Uniprint - malware?

jgbeehive · December 8, 2013

Hi, Uniprint suite randomly installed on my computer, and it reinstalls every timeI uninstall it.

Malwarebytes, Adwcleaner, and Junkware remover all seem to have failed to detect it and/or permanently remove it.

I ran DDS scan, please let me know how to proceed.

Thanks!

AdvancedSetup · December 10, 2013

Hello and :welcome:

If you've not already done so please start here and post back the 2 log files DDS.txt and Attach.txt

P2P/Piracy Warning:

If you're using
Peer 2 Peer
software such as
uTorrent, BitTorrent
or similar you must either fully uninstall them or completely disable them from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have
illegal/cracked software, cracks, keygens etc
. on the system, please remove or uninstall them now and read the policy on
Piracy
.

Before we proceed further, please read all of the following instructions carefully.
If there is anything that you do not understand kindly ask before proceeding.
If needed please print out these instructions.

Please do not post logs using CODE, QUOTE, or FONT tags. Just paste them as direct text.
If the log is too large then you can use attachments by clicking on the More Reply Options button.
Please enable your system to show hidden files: How to see hidden files in Windows
Make sure you're subscribed to this topic:
- Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly
[*]Removing malware can be unpredictable...It is unlikely but things can go very wrong! Please make sure you Backup all files that cannot be replaced if something were to happen. You can copy them to a CD/DVD, external drive or a pen drive [*]Please don't run any other scans, download, install or uninstall any programs unless requested by me while I'm working with you. [*]The removal of malware is not instantaneous, please be patient. Often we are also on a different Time Zone. [*]Perform everything in the correct order. Sometimes one step requires the previous one. [*]If you have any problems while following my instructions, Stop there and tell me the exact nature of the issue. [*]You can check here if you're not sure if your computer is 32-bit or 64-bit [*]Please disable your antivirus while running any requested scanners so that they do not interfere with the scanners. [*]When we are done, I'll give you instructions on how to cleanup all the tools and logs [*]Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that. [*]Your topic will be closed if you haven't replied within 3 days [*](If I have not responded within 24 hours, please send me a Private Message as a reminder)

STEP 0
RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes
so that your normal security software can then run and clean your computer of infections.
When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies
that stop us from using certain tools. When finished it will display a log file that shows the processes that were
terminated while the program was running.

As RKill only terminates a program's running process, and does not delete any files, after running it you should not reboot
your computer as any malware processes that are configured to start automatically will just be started again.
Instead, after running RKill you should immediately scan your computer using the requested scans I've included.

Please download Rkill by Grinler from one of the links below and save it to your desktop.

Link 1

Link 2

On Windows XP double-click on the Rkill desktop icon to run the tool.
On Windows Vista/Windows 7 or 8, right-click on the Rkill desktop icon and select Run As Administrator
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
If the tool does not run from any of the links provided, please let me know.
Do not reboot the computer, you will need to run the application again.

STEP 01
Backup the Registry:
Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.

Please download ERUNT from one of the following links: Link1 | Link2 | Link3
ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.
Double click on erunt-setup.exe to Install ERUNT by following the prompts.
NOTE: Do not choose to allow ERUNT to add an Entry to the Startup folder. Click NO.
Start ERUNT either by double clicking on the desktop icon or choosing to start the program at the end of the setup process.
Choose a location for the backup.
- Note: the default location is C:\Windows\ERDNT which is acceptable.
[*]Make sure that at least the first two check boxes are selected. [*]Click on OK [*]Then click on YES to create the folder. [*]Note: if it is necessary to restore the registry, open the backup folder and start ERDNT.exe

STEP 02
Please download RogueKiller and save it to your desktop.

You can check here if you're not sure if your computer is 32-bit or 64-bit

RogueKiller 32-bit | RogueKiller 64-bit
Quit all running programs.
For Windows XP, double-click to start.
For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
Read and accept the EULA (End User Licene Agreement)
Click Scan to scan the system.
When the scan completes Close the program > Don't Fix anything!
Don't run any other options, they're not all bad!!
Post back the report which should be located on your desktop.

Maurice Naggar · December 22, 2013

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

AdvancedSetup · December 22, 2013

Topic reopened per user request

AdvancedSetup · December 28, 2013

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

AdvancedSetup · January 13, 2014

Due to extenuating circumstances this topic is once again reopened.

AdvancedSetup · January 13, 2014

Please visit this webpage and read the ComboFix User's Guide:

Once you've read the article and are ready to use the program you can download it directly from the link below.
Important! - Please make sure you save combofix to your desktop and do not run it from your browser
Direct download link for: ComboFix.exe
Please make sure you disable your security applications before running ComboFix.
Once Combofix has completed it will produce and open a log file. Please be patient as it can take some time to load.
Please copy/paste the contents or attach that log file to your next reply.
If needed the file can be located here: C:\combofix.txt
NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.

jgbeehive · January 13, 2014

Thanks!

ComboFix 14-01-13.01 - BRothermel 01/13/2014 21:19:43.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3037.1657 [GMT 9:00]

Running from: c:\documents and settings\brothermel.PARK-LAW\Desktop\ComboFix.exe

AV: Symantec Endpoint Protection *Disabled/Outdated* {FB06448E-52B8-493A-90F3-E43226D3305C}

FW: Symantec Endpoint Protection *Disabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\TEMP

C:\install.exe

c:\windows\system32\drivers\etc\hosts.ics

c:\windows\system32\Thumbs.db

c:\windows\wininit.ini

.

((((((((((((((((((((((((( Files Created from 2013-12-13 to 2014-01-13 )))))))))))))))))))))))))))))))

.

2014-01-12 14:07 . 2014-01-12 14:07 -------- d-----w- c:\program files\ERUNT

2014-01-12 10:09 . 2014-01-12 10:09 37944 ----a-w- c:\windows\system32\JRSKD24.SYS

2014-01-12 10:09 . 2014-01-12 10:09 12728 ----a-w- c:\windows\system32\JRSUKD25.SYS

2014-01-12 10:09 . 2014-01-12 10:09 126048 ----a-w- c:\windows\system32\kcrtx86.sys

2014-01-12 10:09 . 2014-01-12 10:09 124216 ----a-r- c:\windows\system32\CKAgent.exe

2014-01-12 10:09 . 2014-01-12 10:09 943416 ----a-w- c:\windows\system32\CKSetup32.exe

2014-01-12 10:09 . 2014-01-12 10:09 70968 ----a-w- c:\windows\system32\CKKeyProCert.dll

2014-01-12 10:09 . 2014-01-12 10:09 434428 ----a-w- c:\windows\system32\CKCSP.dll

2014-01-12 10:09 . 2014-01-12 10:09 394552 ----a-w- c:\windows\system32\XecureCK.dll

2014-01-12 10:09 . 2014-01-12 10:09 210272 ----a-w- c:\windows\system32\npKeyPro.dll

2014-01-12 10:09 . 2014-01-12 10:09 191000 ----a-w- c:\windows\system32\kcrypto.dll

2014-01-12 10:09 . 2014-01-12 10:09 181560 ----a-w- c:\windows\system32\CKApp.dll

2014-01-12 10:09 . 2014-01-12 10:09 152888 ----a-w- c:\windows\system32\jrsoftcp.dll

2014-01-10 16:44 . 2014-01-10 16:44 -------- d-----w- c:\program files\NPKI

2014-01-10 16:44 . 2014-01-10 16:44 -------- d--h--w- c:\windows\yessign

2014-01-10 16:44 . 2014-01-10 16:44 -------- d-----w- C:\XecureSSL

2014-01-10 16:44 . 2014-01-10 16:44 -------- d-----w- c:\program files\SoftForum

2014-01-04 06:31 . 2014-01-04 06:31 -------- d-----w- c:\program files\Common Files\Citrix

2014-01-04 06:31 . 2014-01-04 06:31 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Application Data\Citrix

2014-01-04 06:25 . 2014-01-04 06:25 -------- d-----w- c:\windows\system32\DRM

2014-01-04 00:31 . 2014-01-04 00:31 -------- d-----w- c:\program files\Dell

2014-01-03 07:42 . 2014-01-03 08:17 -------- d-----w- c:\windows\system32\NtmsData

2013-12-27 00:36 . 2013-12-27 00:36 -------- d-----w- C:\Transfer Folder

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-01-12 14:20 . 2014-01-12 14:20 8832 ----a-w- c:\windows\system32\drivers\wmiacpi.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 82944 ----a-w- c:\windows\system32\drivers\WudfRd.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 77568 ----a-w- c:\windows\system32\drivers\WudfPf.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 4352 ----a-w- c:\windows\system32\drivers\wmilib.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 38528 ----a-w- c:\windows\system32\drivers\wpdusb.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 19200 ----a-w- c:\windows\system32\drivers\WSTCODEC.SYS.bak

2014-01-12 14:20 . 2014-01-12 14:20 39368 ----a-w- c:\windows\system32\drivers\winusb.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 83072 ----a-w- c:\windows\system32\drivers\wdmaud.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 81664 ----a-w- c:\windows\system32\drivers\videoprt.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 52352 ----a-w- c:\windows\system32\drivers\volsnap.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 503008 ----a-w- c:\windows\system32\drivers\wdf01000.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 35040 ----a-w- c:\windows\system32\drivers\wdfldr.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 34560 ----a-w- c:\windows\system32\drivers\wanarp.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 26368 ----a-w- c:\windows\system32\drivers\USBSTOR.SYS.bak

2014-01-12 14:20 . 2014-01-12 14:20 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 20992 ----a-w- c:\windows\system32\drivers\vga.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 20608 ----a-w- c:\windows\system32\drivers\usbuhci.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 14976 ----a-w- c:\windows\system32\drivers\usbscan.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 123008 ----a-w- c:\windows\system32\drivers\usbvideo.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 59520 ----a-w- c:\windows\system32\drivers\usbhub.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 5376 ----a-w- c:\windows\system32\drivers\usbd.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 384768 ----a-w- c:\windows\system32\drivers\update.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 32384 ----a-w- c:\windows\system32\drivers\usbccgp.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 30336 ----a-w- c:\windows\system32\drivers\usbehci.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 144128 ----a-w- c:\windows\system32\drivers\usbport.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 12928 ----a-w- c:\windows\system32\drivers\usb8023.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 46144 ----a-w- c:\windows\system32\drivers\tvtumon.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 4608 ----a-w- c:\windows\system32\drivers\TSMAPIP.SYS.bak

2014-01-12 14:20 . 2014-01-12 14:20 4442 ----a-w- c:\windows\system32\drivers\TPPWRIF.SYS.bak

