\Java

2012-12-30 09:30 - 2012-12-30 09:30 - 00000000 ____D C:\Users\Brett\AppData\Local\{D73514ED-E845-4090-A082-665B47542E95}

2012-12-30 01:01 - 2010-01-04 17:57 - 00000000 ____D C:\Users\All Users\Adobe

2012-12-29 14:56 - 2012-12-29 14:56 - 00000000 ____D C:\Users\Brett\AppData\Local\{CC2F2519-E6FF-4164-8768-830F5DD011D8}

2012-12-28 12:08 - 2012-12-28 12:08 - 01222200 ____A (Orthogonal Labs, Inc.) C:\Users\Brett\Downloads\WanderPlayerSetup (2).exe

2012-12-27 12:30 - 2012-12-27 12:30 - 00000000 ____D C:\Users\Brett\AppData\Local\MetaGeek,_LLC

2012-12-27 12:17 - 2012-12-27 12:17 - 00000000 ____D C:\Windows\Options

2012-12-27 12:17 - 2012-12-27 12:17 - 00000000 ____D C:\Users\All Users\TP-LINK

2012-12-27 12:17 - 2009-12-25 12:44 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2012-12-27 11:48 - 2012-12-27 11:48 - 00000051 ____A C:\Users\Brett\Desktop\speedtest.txt

2012-12-24 09:25 - 2012-12-24 10:02 - 00057616 ____A C:\Windows\System32\Drivers\psmounterex.sys

2012-12-24 09:25 - 2012-12-24 10:02 - 00014096 ____A (Paramount Software UK Ltd) C:\Windows\System32\Drivers\PSVolAcc.sys

2012-12-22 13:30 - 2010-12-22 13:21 - 00000000 ____D C:\Users\Brett\AppData\Roaming\.minecraft

2012-12-22 13:27 - 2012-12-22 13:27 - 00263186 ____A C:\Users\Brett\Desktop\Minecraft .exe

2012-12-22 12:58 - 2012-12-22 12:58 - 03787704 ____A (Piriform Ltd) C:\Users\Brett\Downloads\dfsetup212.exe

2012-12-22 12:58 - 2012-02-09 16:32 - 00001724 ____A C:\Users\Public\Desktop\Defraggler.lnk

2012-12-22 12:58 - 2011-11-02 06:40 - 00000000 ____D C:\Program Files\Defraggler

2012-12-20 18:35 - 2012-12-20 18:32 - 11199532 ____A C:\Users\Brett\Downloads\E4442_Rampage_II_GENE_manual.zip

ZeroAccess:

C:\$Recycle.Bin\S-1-5-21-4033335850-2353387393-3453094550-1001\$88ef512717a127116bec53586b1d2e8a

ZeroAccess:

C:\$Recycle.Bin\S-1-5-18\$88ef512717a127116bec53586b1d2e8a

==================== Known DLLs (Whitelisted) =================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2013-01-10 21:00:15

Restore point made on: 2013-01-11 00:12:51

Restore point made on: 2013-01-12 00:12:52

Restore point made on: 2013-01-13 00:38:40

Restore point made on: 2013-01-14 00:12:52

Restore point made on: 2013-01-17 00:39:02

Restore point made on: 2013-01-18 00:12:52

Restore point made on: 2013-01-19 00:12:53

==================== Memory info ===========================

Percentage of memory in use: 10%

Total physical RAM: 8183.08 MB

Available physical RAM: 7330.32 MB

Total Pagefile: 8181.23 MB

Available Pagefile: 7317.05 MB

Total Virtual: 8192 MB

Available Virtual: 8191.9 MB

==================== Partitions =============================

1 Drive c: () (Fixed) (Total:931.42 GB) (Free:483.23 GB) NTFS

2 Drive e: (CDlinux) (CDROM) (Total:0.11 GB) (Free:0 GB) CDFS

3 Drive f: (Dead Vault) (Fixed) (Total:931.51 GB) (Free:428.1 GB) NTFS

4 Drive g: (My Book) (Fixed) (Total:298.09 GB) (Free:281.35 GB) NTFS

5 Drive h: (HITMANPRO) (Removable) (Total:0.05 GB) (Free:0.03 GB) FAT32

7 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

8 Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)]