2014-01-12 14:20 . 2014-01-12 14:20 40840 ----a-w- c:\windows\system32\drivers\termdd.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 33536 ----a-w- c:\windows\system32\drivers\tvtfilter.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 17844 ----a-w- c:\windows\system32\drivers\TPHKDRV.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 118960 ----a-w- c:\windows\system32\drivers\teefer.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 21896 ----a-w- c:\windows\system32\drivers\tdtcp.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 92080 ----a-w- c:\windows\system32\drivers\SysPlant.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 50576 ----a-w- c:\windows\system32\drivers\tcusb.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 361600 ----a-w- c:\windows\system32\drivers\tcpip.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 26624 ----a-w- c:\windows\system32\drivers\tap0901.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 19072 ----a-w- c:\windows\system32\drivers\tdi.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 12040 ----a-w- c:\windows\system32\drivers\tdpipe.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 60800 ----a-w- c:\windows\system32\drivers\sysaudio.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 56576 ----a-w- c:\windows\system32\drivers\swmidi.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 4352 ----a-w- c:\windows\system32\drivers\swenum.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 32864 ----a-w- c:\windows\system32\drivers\staccel.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 177632 ----a-w- c:\windows\system32\drivers\SynTP.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 15232 ----a-w- c:\windows\system32\drivers\StreamIP.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 127096 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS.bak

2014-01-12 14:20 . 2014-01-12 14:20 83864 ----a-w- c:\windows\system32\drivers\ssudbus.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 73472 ----a-w- c:\windows\system32\drivers\sr.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 6272 ----a-w- c:\windows\system32\drivers\splitter.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 357888 ----a-w- c:\windows\system32\drivers\srv.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 181912 ----a-w- c:\windows\system32\drivers\ssudmdm.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 9632128 ----a-w- c:\windows\system32\drivers\snp2uvc.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 11392 ----a-w- c:\windows\system32\drivers\sfloppy.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 11136 ----a-w- c:\windows\system32\drivers\SLIP.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 80384 ----a-w- c:\windows\system32\drivers\sdbus.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 64512 ----a-w- c:\windows\system32\drivers\serial.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 20480 ----a-w- c:\windows\system32\drivers\secdrv.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 13952 ----a-w- c:\windows\system32\drivers\s24trans.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 11904 ----a-w- c:\windows\system32\drivers\sffdisk.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 11008 ----a-w- c:\windows\system32\drivers\sffp_sd.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 102656 ----a-w- c:\windows\system32\drivers\Rtenicxp.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 57600 ----a-w- c:\windows\system32\drivers\redbook.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 46592 ----a-w- c:\windows\system32\drivers\rimmptsk.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 43008 ----a-w- c:\windows\system32\drivers\rimsptsk.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 38400 ----a-w- c:\windows\system32\drivers\rixdptsk.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 203136 ----a-w- c:\windows\system32\drivers\rmcast.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 8832 ----a-w- c:\windows\system32\drivers\rasacd.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 51328 ----a-w- c:\windows\system32\drivers\rasl2tp.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 48384 ----a-w- c:\windows\system32\drivers\raspptp.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 4224 ----a-w- c:\windows\system32\drivers\rdpcdd.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 41472 ----a-w- c:\windows\system32\drivers\raspppoe.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 196224 ----a-w- c:\windows\system32\drivers\rdpdr.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 175744 ----a-w- c:\windows\system32\drivers\rdbss.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 16512 ----a-w- c:\windows\system32\drivers\raspti.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 7012 ----a-w- c:\windows\system32\drivers\pmemnt.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 69120 ----a-w- c:\windows\system32\drivers\psched.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 44944 ----a-w- c:\windows\system32\drivers\pxhelp20.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 30144 ----a-w- c:\windows\system32\drivers\psadd.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 17792 ----a-w- c:\windows\system32\drivers\ptilink.sys.bak

2014-01-12 14:20 . 2014-01-12 14:20 146048 ----a-w- c:\windows\system32\drivers\portcls.sys.bak

2014-01-12 14:19 . 2014-01-12 14:19 80128 ----a-w- c:\windows\system32\drivers\parport.sys.bak

2014-01-12 14:19 . 2014-01-12 14:19 68224 ----a-w- c:\windows\system32\drivers\pci.sys.bak

2014-01-12 14:19 . 2014-01-12 14:19 61696 ----a-w- c:\windows\system32\drivers\ohci1394.sys.bak

2014-01-12 14:19 . 2014-01-12 14:19 3456 ----a-w- c:\windows\system32\drivers\oprghdlr.sys.bak

2014-01-12 14:19 . 2014-01-12 14:19 19712 ----a-w- c:\windows\system32\drivers\partmgr.sys.bak

2014-01-12 14:19 . 2014-01-12 14:19 120192 ----a-w- c:\windows\system32\drivers\pcmcia.sys.bak

2014-01-12 14:19 . 2014-01-12 14:19 32512 ----a-w- c:\windows\system32\drivers\nwlnkfwd.sys.bak

2014-01-12 14:19 . 2014-01-12 14:19 12416 ----a-w- c:\windows\system32\drivers\nwlnkflt.sys.bak

2014-01-12 14:19 . 2014-01-12 14:19 61824 ----a-w- c:\windows\system32\drivers\nic1394.sys.bak

2014-01-12 14:19 . 2014-01-12 14:19 574976 ----a-w- c:\windows\system32\drivers\ntfs.sys.bak

2014-01-12 14:19 . 2014-01-12 14:19 30848 ----a-w- c:\windows\system32\drivers\npfs.sys.bak

2014-01-12 14:19 . 2014-01-12 14:19 2944 ----a-w- c:\windows\system32\drivers\null.sys.bak

2014-01-12 14:19 . 2014-01-12 14:19 5977216 ----a-w- c:\windows\system32\drivers\NETw5x32.sys.bak

2014-01-12 14:19 . 2014-01-12 14:19 162816 ----a-w- c:\windows\system32\drivers\netbt.sys.bak

2014-01-12 14:19 . 2014-01-12 14:19 91520 ----a-w- c:\windows\system32\drivers\ndiswan.sys.bak

2014-01-12 14:19 . 2014-01-12 14:19 85248 ----a-w- c:\windows\system32\drivers\NABTSFEC.sys.bak

2014-01-12 14:19 . 2014-01-12 14:19 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys.bak

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36 130736 ----a-w- c:\documents and settings\brothermel.PARK-LAW\Application Data\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36 130736 ----a-w- c:\documents and settings\brothermel.PARK-LAW\Application Data\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36 130736 ----a-w- c:\documents and settings\brothermel.PARK-LAW\Application Data\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36 130736 ----a-w- c:\documents and settings\brothermel.PARK-LAW\Application Data\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"KiesPreload"="c:\program files\Samsung\Kies\Kies.exe" [2013-05-23 1561968]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2008-04-10 122880]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-10 524288]

"snp2uvc"="c:\windows\vsnp2uvc.exe" [2007-07-11 569344]

"TPFNF7"="c:\progra~1\Lenovo\NPDIRECT\TPFNF7SP.exe" [2009-08-03 62240]

"TpShocks"="TpShocks.exe" [2009-07-09 337184]

"TPHOTKEY"="c:\program files\Lenovo\HOTKEY\LVOSDSVC.exe" [2008-03-24 64368]

"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2008-10-08 256576]

"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-11-24 487424]

"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe" [2008-04-25 244208]

"LPManager"="c:\progra~1\Lenovo\LENOVO~2\LPMGR.exe" [2008-06-08 165208]

"LPMailChecker"="c:\progra~1\Lenovo\LENOVO~2\LPMLCHK.exe" [2008-06-08 124248]

"CameraApplicationLauncher"="c:\program files\Lenovo\Camera Center\bin\CameraApplicationLaunchpadLauncher.exe" [2009-02-03 16384]

"LCONTROL"="c:\program files\Lenovo\ATK Hotkey\LCONTROL.exe" [2008-03-20 77824]

"LFKA"="c:\program files\Lenovo\ATK Hotkey\LFKA.exe" [2008-04-16 315392]

"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2009-10-23 421888]

"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2009-10-23 208896]

"ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2009-07-29 425984]

"ACWLIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2009-07-29 172032]

"cssauth"="c:\program files\Lenovo\Client Security Solution\cssauth.exe" [2008-06-14 3073336]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]

"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]

"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]

"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]

"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143360]

"Message Center Plus"="c:\program files\LENOVO\Message Center Plus\MCPLaunch.exe" [2009-05-28 49976]

"AMSG"="c:\progra~1\THINKV~2\AMSG\Amsg.exe" [2009-09-03 436800]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2013-05-08 41056]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]

"Matrox PowerDesk"="c:\program files\Matrox Graphics\PowerDesk\Matrox.PDesk.Startup.exe" [2011-05-11 884744]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-02-23 129536]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-02-23 164352]

"Persistence"="c:\windows\system32\igfxpers.exe" [2012-02-23 140800]

"PDF7 Registry Controller"="c:\program files\Nuance\PDF Professional 7\RegistryController.exe" [2011-09-09 141160]

"PDFProHook"="c:\program files\Nuance\PDF Professional 7\pdfpro7hook.exe" [2011-09-09 1787752]

"Nuance PDF Converter Professional 7-reminder"="c:\program files\Nuance\PDF Professional 7\Ereg\Ereg.exe" [2011-09-06 333672]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2013-05-23 311152]

"UniPrint Client Init"="c:\program files\UniPrint Suite\Client\UPCInit.exe" [2011-11-28 203624]

"ConnectionCenter"="c:\program files\Citrix\ICA Client\redirector.exe" [2012-07-26 130232]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"RunNarrator"="Narrator.exe" [2008-04-14 53760]

.

c:\documents and settings\brothermel.PARK-LAW\Start Menu\Programs\Startup\

Dropbox.lnk - c:\documents and settings\brothermel.PARK-LAW\Application Data\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]

NexDef Plug-in.lnk - c:\documents and settings\brothermel.PARK-LAW\Local Settings\Application Data\Autobahn\nexdef.exe [2011-8-12 15490560]

OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE /tsr [2013-6-25 228552]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

VPN Client.lnk - c:\windows\Installer\{1CE60928-8325-49A8-8B06-633E48DD2B67}\Icon3E5562ED7.ico -user_logon [2012-10-23 6144]

.