Disk ### Status Size Free Dyn Gpt

-------- ------------- ------- ------- --- ---

Disk 0 Online 931 GB 1024 KB

Disk 1 Online 931 GB 0 B

Disk 2 Online 298 GB 1024 KB

Disk 3 Online 62 MB 0 B

Disk 4 No Media 0 B 0 B

Partitions of Disk 0:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 100 MB 1024 KB

Partition 2 Primary 931 GB 101 MB

==================================================================================

Disk: 0

Partition 1

Type : 07

Hidden: No

Active: Yes

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 1 Y System Rese NTFS Partition 100 MB Healthy

=========================================================

Disk: 0

Partition 2

Type : 07

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 2 C NTFS Partition 931 GB Healthy

=========================================================

Partitions of Disk 1:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 931 GB 1024 KB

==================================================================================

Disk: 1

Partition 1

Type : 07

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 3 F Dead Vault NTFS Partition 931 GB Healthy

=========================================================

Partitions of Disk 2:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 298 GB 31 KB

==================================================================================

Disk: 2

Partition 1

Type : 07

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 4 G My Book NTFS Partition 298 GB Healthy

=========================================================

Partitions of Disk 3:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 54 MB 31 KB

==================================================================================

Disk: 3

Partition 1

Type : 0B

Hidden: No

Active: Yes

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 5 H HITMANPRO FAT32 Removable 54 MB Healthy

=========================================================

Last Boot: 2013-01-13 21:24

==================== End Of Log =============================

mayday757 · January 20, 2013

Here is the search.txt

-------------------------------

Farbar Recovery Scan Tool (x64) Version: 15-01-2013

Ran by SYSTEM at 2013-01-19 20:14:20

Running from H:\

================== Search: "services.exe" ===================

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\System32\services.exe

[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

====== End Of Search ======

gringo_pr · January 20, 2013

Hello

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flash drive as fixlist.txt


HKU\Brett\...\Run: [ieodjrzotp] C:\Users\Brett\AppData\Roaming\phxzbypky [x]
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess
C:\Users\Brett\AppData\Local\phxzbypky.exe
C:\Users\All Users\phxzbypky.exe
C:\$Recycle.Bin\S-1-5-21-4033335850-2353387393-3453094550-1001\$88ef512717a127116bec53586b1d2e8a
C:\$Recycle.Bin\S-1-5-18\$88ef512717a127116bec53586b1d2e8a

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.

Run FRST again like we did before but this time press the Fix button just once and wait.

The tool will make a log on the flash drive (Fixlog.txt) please post it to your reply.

Also boot the computer into normal mode and let me know how things are looking.

Gringo

mayday757 · January 20, 2013

Windows booted up normally. I don't notice any immediate issues. Looking better. Here is the fixlog.txt

-----------------

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-01-2013

Ran by SYSTEM at 2013-01-19 20:52:49 Run:1

Running from H:\

==============================================

HKEY_USERS\Brett\Software\Microsoft\Windows\CurrentVersion\Run\\ieodjrzotp Value deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default value was restored successfully .

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}] should be deleted in normal mode (if present).

C:\Users\Brett\AppData\Local\phxzbypky.exe moved successfully.

C:\Users\All Users\phxzbypky.exe moved successfully.

C:\$Recycle.Bin\S-1-5-21-4033335850-2353387393-3453094550-1001\$88ef512717a127116bec53586b1d2e8a moved successfully.

C:\$Recycle.Bin\S-1-5-18\$88ef512717a127116bec53586b1d2e8a moved successfully.

==== End of Fixlog ====

gringo_pr · January 20, 2013

Hello

These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.

-AdwCleaner-

Please download

AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

--RogueKiller--

Download & SAVE to your Desktop RogueKiller or from here
- Quit all programs that you may have started.
- Please disconnect any USB or external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished ...
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- click on "delete"
- Wait until the Status box shows "Deleting Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- The log should be found in RKreport[1].txt on your Desktop
- Exit/Close RogueKiller+

Gringo

mayday757 · January 20, 2013

Thanks. Things are still looking good.