[HKEY_LOCAL_MACHINE\software\policies\microsoft\windows\windowsupdate\au]

"NoAutoUpdate"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\kwinhook]

2013-08-23 20:44 84072 ----a-w- c:\windows\system32\KWinHook.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]

2008-06-25 00:31 95496 ----a-w- c:\windows\system32\psqlpwd.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]

2009-05-22 01:48 34080 ----a-w- c:\program files\Lenovo\HOTKEY\tphklock.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Citrix\ICACLI~1\RSHook.dll

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Notification Packages REG_MULTI_SZ scecli psqlpwd

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Documents and Settings\\brothermel.PARK-LAW\\Application Data\\Dropbox\\bin\\Dropbox.exe"=

"c:\\Program Files\\KBS\\ISiCastAgent\\ISiCastAgent.exe"=

"c:\\WINDOWS\\system32\\fxsclnt.exe"=

"c:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"=

"c:\\Program Files\\Shoreline Communications\\ShoreWare Client\\ShoreTel.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

.

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\SEP\0C01029F\136B.105\x86\SymDS.sys [6/18/2011 5:31 AM 340088]

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\SEP\0C01029F\136B.105\x86\SymEFA.sys [6/18/2011 5:31 AM 756856]

R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [6/30/2009 3:51 AM 20520]

R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Data\Definitions\BASHDefs\20131101.011\BHDrvx86.sys [11/7/2013 3:27 AM 1096280]

R1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\drivers\ctxusbm.sys [4/25/2011 2:49 PM 67960]

R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\SEP\0C01029F\136B.105\x86\Ironx86.sys [6/18/2011 5:31 AM 136312]

R1 tvtumon;tvtumon;c:\windows\system32\drivers\tvtumon.sys [5/10/2008 9:50 AM 46144]

R2 AMPAgent;Dell KACE Agent;c:\program files\Dell\KACE\AMPAgent.exe [11/12/2013 6:06 AM 2872424]

R2 LFKAS;Service of LFKA;c:\program files\Lenovo\ATK Hotkey\LFKAS.exe [8/21/2009 6:39 AM 208896]

R2 Matrox Centering Service;Matrox Centering Service;c:\program files\Matrox Graphics\PowerDesk\Matrox.PDesk.Services.exe [5/12/2011 3:32 AM 3703816]

R2 Matrox.Pdesk3.ServicesHost;Matrox.Pdesk3.ServicesHost;c:\program files\Matrox Graphics\PowerDesk\Matrox.PDesk.Services.exe [5/12/2011 3:32 AM 3703816]

R2 PDFProFiltSrv;PDFProFiltSrv;c:\program files\Nuance\PDF Professional 7\PDFProFiltSrv.exe [9/9/2011 3:13 PM 135016]

R2 Power Manager DBC Service;Power Manager DBC Service;c:\program files\ThinkPad\Utilities\PWMDBSVC.exe [8/21/2009 6:42 AM 53248]

R2 SecureConnector;ForeScout SecureConnector Service;c:\program files\ForeScout SecureConnector\SecureConnector.exe [11/21/2013 2:00 PM 1046584]

R2 SepMasterService;Symantec Endpoint Protection;c:\program files\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin\ccSvcHst.exe [6/18/2011 5:31 AM 137224]

R2 smihlp;SMI Helper Driver (smihlp);c:\program files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys [6/25/2008 9:07 AM 12560]

R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\Lenovo\Rescue and Recovery\rrpservice.exe [11/25/2008 7:34 AM 520192]

R2 TVT_UpdateMonitor;TVT Windows Update Monitor;c:\program files\Lenovo\Rescue and Recovery\UpdateMonitor.exe [5/10/2008 9:50 AM 360448]

R3 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\7.3.124.0\SeaPort.EXE [12/16/2013 7:34 PM 247968]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [11/27/2013 12:39 AM 108120]

R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Data\Definitions\IPSDefs\20131109.001\IDSXpx86.sys [11/10/2013 11:06 AM 380824]

R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [8/21/2009 6:26 AM 116224]

R3 JRSKD24;JRSKD24;c:\windows\system32\JRSKD24.SYS [1/12/2014 7:09 PM 37944]

R3 kcrtx86;kcrtx86;c:\windows\system32\kcrtx86.sys [1/12/2014 7:09 PM 126048]

R3 staccel;staccel;c:\windows\system32\drivers\staccel.sys [10/16/2012 4:56 AM 32864]

RUnknown ScreenConnect Client (89606bea9a3af76e);ScreenConnect Client (89606bea9a3af76e); [x]

S2 BBSvc;BingBar Service;c:\program files\Microsoft\BingBar\7.3.124.0\BBSvc.EXE [12/16/2013 7:34 PM 193696]

S2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files\Roxio\Digital Home 10\RoxioUpnpService10.exe [4/26/2008 12:18 AM 362992]

S2 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [4/26/2008 12:16 AM 309744]

S2 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [4/26/2008 12:15 AM 166384]

S2 SessionLauncher;SessionLauncher;c:\docume~1\ADMINI~1\LOCALS~1\Temp\DX9\SessionLauncher.exe --> c:\docume~1\ADMINI~1\LOCALS~1\Temp\DX9\SessionLauncher.exe [?]

S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [9/5/2013 11:34 PM 171680]

S3 COH_Mon;COH_Mon;\??\c:\windows\system32\Drivers\COH_Mon.sys --> c:\windows\system32\Drivers\COH_Mon.sys [?]

S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\drivers\ssudbus.sys [9/3/2013 11:07 PM 83864]

S3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [4/26/2008 12:18 AM 313840]

S3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [4/26/2008 12:15 AM 1120752]

S3 scsk5;SCSK5 Driver Service;c:\windows\system32\drivers\scsk5.sys --> c:\windows\system32\drivers\scsk5.sys [?]

S3 Smcinst;Symantec Auto-upgrade Agent;c:\program files\Symantec\Symantec Endpoint Protection\SmcLU\Setup\smcinst.exe --> c:\program files\Symantec\Symantec Endpoint Protection\SmcLU\Setup\smcinst.exe [?]

S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\drivers\ssudmdm.sys [9/3/2013 11:07 PM 181912]

S3 SyDvCtrl;SyDvCtrl;c:\program files\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin\SyDvCtrl32.sys [6/18/2011 5:31 AM 23984]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - JRSKD24

*NewlyCreated* - KCRTX86

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-12-06 01:34 1210320 ----a-w- c:\program files\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2014-01-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-10-28 23:57]

.

2014-01-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-10-28 23:57]

.

2013-12-29 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job

- c:\program files\PC-Doctor\uaclauncher.exe [2010-05-07 19:46]

.

2014-01-12 c:\windows\Tasks\PMTask.job

- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2009-08-20 06:04]

.

2014-01-13 c:\windows\Tasks\SystemToolsDailyTest.job

- c:\program files\PC-Doctor\pcdrcui.exe [2010-05-08 21:08]

.

------- Supplementary Scan -------

.

IE: Append the content of the link to existing PDF file - c:\program files\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll/ZeonIEAppend.HTML

IE: Append the content of the selected links to existing PDF file - c:\program files\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll/ZeonIEAppendSelLinks.HTML

IE: Append to existing PDF file - c:\program files\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll/ZeonIEAppend.HTML

IE: Create PDF file - c:\program files\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll/ZeonIECapture.HTML

IE: Create PDF file from the content of the link - c:\program files\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll/ZeonIECapture.HTML

IE: Create PDF files from the selected links - c:\program files\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll/ZeonIECaptureSelLinks.HTML

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000

IE: Open with Nuance PDF Converter 7 - c:\program files\Nuance\PDF Professional 7\cnvres_eng.dll /100

IE: Open with PDF Professional 7 - c:\program files\Nuance\PDF Professional 7\Bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm

IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105

Trusted Zone: wellsfargo.com\billpay

TCP: DhcpNameServer = 192.168.2.1

Filter: application/x-gforms-deflate - {16F165FF-E9B6-496C-AD6D-039418EA3420} - c:\windows\Downloaded Program Files\Potential.dll

Filter: application/x-gforms-xml - {16F165FF-E9B6-496C-AD6D-039418EA3420} - c:\windows\Downloaded Program Files\Potential.dll

.

- - - - ORPHANS REMOVED - - - -

.

HKCU-Run-KiesAirMessage - c:\program files\Samsung\Kies\KiesAirMessage.exe

Notify-ACNotify - ACNotify.dll

AddRemove-01_Simmental - c:\program files\SAMSUNG\USB Drivers\01_Simmental\Uninstall.exe

AddRemove-02_Siberian - c:\program files\SAMSUNG\USB Drivers\02_Siberian\Uninstall.exe

AddRemove-03_Swallowtail - c:\program files\SAMSUNG\USB Drivers\03_Swallowtail\Uninstall.exe

AddRemove-04_semseyite - c:\program files\SAMSUNG\USB Drivers\04_semseyite\Uninstall.exe

AddRemove-05_Sloan - c:\program files\SAMSUNG\USB Drivers\05_Sloan\Uninstall.exe

AddRemove-06_Spencer - c:\program files\SAMSUNG\USB Drivers\06_Spencer\Uninstall.exe

AddRemove-07_Schorl - c:\program files\SAMSUNG\USB Drivers\07_Schorl\Uninstall.exe

AddRemove-08_EMPChipset - c:\program files\SAMSUNG\USB Drivers\08_EMPChipset\Uninstall.exe

AddRemove-09_Hsp - c:\program files\SAMSUNG\USB Drivers\09_Hsp\Uninstall.exe

AddRemove-11_HSP_Plus_Default - c:\program files\SAMSUNG\USB Drivers\11_HSP_Plus_Default\Uninstall.exe

AddRemove-16_Shrewsbury - c:\program files\SAMSUNG\USB Drivers\16_Shrewsbury\Uninstall.exe

AddRemove-17_EMP_Chipset2 - c:\program files\SAMSUNG\USB Drivers\17_EMP_Chipset2\Uninstall.exe

AddRemove-18_Zinia_Serial_Driver - c:\program files\SAMSUNG\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe

AddRemove-19_VIA_driver - c:\program files\SAMSUNG\USB Drivers\19_VIA_driver\Uninstall.exe

AddRemove-20_NXP_Driver - c:\program files\SAMSUNG\USB Drivers\20_NXP_Driver\Uninstall.exe

AddRemove-21_Searsburg - c:\program files\SAMSUNG\USB Drivers\21_Searsburg\Uninstall.exe

AddRemove-22_WiBro_WiMAX - c:\program files\SAMSUNG\USB Drivers\22_WiBro_WiMAX\Uninstall.exe

AddRemove-24_flashusbdriver - c:\program files\SAMSUNG\USB Drivers\24_flashusbdriver\Uninstall.exe

AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2014-01-13 21:31

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

c:\windows\TEMP\FSA_TMP_18592_52D3DCF8_0001 0 bytes

.

scan completed successfully

hidden files: 1

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SepMasterService]

"ImagePath"="\"c:\program files\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin\ccSvcHst.exe\" /s \"Symantec Endpoint Protection\" /m \"c:\program files\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin\sms.dll\" /prefetch:1"

--

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SmcService]

"ImagePath"="\"c:\program files\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin\Smc.exe\" /prefetch:1"

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TrueSight]

"ImagePath"="\??\"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Symantec\Symantec Endpoint Protection\CurrentVersion]

"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,4f,00,46,00,\

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(644)

c:\progra~1\Citrix\ICACLI~1\RSHook.dll

c:\program files\Citrix\ICA Client\ShellHook.dll

c:\windows\system32\vrlogon.dll

c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll

c:\program files\ThinkPad\ConnectUtilities\AcSvcStub.dll

c:\program files\ThinkPad\ConnectUtilities\AcLocSettings.dll

c:\program files\ThinkPad\ConnectUtilities\ACHelper.dll

c:\windows\system32\kwinhook.dll

c:\windows\system32\psqlpwd.dll

c:\program files\ThinkVantage Fingerprint Software\homefus2.dll

c:\program files\ThinkVantage Fingerprint Software\infql2.dll

c:\program files\ThinkVantage Fingerprint Software\homepass.dll

c:\program files\ThinkVantage Fingerprint Software\bio.dll

c:\program files\ThinkVantage Fingerprint Software\qlbase.dll

c:\program files\ThinkVantage Fingerprint Software\ps2css.dll

c:\program files\Lenovo\HOTKEY\tphklock.dll

c:\program files\ThinkVantage Fingerprint Software\pscssint.dll

c:\program files\ThinkVantage Fingerprint Software\vti.dll

c:\windows\system32\igfxdev.dll

.

- - - - - - - > 'lsass.exe'(704)

c:\progra~1\Citrix\ICACLI~1\RSHook.dll

c:\program files\Citrix\ICA Client\ShellHook.dll

c:\windows\system32\psqlpwd.dll

c:\program files\ThinkVantage Fingerprint Software\homefus2.dll

c:\program files\ThinkVantage Fingerprint Software\infql2.dll

.

Completion time: 2014-01-13 21:35:38

ComboFix-quarantined-files.txt 2014-01-13 12:35

ComboFix2.txt 2012-09-28 04:36

.

Pre-Run: 174,016,573,440 bytes free

Post-Run: 175,559,495,680 bytes free

.

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

.

- - End Of File - - 61617D94EFF579EC65D057DE088131D4

ECA0DF36C8CD373AF8F175D564247B9A

AdvancedSetup · January 17, 2014

Sorry for the delay as I was out of town.

Please uninstall ALL versions of Java and run the following.

Please download JavaRa-1.16 and save it to your computer.

Double click to open the zip file and then select all and choose Copy.
Create a new folder on your Desktop named RemoveJava and paste the files into this new folder.
Quit all browsers and other running applications.
Right-click on JavaRa.exe in RemoveJava folder and choose Run as administrator to start the program.
From the drop-down menu, choose English and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location and post it in your next reply.

Then reboot the computer and run this tool

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

jgbeehive · January 17, 2014

Thanks - here is the JavaRa log:

JavaRa 1.16 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Fri Jan 17 22:17:20 2014

Found and removed: C:\Documents and Settings\brothermel.PARK-LAW\Application Data\Sun\Java\jre1.6.0_11

Found and removed: C:\Documents and Settings\brothermel.PARK-LAW\Application Data\Sun\Java\jre1.6.0_26

Found and removed: C:\Documents and Settings\brothermel.PARK-LAW\Application Data\Sun\Java\jre1.7.0_15

Found and removed: C:\Documents and Settings\brothermel.PARK-LAW\Application Data\Sun\Java\jre1.7.0_21

Found and removed: C:\Documents and Settings\brothermel.PARK-LAW\Application Data\Sun\Java\jre1.7.0_25

Found and removed: C:\Documents and Settings\brothermel.PARK-LAW\Application Data\Sun\Java\jre1.7.0_40

Found and removed: C:\Documents and Settings\brothermel.PARK-LAW\Application Data\Sun\Java\jre1.7.0_45

Found and removed: Software\Classes\JavaPlugin.160_31

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0357E4991DA5FF14F9615B3412062B03

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0357E4991DA5FF14F9615B3412062B04

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0357E4991DA5FF14F9615B3412062B06

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0357E4991DA5FF14F9615B3612062B03

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0357E4991DA5FF14F9615B3612062B04

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0357E4991DA5FF14F9615B3612062B06

Found and removed: SOFTWARE\Classes\CLSID\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}

Found and removed: SOFTWARE\Classes\MIME\Database\Content Type\application/java-deployment-toolkit

Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.7.0.0

Found and removed: SOFTWARE\Microsoft\Internet Explorer\Low Rights

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

Found and removed: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs

Found and removed: SOFTWARE\JavaSoft

Found and removed: SOFTWARE\JreMetrics

Found and removed: SOFTWARE\MozillaPlugins

JavaRa 1.16 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Fri Jan 17 22:18:46 2014

------------------------------------

Finished reporting.

jgbeehive · January 17, 2014

Here is the FRST log:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-01-2014 03

Ran by BRothermel (administrator) on LAPTOP007 on 17-01-2014 22:29:09

Running from C:\Documents and Settings\brothermel.PARK-LAW\Desktop

Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English(US)

Internet Explorer Version 8

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version:

Download link for 64-Bit Version:

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) ===================

(Lenovo) C:\WINDOWS\system32\ibmpmsvc.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\S24EvMon.exe

() C:\Program Files\Lenovo\ATK Hotkey\GFNEXSrv.exe

() C:\Program Files\Lenovo\ATK Hotkey\LFKAS.exe

(Lenovo ) C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe

(Dell Inc.) C:\Program Files\Dell\KACE\AMPAgent.exe

(Microsoft Corporation.) C:\Program Files\Microsoft\BingBar\7.3.124.0\BBSvc.EXE

(Cisco Systems, Inc.) C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

(InterVideo) C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

(Matrox Graphics Inc) C:\Program Files\Matrox Graphics\PowerDesk\Matrox.PDesk.Services.exe

(Nuance Communications, Inc.) C:\Program Files\Nuance\PDF Professional 7\PDFProFiltSrv.exe

(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(Elsinore Technologies, Inc.) C:\Program Files\ScreenConnect Client (89606bea9a3af76e)\Elsinore.ScreenConnect.ClientService.exe

() C:\Program Files\ForeScout SecureConnector\SecureConnector.exe

(Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin\ccSvcHst.exe

(Lenovo Group Limited) C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe

() C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe

(Lenovo Group Limited) C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe

(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

() C:\Program Files\ThinkPad\Utilities\PWMDBSVC.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\System Update\SUService.exe

(Lenovo ) C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe

(Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin\ccSvcHst.exe

(Elsinore Technologies, Inc.) C:\Program Files\ScreenConnect Client (89606bea9a3af76e)\Elsinore.ScreenConnect.WindowsClient.exe

(Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin\Smc.exe

(Microsoft Corporation) C:\WINDOWS\system32\wbem\unsecapp.exe

(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe

(Elsinore Technologies, Inc.) C:\Program Files\ScreenConnect Client (89606bea9a3af76e)\Elsinore.ScreenConnect.WindowsClient.exe

(Lenovo ) C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe

(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Sonix) C:\WINDOWS\vsnp2uvc.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\NPDIRECT\tpfnf7sp.exe

(Lenovo.) C:\WINDOWS\system32\TpShocks.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\LVOSDSVC.exe

(Lenovo Group Ltd.) C:\Program Files\ThinkPad\Utilities\EZEJMNAP.EXE

(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe

(Lenovo Group Limited) C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\LenovoCare\LPMGR.EXE

(Lenovo Group Limited) C:\Program Files\Lenovo\LenovoCare\LPMLCHK.EXE

(ATK0101) C:\Program Files\Lenovo\ATK Hotkey\LControl.exe

(Lenovo) C:\Program Files\Lenovo\ATK Hotkey\LFKA.exe

(Lenovo) C:\Program Files\Lenovo\Camera Center\bin\LenovoCameraCenter.exe

(Lenovo ) C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe

(Lenovo ) C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\Client Security Solution\cssauth.exe

() C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe

(LENOVO) C:\Program Files\ThinkVantage\AMSG\Amsg.exe

(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe

(Matrox Graphics Inc.) C:\Program Files\Matrox Graphics\PowerDesk\Matrox.PDesk.Startup.exe

(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe

(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe

(Matrox Graphics Inc.) C:\Program Files\Matrox Graphics\PowerDesk\Matrox.PDesk.Core.exe

(Nuance Communications, Inc.) C:\Program Files\Nuance\PDF Professional 7\PdfPro7Hook.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\SAMSUNG\Kies\KiesTrayAgent.exe

(Citrix Systems, Inc.) C:\Program Files\Citrix\ICA Client\redirector.exe

(Samsung) C:\Program Files\SAMSUNG\Kies\Kies.exe

(Dropbox, Inc.) C:\Documents and Settings\brothermel.PARK-LAW\Application Data\Dropbox\bin\Dropbox.exe

() C:\Documents and Settings\brothermel.PARK-LAW\Local Settings\Application Data\Autobahn\nexdef.exe

(UniPrint) C:\Program Files\UniPrint Suite\Client\UPCRelay.exe

() C:\Program Files\ForeScout SecureConnector\SecureConnector.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [synTPLpr] - C:\Program Files\Synaptics\SynTP\SynTPLpr.exe [122880 2008-04-10] (Synaptics, Inc.)

HKLM\...\Run: [synTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [524288 2008-04-10] (Synaptics, Inc.)

HKLM\...\Run: [snp2uvc] - C:\WINDOWS\vsnp2uvc.exe [569344 2007-07-12] (Sonix)

HKLM\...\Run: [TPFNF7] - C:\Program Files\Lenovo\NPDIRECT\tpfnf7sp.exe [62240 2009-08-03] (Lenovo Group Limited)

HKLM\...\Run: [TpShocks] - C:\Windows\system32\TpShocks.exe [337184 2009-07-09] (Lenovo.)

HKLM\...\Run: [TPHOTKEY] - C:\Program Files\Lenovo\HOTKEY\LVOSDSVC.exe [64368 2008-03-24] (Lenovo Group Limited)

HKLM\...\Run: [EZEJMNAP] - C:\Program Files\ThinkPad\Utilities\EZEJMNAP.EXE [256576 2008-10-08] (Lenovo Group Ltd.)