Here are the two logs:

# AdwCleaner v2.106 - Logfile created 01/19/2013 at 21:56:13

# Updated 17/01/2013 by Xplode

# Operating system : Windows 7 Ultimate Service Pack 1 (64 bits)

# User : Brett - WINTERLAND

# Boot Mode : Normal

# Running from : C:\Users\Brett\Downloads\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

Folder Deleted : C:\Users\Brett\AppData\Roaming\Mozilla\Firefox\Profiles\cpkp0fo1.default\extensions\staged

***** [Registry] *****

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKLM\Software\Freeze.com

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16457

[OK] Registry is clean.

-\\ Mozilla Firefox v16.0.2 (en-US)

File : C:\Users\Brett\AppData\Roaming\Mozilla\Firefox\Profiles\cpkp0fo1.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v24.0.1312.52

File : C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

-\\ Chromium v check_default_browser: true

File : C:\Users\Brett\AppData\Local\Chromium\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[s1].txt - [1148 octets] - [19/01/2013 21:56:13]

########## EOF - C:\AdwCleaner[s1].txt - [1208 octets] ##########

RogueKiller V8.4.3 [Jan 10 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Brett [Admin rights]

Mode : Remove -- Date : 01/19/2013 22:06:16

¤¤¤ Bad processes : 2 ¤¤¤

[sUSP PATH] Audiogalaxy.exe -- C:\Users\Brett\AppData\Local\Audiogalaxy\Audiogalaxy.exe -> KILLED [TermProc]

[sUSP PATH] WanderPlayer.exe -- C:\Users\Brett\AppData\Local\Orthogonal Labs\WanderPlayer Desktop\Application\wanderplayer.exe -> KILLED [TermProc]

¤¤¤ Registry Entries : 12 ¤¤¤

[RUN][sUSP PATH] HKCU\[...]\Run : Audiogalaxy ("C:\Users\Brett\AppData\Local\Audiogalaxy\Audiogalaxy.exe" /startup) -> DELETED

[RUN][sUSP PATH] HKCU\[...]\Run : WanderPlayer ("C:\Users\Brett\AppData\Local\Orthogonal Labs\WanderPlayer Desktop\Application\WanderPlayerLauncher.exe") -> DELETED

[RUN][bLACKLISTDLL] HKLM\[...]\Run : RunDLLEntry (C:\Windows\system32\RunDLL32.exe C:\Windows\system32\AmbRunE.dll,RunDLLEntry) -> DELETED

[DNS] HKLM\[...]\ControlSet001\Services\Tcpip\Interfaces\{CD37F8D9-6986-4A52-B5CE-EA00FB043FB9} : NameServer (8.8.8.8,8.8.8.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1) -> NOT REMOVED, USE DNSFIX

[DNS] HKLM\[...]\ControlSet002\Services\Tcpip\Interfaces\{CD37F8D9-6986-4A52-B5CE-EA00FB043FB9} : NameServer (8.8.8.8,8.8.8.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1) -> NOT REMOVED, USE DNSFIX

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyPics (0) -> REPLACED (1)

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyMusic (0) -> REPLACED (1)

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowHelp (0) -> REPLACED (1)

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowSetProgramAccessAndDefaults (0) -> REPLACED (1)

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

[HJ] HKCU\[...]\Command Processor : AutoRun ("C:\Users\Brett\AppData\Local\phxzbypky.exe") -> DELETED

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

192.168.1.126 santiago

192.168.1.177 winterland

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: Volume0 +++++

--- User ---

[MBR] ff33aacab0211cf3e6499d07c3e5a9c1

[bSP] a729013c9d969d58d11bdab7e8aa4c80 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 953772 Mo

User = LL1 ... OK!

Error reading LL2 MBR!

Finished : << RKreport[2]_D_01192013_02d2206.txt >>

RKreport[1]_S_01192013_02d2205.txt ; RKreport[2]_D_01192013_02d2206.txt

gringo_pr · January 20, 2013

Hello

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

mayday757 · January 20, 2013

Good morning, the Combofix has completed. Windows still appears to be running properly. Here is the log from Combofix:

ComboFix 13-01-17.04 - Brett 01/19/2013 23:50:29.2.8 - x64

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.8183.6311 [GMT -5:00]

Running from: c:\users\Brett\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}

SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Install.exe

c:\users\Brett\AppData\Roaming\3F1FC5

c:\windows\SysWow64\tmpBA1A.tmp

c:\windows\SysWow64\tmpBA79.tmp

.

((((((((((((((((((((((((( Files Created from 2012-12-20 to 2013-01-20 )))))))))))))))))))))))))))))))

.

2013-01-20 04:58 . 2013-01-20 04:58 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2013-01-20 04:58 . 2013-01-20 04:58 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-01-20 04:11 . 2013-01-20 04:11 -------- d-----w- C:\FRST

2013-01-20 01:06 . 2013-01-20 03:01 32152 ----a-w- c:\windows\system32\drivers\hitmanpro37.sys

2013-01-19 23:10 . 2013-01-20 03:02 -------- d-----w- c:\program files\HitmanPro

2013-01-19 23:09 . 2013-01-19 23:18 -------- d-----w- c:\programdata\HitmanPro

2013-01-19 20:27 . 2013-01-19 20:27 -------- d-----w- c:\users\Brett\AppData\Local\Programs

2013-01-19 15:31 . 2013-01-19 15:31 -------- d-----w- c:\program files\Enigma Software Group

2013-01-19 15:31 . 2013-01-20 03:03 -------- d-----w- c:\windows\83B952C7F8F34CA3B4C533C85B24E478.TMP

2013-01-19 08:39 . 2013-01-08 05:32 9161176 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2E6A34D8-741B-4F95-9D43-773A0DBF9D72}\mpengine.dll

2013-01-18 08:38 . 2013-01-08 05:32 9161176 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2013-01-10 00:49 . 2012-12-19 19:48 237992 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys

2013-01-10 00:49 . 2012-12-19 19:47 120232 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys

2013-01-01 15:19 . 2013-01-08 22:28 74248 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-01-01 15:19 . 2013-01-08 22:28 697864 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-12-31 00:59 . 2012-11-28 15:35 95184 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2012-12-27 20:30 . 2012-12-27 20:30 -------- d-----w- c:\users\Brett\AppData\Local\MetaGeek,_LLC

2012-12-27 20:17 . 2012-12-27 20:17 -------- d-----w- c:\windows\Options

2012-12-27 20:17 . 2011-08-31 18:55 2736640 ----a-w- c:\windows\system32\drivers\athrx.sys

2012-12-27 20:17 . 2011-08-31 18:55 2736640 ----a-w- c:\windows\system32\athrx.sys

2012-12-27 20:17 . 2012-12-27 20:17 -------- d-----w- c:\programdata\TP-LINK

2012-12-24 18:02 . 2012-12-24 17:25 14096 ----a-w- c:\windows\system32\drivers\PSVolAcc.sys

2012-12-24 18:02 . 2012-12-24 17:25 57616 ----a-w- c:\windows\system32\drivers\psmounterex.sys

2012-12-21 08:00 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll

2012-12-21 08:00 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll

2012-12-21 08:00 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll

2012-12-21 08:00 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-01-10 08:04 . 2009-12-25 20:35 67599240 ----a-w- c:\windows\system32\MRT.exe

2012-12-19 19:47 . 2012-12-19 19:47 204200 ----a-w- c:\windows\system32\VBoxNetFltNobj.dll

2012-12-19 19:47 . 2012-12-19 19:47 146856 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys

2012-12-19 19:47 . 2012-12-19 19:47 132008 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys

2012-12-14 21:49 . 2010-09-26 22:00 24176 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-11-30 04:45 . 2013-01-09 11:48 44032 ----a-w- c:\windows\apppatch\acwow64.dll

2012-11-29 08:29 . 2012-11-29 08:29 972264 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A0F6F289-7DDA-4B47-A95D-73CF87BBA56D}\gapaengine.dll

2012-11-14 07:06 . 2012-12-18 08:00 17811968 ----a-w- c:\windows\system32\mshtml.dll

2012-11-14 06:32 . 2012-12-18 08:00 10925568 ----a-w- c:\windows\system32\ieframe.dll

2012-11-14 06:11 . 2012-12-18 08:00 2312704 ----a-w- c:\windows\system32\jscript9.dll

2012-11-14 06:04 . 2012-12-18 08:00 1346048 ----a-w- c:\windows\system32\urlmon.dll

2012-11-14 06:04 . 2012-12-18 08:00 1392128 ----a-w- c:\windows\system32\wininet.dll