HKLM\...\Run: [TVT Scheduler Proxy] - C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe [487424 2008-11-25] (Lenovo Group Limited)

HKLM\...\Run: [RoxWatchTray] - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe [244208 2008-04-26] (Sonic Solutions)

HKLM\...\Run: [LPManager] - C:\Program Files\Lenovo\LenovoCare\LPMGR.EXE [165208 2008-06-09] (Lenovo Group Limited)

HKLM\...\Run: [LPMailChecker] - C:\Program Files\Lenovo\LenovoCare\LPMLCHK.EXE [124248 2008-06-09] (Lenovo Group Limited)

HKLM\...\Run: [CameraApplicationLauncher] - C:\Program Files\Lenovo\Camera Center\bin\CameraApplicationLaunchpadLauncher.exe [16384 2009-02-03] ()

HKLM\...\Run: [LCONTROL] - C:\Program Files\Lenovo\ATK Hotkey\LCONTROL.exe [77824 2008-03-20] (ATK0101)

HKLM\...\Run: [LFKA] - C:\Program Files\Lenovo\ATK Hotkey\LFKA.exe [315392 2008-04-16] (Lenovo)

HKLM\...\Run: [PWRMGRTR] - C:\Program Files\ThinkPad\Utilities\PWRMGRTR.DLL [421888 2009-10-23] (Lenovo Group Limited)

HKLM\...\Run: [bLOG] - C:\Program Files\ThinkPad\Utilities\BATLOGEX.DLL [208896 2009-10-23] ()

HKLM\...\Run: [ACTray] - C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe [425984 2009-07-30] (Lenovo )

HKLM\...\Run: [ACWLIcon] - C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe [172032 2009-07-30] (Lenovo )

HKLM\...\Run: [cssauth] - C:\Program Files\Lenovo\Client Security Solution\cssauth.exe [3073336 2008-06-14] (Lenovo Group Limited)

HKLM\...\Run: [iMJPMIG8.1] - C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [208952 2008-04-14] (Microsoft Corporation)

HKLM\...\Run: [MSPY2002] - C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [59392 2008-04-14] ()

HKLM\...\Run: [PHIME2002ASync] - C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [455168 2008-04-14] (Microsoft Corporation)

HKLM\...\Run: [PHIME2002A] - C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [455168 2008-04-14] (Microsoft Corporation)

HKLM\...\Run: [synchronization Manager] - C:\Windows\system32\mobsync.exe [143360 2008-04-14] (Microsoft Corporation)

HKLM\...\Run: [Message Center Plus] - C:\Program Files\LENOVO\Message Center Plus\MCPLaunch.exe [49976 2009-05-28] ()

HKLM\...\Run: [AMSG] - C:\Program Files\ThinkVantage\AMSG\Amsg.exe [436800 2009-09-04] (LENOVO)

HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-09] (Adobe Systems Incorporated)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM\...\Run: [Matrox PowerDesk] - C:\Program Files\Matrox Graphics\PowerDesk\Matrox.PDesk.Startup.exe [884744 2011-05-12] (Matrox Graphics Inc.)

HKLM\...\Run: [PDF7 Registry Controller] - C:\Program Files\Nuance\PDF Professional 7\RegistryController.exe [141160 2011-09-09] (Nuance Communications, Inc.)

HKLM\...\Run: [PDFProHook] - C:\Program Files\Nuance\PDF Professional 7\pdfpro7hook.exe [1787752 2011-09-09] (Nuance Communications, Inc.)

HKLM\...\Run: [Nuance PDF Converter Professional 7-reminder] - C:\Program Files\Nuance\PDF Professional 7\Ereg\Ereg.exe [333672 2011-09-07] (Nuance Communications, Inc.)

HKLM\...\Run: [KiesTrayAgent] - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-05-24] (Samsung Electronics Co., Ltd.)

HKLM\...\Run: [uniPrint Client Init] - C:\Program Files\UniPrint Suite\Client\UPCInit.exe [203624 2011-11-28] (UniPrint)

HKLM\...\Run: [ConnectionCenter] - C:\Program Files\Citrix\ICA Client\redirector.exe [130232 2012-07-27] (Citrix Systems, Inc.)

Winlogon\Notify\kwinhook: C:\Windows\system32\kwinhook.dll (Dell Inc.)

Winlogon\Notify\psfus: C:\WINDOWS\system32\psqlpwd.dll (UPEK Inc.)

Winlogon\Notify\tphotkey: C:\Program Files\Lenovo\HOTKEY\tphklock.dll (Lenovo Group Limited)

HKLM\...\Policies\Explorer: [NoCDBurning] 1

HKCU\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [1561968 2013-05-24] (Samsung)

HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [204288 2006-10-18] (Microsoft Corporation)

HKU\Default User\...\Run: [ooVoo] - C\ooVoo.exe /minimized

HKU\Tech_Support\...\Run: [skype] - C:\Program Files\Skype\Phone\Skype.exe [ 2013-11-14] (Skype Technologies S.A.)

HKU\ylim\...\Run: [iSUSPM] - C:\Documents and Settings\All Users\Application Data\FLEXnet\Connect\11\ISUSPM.exe [ 2009-05-06] (Acresso Corporation)

AppInit_DLLs: C:\Program Files\Citrix\ICA Client\RSHook.dll [257208 2012-07-27] (Citrix Systems, Inc.)

Lsa: [Notification Packages] scecli psqlpwd

Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk

ShortcutTarget: VPN Client.lnk -> C:\WINDOWS\Installer\{1CE60928-8325-49A8-8B06-633E48DD2B67}\Icon3E5562ED7.ico ()

Startup: C:\Documents and Settings\brothermel.PARK-LAW\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Documents and Settings\brothermel.PARK-LAW\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: C:\Documents and Settings\brothermel.PARK-LAW\Start Menu\Programs\Startup\NexDef Plug-in.lnk

ShortcutTarget: NexDef Plug-in.lnk -> C:\Documents and Settings\brothermel.PARK-LAW\Local Settings\Application Data\Autobahn\nexdef.exe ()

Startup: C:\Documents and Settings\brothermel.PARK-LAW\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk

ShortcutTarget: OneNote 2010 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.patentlyo.com/

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search

Toolbar: HKLM - DocuCom PDF - {E3286BF1-E654-42FF-B4A6-5E111731DF6B} - C:\Program Files\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)

Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)

DPF: {34B5A473-9696-4F9A-9BA1-41B8185A9798} https://espace.samsungsdi.com:3443/epms/cab/EpFTP3_U.cab

DPF: {6CE20149-ABE3-462E-A1B4-5B549971AA38} C:\Documents and Settings\brothermel.PARK-LAW\My Documents\Downloads\CKKeyPro_Installer_Multi_10023.exe

DPF: {7A868592-7D06-44CF-ADF1-EF7517BD8F3A} http://epms.samsungdisplay.com/cab/ManagerEx4.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {F2BE8941-E765-444C-9070-4CC933405CE9} https://espace.samsungsdi.com:3443/epms/cab/NamoWec.cab

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Filter: application/x-gforms-deflate - {16F165FF-E9B6-496C-AD6D-039418EA3420} - C:\WINDOWS\Downloaded Program Files\Potential.dll (SHIFT Infomation & Communication Co., Ltd.)

Filter: application/x-gforms-xml - {16F165FF-E9B6-496C-AD6D-039418EA3420} - C:\WINDOWS\Downloaded Program Files\Potential.dll (SHIFT Infomation & Communication Co., Ltd.)

Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome:

=======

CHR DefaultSearchKeyword: google.co.kr

CHR Extension: (Google Docs) - C:\Documents and Settings\brothermel.PARK-LAW\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0 [2013-12-08]

CHR Extension: (Google Drive) - C:\Documents and Settings\brothermel.PARK-LAW\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0 [2013-12-08]

CHR Extension: (YouTube) - C:\Documents and Settings\brothermel.PARK-LAW\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_1 [2013-12-08]

CHR Extension: (Google Search) - C:\Documents and Settings\brothermel.PARK-LAW\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_1 [2013-12-08]

CHR Extension: (Google Wallet) - C:\Documents and Settings\brothermel.PARK-LAW\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0 [2013-12-19]

CHR Extension: (Gmail) - C:\Documents and Settings\brothermel.PARK-LAW\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_2 [2013-12-08]

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

R2 AMPAgent; C:\Program Files\Dell\KACE\AMPAgent.exe [2872424 2013-11-12] (Dell Inc.)

R2 ATKGFNEXSrv; C:\Program Files\Lenovo\ATK Hotkey\GFNEXSrv.exe [94208 2007-10-31] ()

R2 CVPND; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [1528616 2010-09-28] (Cisco Systems, Inc.)

R2 LFKAS; C:\Program Files\Lenovo\ATK Hotkey\LFKAS.exe [208896 2008-03-20] ()

R2 Matrox Centering Service; C:\Program Files\Matrox Graphics\PowerDesk\Matrox.PDesk.Services.exe [3703816 2011-05-12] (Matrox Graphics Inc)

R2 Matrox.Pdesk3.ServicesHost; C:\Program Files\Matrox Graphics\PowerDesk\Matrox.PDesk.Services.exe [3703816 2011-05-12] (Matrox Graphics Inc)

R2 PDFProFiltSrv; C:\Program Files\Nuance\PDF Professional 7\PDFProFiltSrv.exe [135016 2011-09-09] (Nuance Communications, Inc.)

R2 Power Manager DBC Service; C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE [53248 2009-10-23] ()

S3 Roxio UPnP Renderer 10; C:\Program Files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [313840 2008-04-26] (Sonic Solutions)

S2 Roxio Upnp Server 10; C:\Program Files\Roxio\Digital Home 10\RoxioUpnpService10.exe [362992 2008-04-26] (Sonic Solutions)

S2 RoxLiveShare10; C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [309744 2008-04-26] (Sonic Solutions)

R2 S24EventMonitor; C:\Program Files\Intel\WiFi\bin\S24EvMon.exe [954368 2009-09-22] (Intel® Corporation)

R2 ScreenConnect Client (89606bea9a3af76e); C:\Program Files\ScreenConnect Client (89606bea9a3af76e)\Elsinore.ScreenConnect.ClientService.exe [50232 2013-10-12] (Elsinore Technologies, Inc.)