2012-11-14 06:02 . 2012-12-18 08:00 1494528 ----a-w- c:\windows\system32\inetcpl.cpl

2012-11-14 06:02 . 2012-12-18 08:00 237056 ----a-w- c:\windows\system32\url.dll

2012-11-14 05:59 . 2012-12-18 08:00 85504 ----a-w- c:\windows\system32\jsproxy.dll

2012-11-14 05:58 . 2012-12-18 08:00 816640 ----a-w- c:\windows\system32\jscript.dll

2012-11-14 05:57 . 2012-12-18 08:00 599040 ----a-w- c:\windows\system32\vbscript.dll

2012-11-14 05:57 . 2012-12-18 08:00 173056 ----a-w- c:\windows\system32\ieUnatt.exe

2012-11-14 05:55 . 2012-12-18 08:00 2144768 ----a-w- c:\windows\system32\iertutil.dll

2012-11-14 05:55 . 2012-12-18 08:00 729088 ----a-w- c:\windows\system32\msfeeds.dll

2012-11-14 05:53 . 2012-12-18 08:00 96768 ----a-w- c:\windows\system32\mshtmled.dll

2012-11-14 05:52 . 2012-12-18 08:00 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2012-11-14 05:46 . 2012-12-18 08:00 248320 ----a-w- c:\windows\system32\ieui.dll

2012-11-14 02:09 . 2012-12-18 08:00 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll

2012-11-14 01:58 . 2012-12-18 08:00 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2012-11-14 01:57 . 2012-12-18 08:00 1129472 ----a-w- c:\windows\SysWow64\wininet.dll

2012-11-14 01:49 . 2012-12-18 08:00 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2012-11-14 01:48 . 2012-12-18 08:00 420864 ----a-w- c:\windows\SysWow64\vbscript.dll

2012-11-14 01:44 . 2012-12-18 08:00 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

2012-11-09 05:45 . 2012-12-17 16:15 2048 ----a-w- c:\windows\system32\tzres.dll

2012-11-09 04:42 . 2012-12-17 16:15 2048 ----a-w- c:\windows\SysWow64\tzres.dll

2012-11-02 05:59 . 2012-12-17 16:13 478208 ----a-w- c:\windows\system32\dpnet.dll

2012-11-02 05:11 . 2012-12-17 16:13 376832 ----a-w- c:\windows\SysWow64\dpnet.dll

2012-10-25 08:12 . 2012-10-25 08:12 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx

2012-10-25 08:12 . 2012-10-25 08:12 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]

@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"

[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

2012-11-16 03:22 222712 ----a-w- c:\users\Brett\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]

@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"

[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

2012-11-16 03:22 222712 ----a-w- c:\users\Brett\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]

@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"

[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

2012-11-16 03:22 222712 ----a-w- c:\users\Brett\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]

@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"

[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]

2012-09-21 07:06 2042528 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\GROOVEEX.DLL

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]

@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"

[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]

2012-09-21 07:06 2042528 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\GROOVEEX.DLL

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]

@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"

[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]

2012-09-21 07:06 2042528 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\GROOVEEX.DLL

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\users\Brett\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\users\Brett\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\users\Brett\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-12-07 2387968]

"Steam"="c:\program files (x86)\Steam\steam.exe" [2012-12-08 1354736]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2012-11-28 59280]

"igndlm.exe"="c:\program files (x86)\Download Manager\DLM.exe" [2009-10-27 1103216]

"SkyDrive"="c:\users\Brett\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe" [2012-11-16 255992]

"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2012-11-28 59280]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"SoundMAXPnP"="c:\program files (x86)\Analog Devices\Core\smax4pnp.exe" [2009-09-17 1310720]

"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2009-07-13 36864]

"VolPanel"="c:\program files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe" [2009-07-07 241789]

"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]

"TweakIt Help"="c:\program files\ASUS\TweakIt\TweakIt.exe" [2009-03-13 817152]

"UpdatePSTShortCut"="c:\program files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe" [2009-02-03 210216]

"BDRegion"="c:\program files (x86)\Cyberlink\Shared Files\brs.exe" [2008-12-03 75048]

"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]

"RemoteControl8"="c:\program files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-07-17 91432]

"PDVD8LanguageShortcut"="c:\program files (x86)\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-16 50472]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-07-31 38872]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008]