R2 SecureConnector; C:\Program Files\ForeScout SecureConnector\SecureConnector.exe [1046584 2013-12-12] ()

R2 SepMasterService; C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin\ccSvcHst.exe [137224 2011-06-18] (Symantec Corporation)

R3 SmcService; C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin\Smc.exe [1664744 2011-06-18] (Symantec Corporation)

S3 SNAC; C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin\snac.exe [280496 2011-06-18] (Symantec Corporation)

R2 SUService; c:\program files\lenovo\system update\suservice.exe [28672 2009-06-13] (Lenovo Group Limited)

R2 TVT Backup Protection Service; C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe [520192 2008-11-25] ()

R2 TVT Scheduler; c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe [1155072 2008-11-25] (Lenovo Group Limited)

S2 SessionLauncher; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\DX9\SessionLauncher.exe [x]

S3 Smcinst; C:\Program Files\Symantec\Symantec Endpoint Protection\SmcLU\Setup\smcinst.exe [x]

==================== Drivers (Whitelisted) ====================

S4 abp480n5; C:\Windows\system32\DRIVERS\ABP480N5.SYS [23552 2001-08-18] (Microsoft Corporation)

R1 ANC; C:\Windows\System32\drivers\ANC.SYS [11520 2009-07-22] (IBM Corp.)

R2 ASMMAP; C:\Program Files\Lenovo\ATK Hotkey\ASMMAP.sys [13880 2007-07-25] ()

R1 BHDrvx86; C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Data\Definitions\BASHDefs\20131101.011\BHDrvx86.sys [1096280 2013-10-30] (Symantec Corporation)

S3 CCDECODE; C:\Windows\System32\DRIVERS\CCDECODE.sys [17024 2008-04-14] (Microsoft Corporation)

R3 CnxtHdAudService; C:\Windows\System32\drivers\CHDAU32.sys [764416 2008-06-12] (Conexant Systems Inc.)

S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-19] (Cisco Systems, Inc.)

R2 CVPNDRVA; C:\WINDOWS\system32\Drivers\CVPNDRVA.sys [308859 2010-09-28] (Cisco Systems, Inc.)

R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [131984 2008-11-17] (Deterministic Networks, Inc.)

R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376920 2013-11-24] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [108120 2013-11-24] (Symantec Corporation)

R3 HSFHWAZL; C:\Windows\System32\DRIVERS\HSFHWAZL.sys [210560 2008-03-25] (Conexant Systems, Inc.)

R3 HSF_DPV; C:\Windows\System32\DRIVERS\HSF_DPV.sys [985472 2008-03-25] (Conexant Systems, Inc.)

R1 IBMTPCHK; C:\WINDOWS\system32\Drivers\IBMBLDID.sys [4224 2009-07-22] ()

R3 IDSxpx86; C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Data\Definitions\IPSDefs\20131109.001\IDSxpx86.sys [380824 2013-10-30] (Symantec Corporation)

S3 JRSKD24; C:\WINDOWS\system32\JRSKD24.SYS [37944 2014-01-12] (SoftForum Corporation)

S3 kcrtx86; C:\WINDOWS\system32\kcrtx86.sys [126048 2014-01-12] (Kings Information & Network)

R3 MTsensor; C:\Windows\System32\DRIVERS\A0101X32.sys [5760 2007-08-25] ()

R3 NAVENG; C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Data\Definitions\VirusDefs\20131124.007\NAVENG.SYS [93272 2013-11-24] (Symantec Corporation)

R3 NAVEX15; C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Data\Definitions\VirusDefs\20131124.007\NAVEX15.SYS [1612376 2013-11-24] (Symantec Corporation)

S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)

R3 NETw5x32; C:\Windows\System32\DRIVERS\NETw5x32.sys [5977216 2009-09-16] (Intel Corporation)

R2 pmem; C:\WINDOWS\System32\drivers\pmemnt.sys [7012 2009-08-21] (Microsoft Corporation)

R2 s24trans; C:\Windows\System32\DRIVERS\s24trans.sys [13952 2009-08-10] (Intel Corporation)

R2 smihlp; C:\Program Files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys [12560 2008-06-25] (UPEK Inc.)

S3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [9632128 2007-10-02] ()

R1 SRTSP; C:\Windows\System32\Drivers\SEP\0C01029F\136B.105\x86\SRTSP.SYS [516216 2011-06-18] (Symantec Corporation)

R1 SRTSPX; C:\Windows\System32\Drivers\SEP\0C01029F\136B.105\x86\SRTSPX.SYS [50168 2011-06-18] (Symantec Corporation)

R3 staccel; C:\Windows\System32\DRIVERS\staccel.sys [32864 2012-10-16] (ShoreTel, Inc)

S3 SyDvCtrl; C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin\SyDvCtrl32.sys [23984 2011-06-18] (Symantec Corporation)

R0 SymDS; C:\Windows\System32\Drivers\SEP\0C01029F\136B.105\x86\SYMDS.SYS [340088 2011-06-18] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\Drivers\SEP\0C01029F\136B.105\x86\SYMEFA.SYS [756856 2011-06-18] (Symantec Corporation)

R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT.SYS [127096 2011-09-09] (Symantec Corporation)

R1 SymIRON; C:\Windows\System32\Drivers\SEP\0C01029F\136B.105\x86\Ironx86.SYS [136312 2011-06-18] (Symantec Corporation)

R1 SYMTDI; C:\Windows\System32\Drivers\SEP\0C01029F\136B.105\x86\SYMTDI.SYS [369784 2011-06-18] (Symantec Corporation)

R1 SysPlant; C:\Windows\System32\Drivers\SysPlant.sys [92080 2011-09-09] (Symantec Corporation)

R3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [26624 2013-04-15] (The OpenVPN Project)

R3 Teefer2; C:\Windows\System32\DRIVERS\teefer.sys [118960 2011-06-18] (Symantec Corporation)

R1 TPHKDRV; C:\Windows\System32\DRIVERS\TPHKDRV.sys [17844 2008-05-13] (Lenovo Group Limited)

R1 TPPWRIF; C:\Windows\System32\drivers\Tppwrif.sys [4442 2009-10-23] ()

R1 TSMAPIP; C:\Windows\System32\drivers\TSMAPIP.SYS [4608 2009-08-03] ()

S3 catchme; \??\C:\DOCUME~1\BROTHE~1.PAR\LOCALS~1\Temp\catchme.sys [x]

S3 COH_Mon; \??\C:\WINDOWS\system32\Drivers\COH_Mon.sys [x]

S3 scsk5; system32\drivers\scsk5.sys [x]

U3 TrueSight; \??\ [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-01-17 22:26 - 2014-01-17 22:29 - 00027112 _____ C:\Documents and Settings\brothermel.PARK-LAW\Desktop\FRST.txt

2014-01-17 22:26 - 2014-01-17 22:26 - 00000000 ____D C:\FRST

2014-01-17 22:19 - 2014-01-17 22:19 - 00002789 _____ C:\Documents and Settings\brothermel.PARK-LAW\Desktop\JavaRa.log

2014-01-17 22:17 - 2014-01-17 22:18 - 00002789 _____ C:\JavaRa.log

2014-01-17 22:16 - 2014-01-17 22:16 - 00000000 ____D C:\Documents and Settings\brothermel.PARK-LAW\Desktop\RemoveJava

2014-01-17 22:09 - 2014-01-17 22:09 - 01221120 _____ (Farbar) C:\Documents and Settings\brothermel.PARK-LAW\Desktop\FRST.exe

2014-01-17 22:06 - 2014-01-17 22:06 - 00165483 _____ C:\Documents and Settings\brothermel.PARK-LAW\Desktop\JavaRa-1.16-28-5-13.zip

2014-01-16 15:31 - 2014-01-16 15:31 - 00004354 _____ C:\WINDOWS\KB2914368.log

2014-01-16 15:31 - 2014-01-16 15:31 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2914368$

2014-01-16 10:31 - 2014-01-17 22:25 - 00000436 _____ C:\WINDOWS\system32\Drivers\etc\hosts.ics

2014-01-14 23:28 - 2014-01-14 23:28 - 00095010 _____ C:\Documents and Settings\brothermel.PARK-LAW\Desktop\2014-01-14 Good Faith in Settlement v1.pptx

2014-01-14 01:05 - 2014-01-14 01:05 - 00044032 _____ C:\Documents and Settings\brothermel.PARK-LAW\Desktop\2014-01-13 Weekly Prosecution work load_ByAttorney.xls

2014-01-13 21:35 - 2014-01-13 21:35 - 00036513 _____ C:\ComboFix.txt

2014-01-13 21:15 - 2014-01-13 21:15 - 00000000 _RSHD C:\cmdcons

2014-01-13 21:15 - 2009-09-22 17:09 - 00000211 _____ C:\Boot.bak

2014-01-13 21:15 - 2004-08-03 23:00 - 00260272 __RSH C:\cmldr

2014-01-13 17:32 - 2014-01-13 16:44 - 05166068 ____R (Swearware) C:\Documents and Settings\brothermel.PARK-LAW\Desktop\ComboFix.exe