"Cisco AnyConnect Secure Mobility Agent for Windows"="c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" [2012-06-07 522744]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-12-12 152544]

.

c:\users\Brett\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

AutoHotkey.lnk - c:\program files\AutoHotkey\AutoHotkey.exe [2011-4-1 1326592]

Dropbox.lnk - c:\users\Brett\AppData\Roaming\Dropbox\bin\Dropbox.exe [2013-1-4 28539232]

Launch Jawbone Updater.lnk - c:\program files (x86)\Jawbone\LaunchJU.exe [2012-11-29 62128]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 WysePocketCloud;Wyse PocketCloud;c:\program files (x86)\Wyse\PocketCloud Windows Companion\PocketCloudService.exe [2012-11-05 191488]

R3 acsock;acsock;c:\windows\system32\DRIVERS\acsock64.sys [2012-06-07 107432]

R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [2009-07-10 31744]

R3 AWEAlloc;AWE Memory Allocation Driver;c:\windows\system32\DRIVERS\awealloc.sys [x]

R3 bmdrvr;Modified Clusters Tracking Driver;SysWOW64\drivers\bmdrvr.sys [x]

R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2009-12-25 79360]

R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-12-25 79360]

R3 Fwleaf;NETGEAR Firewall Driver;c:\windows\system32\DRIVERS\fwleaf.sys [x]

R3 GPU-Z;GPU-Z;c:\users\Brett\AppData\Local\Temp\GPU-Z.sys [x]

R3 hitmanpro37;HitmanPro 3.7 Support Driver;c:\windows\system32\drivers\hitmanpro37.sys [2013-01-20 32152]

R3 leafnets;Leaf Networks Adapter;c:\windows\system32\DRIVERS\leafnets.sys [2011-05-26 29696]

R3 libusb0;Jawbone LibUsb-Win32 - Kernel Driver 09/22/2011,1.2.5.0;c:\windows\system32\DRIVERS\libusb0.sys [2012-09-27 52320]

R3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys [2009-05-08 53632]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-31 128456]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-13 368896]

R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-09-12 178808]

R3 PROCEXP151;PROCEXP151;c:\windows\system32\Drivers\PROCEXP151.SYS [x]

R3 PSMounter;Macrium Reflect Image Explorer Service;c:\windows\system32\drivers\psmounter.sys [2012-08-21 57536]

R3 PSVolAcc;PSVolAcc; [x]

R3 radpms;Driver for RADPMS Device;c:\windows\system32\DRIVERS\radpms.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 20992]

R3 RTCore64;RTCore64;c:\program files (x86)\MSI Afterburner\RTCore64.sys [2012-01-06 13368]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-09-28 53760]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-17 1255736]

R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2008-05-06 14464]

R3 WPRO_41_1742;WinPcap Packet Driver (WPRO_41_1742);c:\windows\system32\drivers\WPRO_41_1742.sys [x]

S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2012-12-19 237992]

S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2012-12-19 120232]

S2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};Power Control [2011/12/17 22:02];c:\program files (x86)\CyberLink\PowerDVD8\000.fcl [2010-01-13 04:08 146928]

S2 AirPrint;AirPrint;c:\program files (x86)\AirPrint\airprint.exe [2010-12-04 234784]

S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35344]

S2 OfficeSvc;Microsoft Office Service;c:\program files\Microsoft Office 15\ClientX64\integratedoffice.exe [2012-09-11 1494144]

S2 ReflectService.exe;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe [2012-12-24 302352]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-10-02 382824]

S2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [2009-11-24 5521192]

S2 vmware-converter-agent;VMware vCenter Converter Standalone Agent;c:\program files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe [2011-08-20 423536]

S2 vmware-converter-server;VMware vCenter Converter Standalone Server;c:\program files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe [2011-08-20 423536]

S2 vmware-converter-worker;VMware vCenter Converter Standalone Worker;c:\program files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe [2011-08-20 423536]

S2 vpnagent;Cisco AnyConnect Secure Mobility Agent;c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [2012-06-07 478712]

S2 vstor2-mntapi10-shared;Vstor2 MntApi 1.0 Driver (shared);SysWOW64\drivers\vstor2-mntapi10-shared.sys [x]

S2 WyseRemoteAccess;Wyse Remote Access;c:\program files (x86)\Wyse\PocketCloud Windows Companion\WyseRemoteAccess.exe [2012-11-05 1436160]

S3 ALSysIO;ALSysIO;c:\users\Brett\AppData\Local\Temp\ALSysIO64.sys [x]

S3 EuMusDesignVirtualAudioCableWdm_jrm;MuvEnum Virtual Cable (WDM);c:\windows\system32\DRIVERS\vacjrmkd.sys [2009-11-16 56448]

S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys [2011-09-02 76056]

S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys [2011-09-02 15128]

S3 MCfilt;MCfilt;c:\windows\system32\drivers\MCfilt64.sys [2009-09-17 25600]

S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2012-12-19 132008]

S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2012-12-19 146856]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - ALSYSIO

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2008-12-07 04:18 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-01-20 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-01 22:28]

.

2013-01-14 c:\windows\Tasks\Full.job

- c:\program files\macrium\reflect\reflect.exe [2012-12-24 17:14]

.

2013-01-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4033335850-2353387393-3453094550-1001Core.job

- c:\users\Brett\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-12 15:52]

.

2013-01-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4033335850-2353387393-3453094550-1001UA.job

- c:\users\Brett\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-12 15:52]

.

2013-01-19 c:\windows\Tasks\Incremental.job

- c:\program files\macrium\reflect\reflect.exe [2012-12-24 17:14]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]

@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"

[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

2012-11-16 03:22 261624 ----a-w- c:\users\Brett\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]

@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"

[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

2012-11-16 03:22 261624 ----a-w- c:\users\Brett\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]

@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"

[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

2012-11-16 03:22 261624 ----a-w- c:\users\Brett\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]

@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"

[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]

2012-09-21 07:05 2860192 ----a-w- c:\program files\Microsoft Office 15\root\office15\grooveex.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]

@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"

[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]

2012-09-21 07:05 2860192 ----a-w- c:\program files\Microsoft Office 15\root\office15\grooveex.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]

@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"

[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]

2012-09-21 07:05 2860192 ----a-w- c:\program files\Microsoft Office 15\root\office15\grooveex.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 162552 ----a-w- c:\users\Brett\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 162552 ----a-w- c:\users\Brett\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 162552 ----a-w- c:\users\Brett\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 162552 ----a-w- c:\users\Brett\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LogiScrollApp"="c:\program files\Logitech\ScrollApp\KhalScroll.exe" [2011-09-16 50456]

"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]

"PocketCloud Location"="c:\program files (x86)\Wyse\PocketCloud Windows Companion\WyseBrowser.exe" [2012-11-05 935312]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com/

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = localhost;127.0.0.1;<local>

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Download All by ASUS Download - c:\program files (x86)\ASUS\WL-500gP Wireless Router Utilities\ASDownloadAll.htm

IE: Download using ASUS Download - c:\program files (x86)\ASUS\WL-500gP Wireless Router Utilities\ASDownload.htm

IE: E&xport to Microsoft Excel - c:\program files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html

IE: LastPass - file://c:\program files (x86)\LastPass\context.html?cmd=lastpass

IE: LastPass Fill Forms - file://c:\program files (x86)\LastPass\context.html?cmd=fillforms

IE: Se&nd to OneNote - c:\program files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105

Trusted Zone: real.com\rhap-app-4-0

Trusted Zone: real.com\rhapreg

Trusted Zone: rhapsody.com\rhap-app-4-0

Trusted Zone: rhapsody.com\rhapreg

Trusted Zone: usat.com\ocsr2

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{CD37F8D9-6986-4A52-B5CE-EA00FB043FB9}: NameServer = 8.8.8.8,8.8.8.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1

FF - ProfilePath - c:\users\Brett\AppData\Roaming\Mozilla\Firefox\Profiles\cpkp0fo1.default\

.

------- File Associations -------

.

.txt=bftxtfile

.

- - - - ORPHANS REMOVED - - - -

.