2014-01-12 23:20 - 2014-01-12 23:20 - 09632128 _____ () C:\WINDOWS\system32\Drivers\snp2uvc.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00503008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wdf01000.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00384768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\update.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00361600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00357888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00226880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip6.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00203136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rmcast.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00196224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdpdr.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00181912 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\WINDOWS\system32\Drivers\ssudmdm.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00177632 _____ (Synaptics, Inc.) C:\WINDOWS\system32\Drivers\SynTP.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00175744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00146048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\portcls.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00144128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbport.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00139784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdpwd.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00127096 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT.SYS.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00123008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbvideo.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00118960 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\teefer.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00102656 _____ (Realtek Semiconductor Corporation ) C:\WINDOWS\system32\Drivers\Rtenicxp.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00092080 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SysPlant.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00083864 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\WINDOWS\system32\Drivers\ssudbus.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00083072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wdmaud.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00082944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WudfRd.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00081664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\videoprt.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00077568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WudfPf.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00073472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sr.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00069120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\psched.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\serial.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00060800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sysaudio.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00059520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00057600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\redbook.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00056576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\swmidi.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00052352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00051328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rasl2tp.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00050576 _____ (UPEK Inc.) C:\WINDOWS\system32\Drivers\tcusb.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00048384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\raspptp.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00046592 _____ (REDC) C:\WINDOWS\system32\Drivers\rimmptsk.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00046144 _____ (Lenovo) C:\WINDOWS\system32\Drivers\tvtumon.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00044944 _____ (Sonic Solutions) C:\WINDOWS\system32\Drivers\pxhelp20.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00043008 _____ (REDC) C:\WINDOWS\system32\Drivers\rimsptsk.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00041472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\raspppoe.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00040840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\termdd.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00039368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winusb.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00038528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wpdusb.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00038400 _____ (REDC) C:\WINDOWS\system32\Drivers\rixdptsk.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00035040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wdfldr.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00034560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wanarp.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00033536 _____ (Lenovo) C:\WINDOWS\system32\Drivers\tvtfilter.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00032864 _____ (ShoreTel, Inc) C:\WINDOWS\system32\Drivers\staccel.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00032384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbccgp.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00030336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbehci.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00030144 _____ (Lenovo (United States) Inc.) C:\WINDOWS\system32\Drivers\psadd.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00026624 _____ (The OpenVPN Project) C:\WINDOWS\system32\Drivers\tap0901.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00026368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00025856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbprint.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00021896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tdtcp.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00020992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vga.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00020608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbuhci.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00020480 _____ (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) C:\WINDOWS\system32\Drivers\secdrv.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00019200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WSTCODEC.SYS.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00019072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tdi.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00017844 _____ (Lenovo Group Limited) C:\WINDOWS\system32\Drivers\TPHKDRV.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00017792 _____ (Parallel Technologies, Inc.) C:\WINDOWS\system32\Drivers\ptilink.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00016512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\raspti.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00015232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\StreamIP.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00014976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbscan.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00013952 _____ (Intel Corporation) C:\WINDOWS\system32\Drivers\s24trans.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00012928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usb8023.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00012040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tdpipe.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00011904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sffdisk.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00011392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sfloppy.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00011136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\SLIP.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00011008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sffp_sd.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00008832 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wmiacpi.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00008832 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rasacd.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00007012 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pmemnt.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00006272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\splitter.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00005376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbd.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00004608 _____ C:\WINDOWS\system32\Drivers\TSMAPIP.SYS.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00004442 _____ C:\WINDOWS\system32\Drivers\TPPWRIF.SYS.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00004352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wmilib.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00004352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\swenum.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00004224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdpcdd.sys.bak

2014-01-12 23:20 - 2014-01-12 23:20 - 00002076 _____ C:\Documents and Settings\brothermel.PARK-LAW\Desktop\RKreport[0]_S_01122014_232015.txt

2014-01-12 23:19 - 2014-01-12 23:19 - 05977216 _____ (Intel Corporation) C:\WINDOWS\system32\Drivers\NETw5x32.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 02019232 _____ (Intel Corporation) C:\WINDOWS\system32\Drivers\igxpmp32.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00985472 _____ (Conexant Systems, Inc.) C:\WINDOWS\system32\Drivers\HSF_DPV.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00764416 _____ (Conexant Systems Inc.) C:\WINDOWS\system32\Drivers\CHDAU32.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00731264 _____ (Conexant Systems, Inc.) C:\WINDOWS\system32\Drivers\HSF_CNXT.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00574976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00456320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00329752 _____ (Intel Corporation) C:\WINDOWS\system32\Drivers\iaStor.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00308859 _____ (Cisco Systems, Inc.) C:\WINDOWS\system32\Drivers\CVPNDRVA.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00272128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00265728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00210560 _____ (Conexant Systems, Inc.) C:\WINDOWS\system32\Drivers\HSFHWAZL.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00187776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\acpi.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00182656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00179712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00172416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\kmixer.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00162816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netbt.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00152832 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ipnat.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00144384 _____ (Windows ® Server 2003 DDK provider) C:\WINDOWS\system32\Drivers\hdaudbus.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00143744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00142592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\aec.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00141056 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ks.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00138496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00131984 _____ (Deterministic Networks, Inc.) C:\WINDOWS\system32\Drivers\dne2000.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00129792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fltMgr.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00125056 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ftdisk.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00124000 _____ (Kings Information & Network) C:\WINDOWS\system32\Drivers\kcrtx86.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00120192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pcmcia.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00117800 _____ (Lenovo.) C:\WINDOWS\system32\Drivers\ApsX86.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00116224 _____ (Intel® Corporation) C:\WINDOWS\system32\Drivers\IntcHdmi.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00105472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mup.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00099848 _____ (Sonic Solutions) C:\WINDOWS\system32\Drivers\DRVMCDB.SYS.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00092928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecdd.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00091520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndiswan.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00085248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\NABTSFEC.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00080128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\parport.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ipsec.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00071168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxg.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00068224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00067960 _____ (Citrix Systems, Inc.) C:\WINDOWS\system32\Drivers\ctxusbm.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00063744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cdfs.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00062976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cdrom.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00061824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nic1394.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00061696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ohci1394.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00060800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\arp1394.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00060160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\drmk.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\atmarpc.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00053376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\1394bus.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00052864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\DMusic.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00052480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\i8042prt.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00051768 _____ (Roxio) C:\WINDOWS\system32\Drivers\DRVNDDM.SYS.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00049536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\classpnp.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00044544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fips.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00042368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mountmgr.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00042112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\imapi.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00040960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndproxy.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00037248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\isapnp.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidclass.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00036608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ip6fw.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelppm.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\disk.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00035072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msgpc.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00034688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netbios.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00032896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ipfltdrv.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00032512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwlnkfwd.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00030848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\npfs.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00030080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\modem.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00028120 _____ (Roxio) C:\WINDOWS\system32\Drivers\DLARTL_M.SYS.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00027392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fdc.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00025088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidparse.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00024576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\kbdclass.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00023040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mouclass.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00022312 _____ (Lenovo.) C:\WINDOWS\system32\Drivers\ibmpmdrv.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00020864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ipinip.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00020520 _____ (Lenovo.) C:\WINDOWS\system32\Drivers\ApsHM86.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00020480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\flpydisk.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00020032 _____ (Devguru Co., Ltd) C:\WINDOWS\system32\Drivers\dgderdrv.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00019712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\partmgr.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00019072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msfs.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00018688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cdaudio.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00017024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\CCDECODE.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00015488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mssmbios.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00014592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndisuio.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00014592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\kbdhid.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\asyncmac.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00014208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\battc.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00013952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\CmBatt.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00012856 _____ (Roxio) C:\WINDOWS\system32\Drivers\DLACDBHM.SYS.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00012672 _____ (Conexant) C:\WINDOWS\system32\Drivers\mdmxsdk.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00012416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwlnkflt.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00012160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mouhid.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00011648 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\acpiec.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00011520 _____ (IBM Corp.) C:\WINDOWS\system32\Drivers\ANC.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00011264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\irenum.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00010880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\NdisIP.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00010496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndistapi.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00010496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxapi.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00010368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidusb.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\compbatt.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00008576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\i2omgmt.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00007936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fs_rec.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00007552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\MSKSSRV.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00005760 _____ C:\WINDOWS\system32\Drivers\A0101X32.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00005504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\MSTEE.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00005376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\MSPCLOCK.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00005275 _____ (Cisco Systems, Inc.) C:\WINDOWS\system32\Drivers\CVirtA.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00004992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\MSPQM.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00004224 _____ C:\WINDOWS\system32\Drivers\IBMBLDID.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00004224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mnmdd.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00004224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\beep.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00003456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\oprghdlr.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00003328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgthk.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\audstub.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00002944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\null.sys.bak

2014-01-12 23:19 - 2014-01-12 23:19 - 00002944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\drmkaud.sys.bak

2014-01-12 23:17 - 2014-01-12 23:22 - 00000000 ____D C:\Documents and Settings\brothermel.PARK-LAW\Desktop\RK_Quarantine

2014-01-12 23:15 - 2014-01-16 00:19 - 00002602 _____ C:\Documents and Settings\brothermel.PARK-LAW\Desktop\Rkill.txt

2014-01-12 23:09 - 2014-01-12 23:09 - 03810304 _____ C:\Documents and Settings\brothermel.PARK-LAW\Desktop\RogueKiller.exe

2014-01-12 23:07 - 2014-01-12 23:07 - 00000000 ____D C:\Program Files\ERUNT

2014-01-12 23:07 - 2014-01-12 23:07 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\ERUNT

2014-01-12 23:05 - 2014-01-12 23:05 - 00791393 _____ (Lars Hederer ) C:\Documents and Settings\brothermel.PARK-LAW\Desktop\erunt-setup.exe

2014-01-12 23:03 - 2014-01-12 23:04 - 01933048 _____ (Bleeping Computer, LLC) C:\Documents and Settings\brothermel.PARK-LAW\Desktop\rkill.exe

2014-01-12 19:09 - 2014-01-12 19:09 - 00943416 _____ (SoftForum Co. Ltd.) C:\WINDOWS\system32\CKSetup32.exe

2014-01-12 19:09 - 2014-01-12 19:09 - 00434428 _____ (SoftForum Corporation) C:\WINDOWS\system32\CKCSP.dll

2014-01-12 19:09 - 2014-01-12 19:09 - 00394552 _____ (SoftForum Co., Ltd.) C:\WINDOWS\system32\XecureCK.dll

2014-01-12 19:09 - 2014-01-12 19:09 - 00210272 _____ (SoftForum Co., Ltd.) C:\WINDOWS\system32\npKeyPro.dll

2014-01-12 19:09 - 2014-01-12 19:09 - 00191000 _____ (Kings Information & Network) C:\WINDOWS\system32\kcrypto.dll

2014-01-12 19:09 - 2014-01-12 19:09 - 00181560 _____ (SoftForum Co. Ltd.) C:\WINDOWS\system32\CKApp.dll

2014-01-12 19:09 - 2014-01-12 19:09 - 00152888 _____ (SoftForum Co. Ltd.) C:\WINDOWS\system32\jrsoftcp.dll

2014-01-12 19:09 - 2014-01-12 19:09 - 00126048 _____ (Kings Information & Network) C:\WINDOWS\system32\kcrtx86.sys

2014-01-12 19:09 - 2014-01-12 19:09 - 00124216 ____R (SoftForum Co., Ltd.) C:\WINDOWS\system32\CKAgent.exe

2014-01-12 19:09 - 2014-01-12 19:09 - 00070968 _____ (SoftForm Co. Ltd.) C:\WINDOWS\system32\CKKeyProCert.dll

2014-01-12 19:09 - 2014-01-12 19:09 - 00037944 _____ (SoftForum Corporation) C:\WINDOWS\system32\JRSKD24.SYS

2014-01-12 19:09 - 2014-01-12 19:09 - 00012728 _____ (SoftForum Corporation) C:\WINDOWS\system32\JRSUKD25.SYS

2014-01-11 01:44 - 2014-01-11 01:44 - 00000000 ___HD C:\WINDOWS\yessign

2014-01-11 01:44 - 2014-01-11 01:44 - 00000000 ____D C:\XecureSSL

2014-01-11 01:44 - 2014-01-11 01:44 - 00000000 ____D C:\Program Files\SoftForum

2014-01-11 01:44 - 2014-01-11 01:44 - 00000000 ____D C:\Program Files\NPKI

2014-01-08 11:42 - 2014-01-08 11:42 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage

2014-01-08 10:09 - 2014-01-08 10:09 - 00043520 _____ C:\Documents and Settings\brothermel.PARK-LAW\Desktop\2014-01-06 Weekly Prosecution work load_ByAttorney.xls

2014-01-04 15:34 - 2014-01-04 15:34 - 00001004 _____ C:\Documents and Settings\All Users\Start Menu\Programs\Citrix Receiver.lnk

2014-01-04 15:31 - 2014-01-04 15:31 - 00000000 ____D C:\Program Files\Common Files\Citrix

2014-01-04 15:27 - 2014-01-08 11:42 - 00004152 _____ C:\WINDOWS\wmsetup.log

2014-01-04 15:27 - 2014-01-04 15:38 - 00001084 _____ C:\WINDOWS\spupdsvc.log

2014-01-04 15:25 - 2014-01-04 15:25 - 00000000 ____D C:\WINDOWS\system32\DRM

2014-01-04 09:31 - 2014-01-04 09:31 - 00000000 ____D C:\Program Files\Dell

2014-01-03 16:42 - 2014-01-03 17:17 - 00000000 ____D C:\WINDOWS\system32\NtmsData

2013-12-29 22:52 - 2013-12-29 22:52 - 00009033 _____ C:\__PatchLink02bd.cab

2013-12-27 09:36 - 2013-12-27 09:36 - 00000425 _____ C:\Documents and Settings\All Users\Desktop\Transfer Folder.lnk

2013-12-27 09:36 - 2013-12-27 09:36 - 00000000 ____D C:\Transfer Folder

==================== One Month Modified Files and Folders =======

2014-01-17 22:29 - 2014-01-17 22:26 - 00027112 _____ C:\Documents and Settings\brothermel.PARK-LAW\Desktop\FRST.txt

2014-01-17 22:26 - 2014-01-17 22:26 - 00000000 ____D C:\FRST

2014-01-17 22:26 - 2011-08-16 08:17 - 00000000 ___RD C:\Documents and Settings\brothermel.PARK-LAW\My Documents\Dropbox

2014-01-17 22:26 - 2011-08-16 08:15 - 00000000 ____D C:\Documents and Settings\brothermel.PARK-LAW\Application Data\Dropbox

2014-01-17 22:25 - 2014-01-16 10:31 - 00000436 _____ C:\WINDOWS\system32\Drivers\etc\hosts.ics

2014-01-17 22:25 - 2009-08-21 06:42 - 00000300 _____ C:\WINDOWS\Tasks\PMTask.job

2014-01-17 22:24 - 2013-12-08 18:11 - 00184233 _____ C:\WINDOWS\setupapi.log

2014-01-17 22:24 - 2012-10-29 08:57 - 00000894 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2014-01-17 22:24 - 2008-07-22 07:01 - 02080356 _____ C:\WINDOWS\WindowsUpdate.log

2014-01-17 22:23 - 2008-07-21 23:58 - 00000157 _____ C:\WINDOWS\wiadebug.log

2014-01-17 22:23 - 2008-07-21 23:58 - 00000049 _____ C:\WINDOWS\wiaservc.log

2014-01-17 22:22 - 2009-09-22 17:09 - 00003120 _____ C:\WINDOWS\system32\ICAutoUpdate.log.bak

2014-01-17 22:22 - 2008-07-22 07:05 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2014-01-17 22:21 - 2013-11-13 00:16 - 01477976 _____ C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

2014-01-17 22:21 - 2011-09-10 02:52 - 00131072 _____ C:\WINDOWS\system32\config\OAlerts.evt

2014-01-17 22:21 - 2011-07-06 02:35 - 00000278 ___SH C:\Documents and Settings\brothermel.PARK-LAW\ntuser.ini

2014-01-17 22:21 - 2008-07-22 07:05 - 00032494 _____ C:\WINDOWS\SchedLgU.Txt

2014-01-17 22:20 - 2011-07-06 02:35 - 00000000 ____D C:\Documents and Settings\brothermel.PARK-LAW

2014-01-17 22:19 - 2014-01-17 22:19 - 00002789 _____ C:\Documents and Settings\brothermel.PARK-LAW\Desktop\JavaRa.log

2014-01-17 22:18 - 2014-01-17 22:17 - 00002789 _____ C:\JavaRa.log

2014-01-17 22:16 - 2014-01-17 22:16 - 00000000 ____D C:\Documents and Settings\brothermel.PARK-LAW\Desktop\RemoveJava

2014-01-17 22:09 - 2014-01-17 22:09 - 01221120 _____ (Farbar) C:\Documents and Settings\brothermel.PARK-LAW\Desktop\FRST.exe

2014-01-17 22:06 - 2014-01-17 22:06 - 00165483 _____ C:\Documents and Settings\brothermel.PARK-LAW\Desktop\JavaRa-1.16-28-5-13.zip

2014-01-17 22:04 - 2011-07-06 23:22 - 00000000 ____D C:\Documents and Settings\brothermel.PARK-LAW\Application Data\Skype

2014-01-17 22:02 - 2012-02-29 03:17 - 00002265 _____ C:\Documents and Settings\All Users\Desktop\Skype.lnk

2014-01-17 21:57 - 2008-07-22 07:50 - 00002278 _____ C:\WINDOWS\system32\wpa.dbl

2014-01-17 21:33 - 2012-10-29 08:57 - 00000898 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2014-01-17 16:00 - 2010-06-19 22:46 - 00000332 _____ C:\WINDOWS\Tasks\SystemToolsDailyTest.job

2014-01-16 15:57 - 2011-08-16 08:15 - 00000000 ____D C:\Documents and Settings\brothermel.PARK-LAW\Start Menu\Programs\Dropbox

2014-01-16 15:39 - 2013-11-13 00:00 - 00000000 ____D C:\WINDOWS\system32\MRT

2014-01-16 15:34 - 2010-01-02 21:59 - 83425928 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2014-01-16 15:31 - 2014-01-16 15:31 - 00004354 _____ C:\WINDOWS\KB2914368.log

2014-01-16 15:31 - 2014-01-16 15:31 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2914368$

2014-01-16 15:31 - 2013-12-11 23:16 - 00047339 _____ C:\WINDOWS\iis6.log

2014-01-16 15:31 - 2013-12-11 23:16 - 00043118 _____ C:\WINDOWS\FaxSetup.log

2014-01-16 15:31 - 2013-12-11 23:16 - 00020692 _____ C:\WINDOWS\ocgen.log

2014-01-16 15:31 - 2013-12-11 23:16 - 00019752 _____ C:\WINDOWS\tsoc.log

2014-01-16 15:31 - 2013-12-11 23:16 - 00014566 _____ C:\WINDOWS\comsetup.log

2014-01-16 15:31 - 2013-12-11 23:16 - 00013454 _____ C:\WINDOWS\msmqinst.log

2014-01-16 15:31 - 2013-12-11 23:16 - 00008808 _____ C:\WINDOWS\ntdtcsetup.log

2014-01-16 15:31 - 2013-12-11 23:16 - 00007581 _____ C:\WINDOWS\netfxocm.log

2014-01-16 15:31 - 2013-12-11 23:16 - 00002975 _____ C:\WINDOWS\MedCtrOC.log

2014-01-16 15:31 - 2013-12-11 23:16 - 00002394 _____ C:\WINDOWS\ocmsn.log

2014-01-16 15:31 - 2013-12-11 23:16 - 00002177 _____ C:\WINDOWS\tabletoc.log

2014-01-16 15:31 - 2013-12-11 23:16 - 00002163 _____ C:\WINDOWS\msgsocm.log

2014-01-16 15:31 - 2013-12-11 23:16 - 00001374 _____ C:\WINDOWS\imsins.log

2014-01-16 10:34 - 2008-07-21 23:55 - 00529108 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2014-01-16 02:06 - 2013-11-21 14:00 - 00000000 ____D C:\Program Files\ForeScout SecureConnector

2014-01-16 00:19 - 2014-01-12 23:15 - 00002602 _____ C:\Documents and Settings\brothermel.PARK-LAW\Desktop\Rkill.txt

2014-01-15 23:45 - 2012-02-29 03:04 - 00002108 ____H C:\Documents and Settings\brothermel.PARK-LAW\My Documents\Default.rdp

2014-01-15 23:13 - 2009-09-22 02:51 - 00000000 ____D C:\WINDOWS\system32\FxsTmp

2014-01-15 10:11 - 2013-11-02 05:25 - 00000000 ____D C:\Documents and Settings\brothermel.PARK-LAW\My Documents\Pantech

2014-01-15 09:51 - 2013-11-23 22:10 - 00000000 ____D C:\Documents and Settings\brothermel.PARK-LAW\Application Data\SlickVPN

2014-01-14 23:28 - 2014-01-14 23:28 - 00095010 _____ C:\Documents and Settings\brothermel.PARK-LAW\Desktop\2014-01-14 Good Faith in Settlement v1.pptx

2014-01-14 10:55 - 2011-07-28 23:00 - 00000000 ____D C:\Documents and Settings\brothermel.PARK-LAW\Local Settings\Application Data\CutePDF Writer

2014-01-14 01:05 - 2014-01-14 01:05 - 00044032 _____ C:\Documents and Settings\brothermel.PARK-LAW\Desktop\2014-01-13 Weekly Prosecution work load_ByAttorney.xls

2014-01-13 21:35 - 2014-01-13 21:35 - 00036513 _____ C:\ComboFix.txt

2014-01-13 21:35 - 2012-09-28 13:18 - 00000000 ____D C:\Qoobox

2014-01-13 21:31 - 2008-07-22 07:50 - 00000227 _____ C:\WINDOWS\system.ini

2014-01-13 21:15 - 2014-01-13 21:15 - 00000000 _RSHD C:\cmdcons

2014-01-13 21:15 - 2008-07-22 07:50 - 00000327 __RSH C:\boot.ini

2014-01-13 16:44 - 2014-01-13 17:32 - 05166068 ____R (Swearware) C:\Documents and Settings\brothermel.PARK-LAW\Desktop\ComboFix.exe

2014-01-12 23:22 - 2014-01-12 23:17 - 00000000 ____D C:\Documents and Settings\brothermel.PARK-LAW\Desktop\RK_Quarantine