Wow6432Node-HKCU-Run-MobileDocuments - c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe

HKLM-Run-MSC - c:\program files\Microsoft Security Client\mssecex.exe

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\MySQL]

"ImagePath"="\"c:\program files\MySQL\MySQL Server 5.1\bin\mysqld\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.1\my.ini\" MySQL"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]

"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD8\000.fcl"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-4033335850-2353387393-3453094550-1001\Software\SecuROM\License information*]

"datasecu"=hex:96,4d,24,9c,be,b9,40,ff,47,1e,2d,69,74,6f,9b,33,83,d0,ae,b2,3f,

34,fc,c9,22,22,cf,fc,d5,9e,e6,4c,d9,d8,f5,27,c3,47,b6,9f,b6,2e,5e,b2,7d,60,\

"rkeysecu"=hex:67,9c,b4,b5,81,a5,d4,e5,89,04,90,66,22,21,be,8a

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Environment*]

"v5Setup"="07-HU9M-E47R-J2BU-R92R-DV38-BTNC1JN"

"Activated"="Y"

"v5Licence"="17-XZ3D-V31D-PVSV-3BHU-GBYM-Z4X6NGD"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2013-01-19 23:59:50

ComboFix-quarantined-files.txt 2013-01-20 04:59

.

Pre-Run: 519,180,038,144 bytes free

Post-Run: 518,853,873,664 bytes free

.

- - End Of File - - 403FD5230FDBC8995592AC76683F5355

mayday757 · January 20, 2013

One oddity that I just noticed is all of the predefined firewall rules for Windows Firewall are missing.

gringo_pr · January 20, 2013

Greetings

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

 ClearJavaCache::

Save it to your desktop as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.

Restart if you have to.

Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following

report from Combofix
let me know of any problems you may have had
How is the computer doing now after running the script?

Gringo

mayday757 · January 20, 2013

Hello,

I've tried running this twice now and it seems to always hang at stage_48. I made sure all applications and virus scanners were disabled. The computer seems to be running ok with the exception that the predefined firewall rules are missing.

Thanks.

gringo_pr · January 20, 2013

Hello

Ok lets try this, I want you to run combofix in safe mode but it is very important that when combofix reboots the computer for you to direct it back into safe mode so it can finish the scan.

Boot into Safe Mode

Reboot your computer in Safe Mode.

If the computer is running, shut down Windows, and then turn off the power.
Wait 30 seconds, and then turn the computer on.
Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Login on your usual account.

after combofix has finished its scan please post the report back here.

Gringo

mayday757 · January 20, 2013

Hello. The script ran properly in safe mode. Please see the log below. I also just noticed that the action center icon is missing from the taskbar. It is not set to be hidden.

Thanks.

ComboFix 13-01-17.04 - Brett 01/20/2013 13:24:32.5.8 - x64 NETWORK

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.8183.7164 [GMT -5:00]

Running from: c:\users\Brett\Desktop\ComboFix.exe

Command switches used :: c:\users\Brett\Desktop\CFscript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}

SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

((((((((((((((((((((((((( Files Created from 2012-12-20 to 2013-01-20 )))))))))))))))))))))))))))))))

.

2013-01-20 18:31 . 2013-01-20 18:31 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2013-01-20 18:31 . 2013-01-20 18:31 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-01-20 18:31 . 2013-01-20 18:31 -------- d-----w- c:\users\Away\AppData\Local\temp

2013-01-20 06:45 . 2013-01-08 05:32 9161176 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1DEC9D4F-B969-47E1-801A-21A07B2BD709}\mpengine.dll

2013-01-20 04:11 . 2013-01-20 04:11 -------- d-----w- C:\FRST

2013-01-20 01:06 . 2013-01-20 03:01 32152 ----a-w- c:\windows\system32\drivers\hitmanpro37.sys

2013-01-19 23:10 . 2013-01-20 03:02 -------- d-----w- c:\program files\HitmanPro

2013-01-19 23:09 . 2013-01-19 23:18 -------- d-----w- c:\programdata\HitmanPro

2013-01-19 20:27 . 2013-01-19 20:27 -------- d-----w- c:\users\Brett\AppData\Local\Programs

2013-01-19 15:31 . 2013-01-19 15:31 -------- d-----w- c:\program files\Enigma Software Group

2013-01-19 15:31 . 2013-01-20 03:03 -------- d-----w- c:\windows\83B952C7F8F34CA3B4C533C85B24E478.TMP

2013-01-19 08:39 . 2013-01-08 05:32 9161176 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll