ie redirects &https Tidserv Request 2

papawana · October 18, 2010

when I use IE some of the time I get redirected to a place that I did not click on...also Norton keeps blocking attacks...https Tidserv Request 2...it is very aggravating...so here goes:

dds.txt

DDS (Ver_10-10-10.03) - NTFS_AMD64

Run by Em at 3:21:25.49 on Mon 10/18/2010

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_18

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.16382.14165 [GMT -4:00]

============== Running Processes ===============

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\ATKFUSService.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\atieclxx.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

C:\Program Files\ASUS\GamerOSD\ATKFastUserSwitching.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\SysWOW64\ASDR.exe

C:\Program Files (x86)\ASUS\TurboV EVO\TurboVHELP.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe

C:\Program Files (x86)\Common Files\Motive\McciCMService.exe

C:\Program Files (x86)\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Program Files (x86)\Common Files\Intel\Intel Extreme Tuning Utility\PerfTuneService.exe

C:\Program Files (x86)\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\SearchIndexer.exe

C:\ProgramData\Norton\NUA.exe

C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe

C:\Program Files (x86)\ASUS\AI Suite\QFan3\QFanHelp.exe

C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe

C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

C:\Windows\SysWOW64\rundll32.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\mIRC\mirc.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

C:\Windows\system32\AUDIODG.EXE

C:\Users\Em\Desktop\Defogger.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Users\Em\Desktop\dds.scr

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Bar = Preserve

uStart Page = hxxp://www.foxnews.com/

uURLSearchHooks: ToolbarURLSearchHook Class: {ca3eb689-8f09-4026-aa10-b9534c691ce0} - C:\Program Files (x86)\Search Toolbar\tbhelper.dll

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton AntiVirus\Engine\17.8.0.5\IPSBHO.DLL

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

{d2ce3e00-f94a-4740-988e-03dc2f38c34f}

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: Norton Safe Web Lite BHO: {f0da78e9-6b60-42fb-bc26-ef2cfb8c8ff3} - C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.0.1.8\coIEPlg.dll

BHO: TBSB05974 Class: {fcbccb87-9224-4b8d-b117-f56d924beb18} - C:\Program Files (x86)\Search Toolbar\tbcore3.dll

TB: Search Toolbar: {0c8413c1-fad1-446c-8584-be50576f863e} - C:\Program Files (x86)\Search Toolbar\tbcore3.dll

TB: Norton Safe Web Lite: {30ceeea2-3742-40e4-85dd-812bf1cbb83d} - C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.0.1.8\coIEPlg.dll

{8dcb7100-df86-4384-8842-8fa844297b3f}

{555d4d79-4bd2-4094-a395-cfc534424a05}

uRun: [NortonUpdateAgent] C:\ProgramData\Norton\NUA.exe

mRun: [bCU] "C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe"

mRun: [QFan Help] "C:\Program Files (x86)\ASUS\AI Suite\QFan3\QFanHelp.exe"

mRun: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r

mRun: [bing Bar] "C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe"

mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume

mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

mRun: [P17RunE] RunDll32 P17RunE.dll,RunDLLEntry

mRun: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe

mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

DPF: vzTCPConfig - hxxp://my.verizon.com/micro/speedoptimizer/fios/vzTCPConfig.CAB

DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab

DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

SEH: Eudora's Shell Extension: {edb0e980-90bd-11d4-8599-0008c7d3b6f8} - C:\Program Files (x86)Eudora\EuShlExt.dll

mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"

TB-X64: {0C8413C1-FAD1-446C-8584-BE50576F863E} - No File

TB-X64: {30CEEEA2-3742-40E4-85DD-812BF1CBB83D} - No File

EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File

============= SERVICES / DRIVERS ===============

R0 mv91xx;mv91xx;C:\Windows\System32\drivers\mv91xx.sys [2010-6-30 293416]

R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\NAVx64\1108000.005\symds64.sys [2010-9-23 433200]

R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\NAVx64\1108000.005\symefa64.sys [2010-9-23 221232]

R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\BASHDefs\20101001.001\BHDrvx64.sys [2010-10-5 954928]

R1 ccHP;Symantec Hash Provider;C:\Windows\System32\drivers\NAVx64\1108000.005\cchpx64.sys [2010-9-23 615040]

R1 EIO64;EIO Driver;C:\Windows\System32\drivers\EIO64.sys [2010-10-6 16384]

R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\IPSDefs\20101015.003\IDSviA64.sys [2010-10-13 476720]

R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\NAVx64\1108000.005\ironx64.sys [2010-9-23 150064]

R1 SYMTDIv;Symantec Vista Network Dispatch Driver;C:\Windows\System32\drivers\NAVx64\1108000.005\symtdiv.sys [2010-9-23 451120]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-2-26 202752]

R2 AsSysCtrlService;ASUS System Control Service;C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [2010-2-27 90112]

R2 BCUService;Browser Configuration Utility Service;C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-26 223464]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-9-25 13336]

R2 IOCBIOS;IOCBIOS;C:\ProgramData\Intel\Extreme Tuning Utility\IOCbios\64bit\iOCbios.sys [2009-7-9 27096]

R2 NAV;Norton AntiVirus;C:\Program Files (x86)\Norton AntiVirus\Engine\17.8.0.5\ccsvchst.exe [2010-9-23 126392]

R2 NSL;Norton Safe Web Lite;C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe [2010-8-22 126904]

R2 XTUService;Intel® Extreme Tuning Utility;C:\Program Files (x86)\Common Files\Intel\Intel Extreme Tuning Utility\PerfTuneService.exe [2009-8-6 30944]

R3 amdkmdag;amdkmdag;C:\Windows\System32\drivers\atipmdag.sys [2010-2-26 6369792]

R3 amdkmdap;amdkmdap;C:\Windows\System32\drivers\atikmpag.sys [2010-2-26 188928]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-9-22 132656]

R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2009-10-27 75264]

R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2009-10-27 176640]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2010-6-23 344680]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 SgtSch2Svc;Seagate Scheduler2 Service;"C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe" --> C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe [?]

S3 cpudrv64;cpudrv64;C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [2009-12-18 17864]

S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;"C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe" --> C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [?]

S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2010-9-21 79360]

S3 rcmirror;rcmirror;C:\Windows\System32\drivers\rcmirror.sys [2010-1-18 4608]

S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]

S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;C:\Windows\System32\drivers\viahduaa.sys [2009-9-17 1250816]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-2-27 1255736]

S4 PCPitstop Scheduling;PCPitstop Scheduling;C:\Program Files (x86)\PCPitstop\PCPitstopScheduleService.exe --> C:\Program Files (x86)\PCPitstop\PCPitstopScheduleService.exe [?]

=============== Created Last 30 ================

2010-10-18 05:30:37 -------- d-----w- C:\Users\Em\AppData\Roaming\Malwarebytes

2010-10-18 05:30:27 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys

2010-10-18 05:30:26 24664 ----a-w- C:\Windows\System32\drivers\mbam.sys

2010-10-18 05:30:26 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2010-10-18 05:30:26 -------- d-----w- C:\PROGRA~3\Malwarebytes

2010-10-17 19:11:12 81952 ----a-w- C:\Windows\System32\drivers\tifsfilt.sys

2010-10-17 19:11:12 -------- d-----w- C:\PROGRA~3\Seagate

2010-10-17 19:11:11 711712 ----a-w- C:\Windows\System32\drivers\timntr.sys

2010-10-17 19:11:11 235040 ----a-w- C:\Windows\System32\drivers\snapman.sys

2010-10-17 19:11:05 593952 ----a-w- C:\Windows\System32\drivers\tdrpman.sys

2010-10-13 20:55:07 148992 ----a-w- C:\Windows\System32\t2embed.dll

2010-10-13 20:55:07 109056 ----a-w- C:\Windows\SysWow64\t2embed.dll

2010-10-13 20:54:39 4582912 ----a-w- C:\Program Files\Windows NT\Accessories\wordpad.exe

2010-10-13 20:54:38 4247040 ----a-w- C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe

2010-10-13 20:54:38 2085376 ----a-w- C:\Windows\System32\ole32.dll

2010-10-13 20:54:38 1413632 ----a-w- C:\Windows\SysWow64\ole32.dll

2010-10-13 20:54:07 483840 ----a-w- C:\Windows\System32\StructuredQuery.dll

2010-10-13 20:54:07 363520 ----a-w- C:\Windows\SysWow64\StructuredQuery.dll

2010-10-13 20:53:39 340992 ----a-w- C:\Windows\System32\schannel.dll

2010-10-13 20:53:39 224256 ----a-w- C:\Windows\SysWow64\schannel.dll

2010-10-13 20:53:10 633856 ----a-w- C:\Windows\System32\comctl32.dll

2010-10-13 20:53:10 530432 ----a-w- C:\Windows\SysWow64\comctl32.dll

2010-10-13 20:52:42 738816 ----a-w- C:\Windows\SysWow64\wmpmde.dll

2010-10-13 20:52:42 1024512 ----a-w- C:\Windows\System32\wmpmde.dll

2010-10-13 20:52:14 954752 ----a-w- C:\Windows\SysWow64\mfc40.dll

2010-10-13 20:52:14 954288 ----a-w- C:\Windows\SysWow64\mfc40u.dll

2010-10-13 20:50:39 9728 ----a-w- C:\Windows\SysWow64\sscore.dll

2010-10-13 20:50:39 463360 ----a-w- C:\Windows\System32\drivers\srv.sys

2010-10-13 20:50:39 402944 ----a-w- C:\Windows\System32\drivers\srv2.sys

2010-10-13 20:50:39 236032 ----a-w- C:\Windows\System32\srvsvc.dll

2010-10-13 20:50:39 161792 ----a-w- C:\Windows\System32\drivers\srvnet.sys

2010-10-13 20:50:10 3123712 ----a-w- C:\Windows\System32\win32k.sys

2010-10-06 05:02:09 16384 ----a-w- C:\Windows\System32\drivers\EIO64.sys

2010-10-03 15:51:33 44544 ----a-w- C:\Windows\SysWow64\GIF89.DLL

2010-10-03 15:51:33 40960 ----a-w- C:\Windows\SysWow64\SSubTmr6.dll

2010-10-03 15:51:33 200704 ----a-w- C:\Windows\SysWow64\vbalExpBar6.ocx

2010-10-03 15:51:33 15360 ----a-w- C:\Windows\SysWow64\inetfr.DLL

2010-10-03 15:51:33 141312 ----a-w- C:\Windows\SysWow64\MSCMCFR.DLL

2010-10-03 15:51:33 119568 ----a-w- C:\Windows\SysWow64\VB6FR.DLL

2010-10-03 15:51:33 115920 ----a-w- C:\Windows\SysWow64\msinet.OCX

2010-10-03 15:51:33 101888 ----a-w- C:\Windows\SysWow64\VB6STKIT.DLL

2010-10-03 15:51:32 484352 ----a-w- C:\Windows\SysWow64\lame_enc.dll

2010-10-03 15:51:32 32768 ----a-w- C:\Windows\SysWow64\CMDLGFR.DLL

2010-10-03 15:51:32 152848 ----a-w- C:\Windows\SysWow64\COMDLG32.OCX

2010-10-03 15:51:32 -------- d-----w- C:\Users\Em\AppData\Roaming\FreeBurner

2010-10-03 15:51:32 -------- d-----w- C:\Program Files (x86)\Free Easy Burner

2010-10-02 08:51:59 -------- d-----w- C:\Program Files\Microsoft IntelliType Pro

2010-10-02 08:51:58 -------- d-----w- C:\Windows\PCHEALTH

2010-09-29 07:00:28 243712 ----a-w- C:\Windows\System32\drivers\ks.sys

2010-09-29 05:36:50 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

2010-09-29 05:36:50 2048 ----a-w- C:\Windows\System32\tzres.dll

2010-09-29 05:36:16 13312 ----a-w- C:\Program Files\Internet Explorer\iecompat.dll

2010-09-29 05:36:16 13312 ----a-w- C:\Program Files (x86)\Internet Explorer\iecompat.dll

2010-09-27 22:05:21 -------- d-----w- C:\PROGRA~3\EPU

2010-09-25 07:23:08 -------- d-----w- C:\Users\Em\AppData\Roaming\Intel Corporation

2010-09-25 07:21:14 540696 ----a-w- C:\Windows\System32\drivers\iaStor.sys

2010-09-25 06:13:31 315904 ----a-w- C:\Windows\SysWow64\Difx119c.rra

2010-09-25 06:13:31 -------- d-----w- C:\RaidTool

2010-09-23 23:06:26 615040 ----a-w- C:\Windows\System32\drivers\NAVx64\1108000.005\cchpx64.sys

2010-09-23 23:06:26 505392 ----a-w- C:\Windows\System32\drivers\NAVx64\1108000.005\srtsp64.sys

2010-09-23 23:06:26 451120 ----a-w- C:\Windows\System32\drivers\NAVx64\1108000.005\symtdiv.sys

2010-09-23 23:06:26 433200 ----a-r- C:\Windows\System32\drivers\NAVx64\1108000.005\symds64.sys

2010-09-23 23:06:26 32304 ----a-w- C:\Windows\System32\drivers\NAVx64\1108000.005\srtspx64.sys

2010-09-23 23:06:26 221232 ----a-w- C:\Windows\System32\drivers\NAVx64\1108000.005\symefa64.sys

2010-09-23 23:06:26 150064 ----a-w- C:\Windows\System32\drivers\NAVx64\1108000.005\ironx64.sys

2010-09-23 22:46:57 -------- d-----w- C:\Windows\System32\drivers\NAVx64\1108000.005

2010-09-22 22:10:52 103864 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\nppdf32.dll

2010-09-22 10:20:25 -------- d-----w- C:\Program Files (x86)\Common Files\Symantec Shared

2010-09-22 08:55:54 173104 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS

2010-09-22 08:55:51 -------- d-----w- C:\Program Files\Symantec

2010-09-22 08:55:32 -------- d-----w- C:\Program Files (x86)\Norton AntiVirus

2010-09-21 13:11:28 -------- d-----w- C:\Program Files\Creative

2010-09-21 13:11:19 -------- d-----w- C:\Program Files (x86)\Common Files\Creative

2010-09-21 13:11:16 -------- d-----w- C:\Program Files (x86)\Common Files\Creative Labs Shared

==================== Find3M ====================

2010-09-21 13:11:17 419840 ----a-w- C:\Windows\System32\wrap_oal.dll

2010-09-21 13:11:17 413696 ----a-w- C:\Windows\SysWow64\wrap_oal.dll

2010-09-21 13:11:17 133632 ----a-w- C:\Windows\System32\OpenAL32.dll

2010-09-21 13:11:17 110592 ----a-w- C:\Windows\SysWow64\OpenAL32.dll

2010-09-08 05:36:17 1192960 ----a-w- C:\Windows\System32\wininet.dll

2010-09-08 05:34:34 57856 ----a-w- C:\Windows\System32\licmgr10.dll

2010-09-08 04:30:04 978432 ----a-w- C:\Windows\SysWow64\wininet.dll

2010-09-08 04:28:15 44544 ----a-w- C:\Windows\SysWow64\licmgr10.dll

2010-09-08 04:16:38 482816 ----a-w- C:\Windows\System32\html.iec

2010-09-08 03:35:30 1638912 ----a-w- C:\Windows\System32\mshtml.tlb

2010-09-08 03:22:31 386048 ----a-w- C:\Windows\SysWow64\html.iec

2010-09-08 02:48:16 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2010-09-01 05:12:09 12625920 ----a-w- C:\Windows\System32\wmploc.DLL

2010-09-01 04:23:49 12625408 ----a-w- C:\Windows\SysWow64\wmploc.DLL

2010-08-26 19:59:52 16896 ----a-w- C:\Windows\AsTaskSched.dll

2010-08-21 06:29:47 558592 ----a-w- C:\Windows\System32\spoolsv.exe

2010-07-29 06:30:34 82944 ----a-w- C:\Windows\SysWow64\iccvid.dll

2010-07-21 20:59:28 592272 ----a-w- C:\Windows\System32\ipcoin80.dll

============= FINISH: 3:21:49.49 ===============

malwarebytes Log

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4867

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

10/18/2010 3:17:20 AM

mbam-log-2010-10-18 (03-17-20).txt

Scan type: Quick scan

Objects scanned: 142170

Time elapsed: 2 minute(s), 13 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

the ark log showed absolutly nothing

thank you very much for your assistance

Elise · October 19, 2010

Hello ,

And My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

Please download OTL from one of the following mirrors:
- This is THE Mirror
[*]Save it to your desktop.
[*]Double click on the icon on your desktop.
[*]Click the "Scan All Users" checkbox.
[*]Push the Quick Scan button.
[*]Two reports will open, copy and paste them in a reply here:
- OTListIt.txt <-- Will be opened
- Extra.txt <-- Will be minimized

Please download Rootkit Unhooker and save it to your Desktop

Double-click on RKUnhookerLE to run it
Click the Report tab, then click Scan
Check Drivers, Stealth and uncheck the rest
Click OK
Wait until it's finished and then go to File > Save Report
Save the report to your Desktop

Copy the entire contents of the report and paste it in a reply here.

Note - you may get this warning it is ok, just ignore: "Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

A detailed description of your problems
A new OTL log (don't forget extra.txt)
RKU log

Thanks and again sorry for the delay.

papawana · October 19, 2010

OTL logfile created on: 10/19/2010 9:05:31 AM - Run 2

OTL by OldTimer - Version 3.2.15.2 Folder = C:\Users\Em\Desktop

64bit- An unknown product (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

16.00 Gb Total Physical Memory | 14.00 Gb Available Physical Memory | 85.00% Memory free

32.00 Gb Paging File | 29.00 Gb Available in Paging File | 91.00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 59.62 Gb Total Space | 10.48 Gb Free Space | 17.57% Space Free | Partition Type: NTFS

Drive D: | 931.51 Gb Total Space | 510.45 Gb Free Space | 54.80% Space Free | Partition Type: NTFS

Drive E: | 931.51 Gb Total Space | 801.51 Gb Free Space | 86.04% Space Free | Partition Type: NTFS

Computer Name: EM-PC | User Name: Em | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days

========== Processes (SafeList) ==========

PRC - [2010/10/19 08:30:37 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Em\Desktop\OTL.exe

PRC - [2010/10/13 08:57:50 | 003,238,488 | ---- | M] (mIRC Co. Ltd.) -- C:\mIRC\mirc.exe

PRC - [2010/09/01 02:39:18 | 001,164,584 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

PRC - [2010/07/23 01:05:56 | 000,126,904 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe

PRC - [2010/05/23 01:39:05 | 000,126,904 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe

PRC - [2010/04/27 16:39:38 | 000,243,544 | ---- | M] (Microsoft Corp.) -- C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe

PRC - [2010/03/03 20:16:06 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

PRC - [2010/03/03 20:16:04 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

PRC - [2010/01/19 20:43:02 | 001,060,992 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\TurboV EVO\TurboVHelp.exe

PRC - [2009/10/26 17:16:00 | 000,223,464 | ---- | M] (DeviceVM, Inc.) -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe

PRC - [2009/10/26 17:15:56 | 000,375,000 | ---- | M] (DeviceVM, Inc.) -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe

PRC - [2009/08/19 16:44:56 | 000,603,136 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite\QFan3\QFanHelp.exe

PRC - [2009/08/19 07:56:38 | 000,090,112 | R--- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

PRC - [2009/08/06 08:55:22 | 000,030,944 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Common Files\Intel\Intel Extreme Tuning Utility\PerfTuneService.exe

PRC - [2009/07/27 11:13:28 | 000,061,440 | ---- | M] () -- C:\Windows\SysWOW64\ASDR.exe

PRC - [2008/11/18 13:15:30 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

PRC - [2006/10/03 16:15:44 | 002,658,304 | ---- | M] (QUALCOMM Incorporated) -- C:\Program Files (x86)Eudora\Eudora.exe

========== Modules (SafeList) ==========

MOD - [2010/10/19 08:30:37 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Em\Desktop\OTL.exe

MOD - [2010/08/21 01:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll

MOD - [2009/07/13 21:15:31 | 000,154,624 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\imagehlp.dll

MOD - [2009/07/13 21:09:00 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\normaliz.dll

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2010/02/26 03:07:54 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2009/12/01 14:22:58 | 000,063,488 | ---- | M] (ASUSTeK COMPUTER INC.) [Auto | Running] -- C:\Windows\SysNative\ATKFUSService.exe -- (ATKFUSService)

SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV:64bit: - [2009/07/13 21:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV - [2010/09/21 09:11:16 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)

SRV - [2010/07/23 01:05:56 | 000,126,904 | R--- | M] (Symantec Corporation) [unknown | Running] -- C:\Program Files (x86)\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe -- (NAV)

SRV - [2010/05/23 01:39:05 | 000,126,904 | R--- | M] (Symantec Corporation) [unknown | Running] -- C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe -- (NSL)

SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010/03/03 20:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel®

SRV - [2009/10/26 17:16:00 | 000,223,464 | ---- | M] (DeviceVM, Inc.) [Auto | Running] -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe -- (BCUService)

SRV - [2009/08/19 07:56:38 | 000,090,112 | R--- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe -- (AsSysCtrlService)

SRV - [2009/08/06 08:55:22 | 000,030,944 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Intel\Intel Extreme Tuning Utility\PerfTuneService.exe -- (XTUService) Intel®

SRV - [2009/07/27 11:13:28 | 000,061,440 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\ASDR.exe -- (ASDR)

SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2008/11/18 13:15:30 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)

========== Driver Services (SafeList) ==========

DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\vmnetadapter.sys -- (VMnetAdapter)

DRV:64bit: - [2010/10/18 10:00:48 | 000,174,640 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent)

DRV:64bit: - [2010/10/17 15:11:12 | 000,711,712 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\timntr.sys -- (timounter)

DRV:64bit: - [2010/10/17 15:11:12 | 000,081,952 | ---- | M] (Acronis) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\tifsfilt.sys -- (tifsfilter)

DRV:64bit: - [2010/10/06 01:02:09 | 000,016,384 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\EIO64.sys -- (EIO64)

DRV:64bit: - [2010/08/10 17:29:14 | 000,120,920 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID)

DRV:64bit: - [2010/07/21 16:59:28 | 000,045,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)

DRV:64bit: - [2010/07/01 17:52:18 | 000,051,600 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d)

DRV:64bit: - [2010/06/30 22:01:38 | 000,293,416 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mv91xx.sys -- (mv91xx)

DRV:64bit: - [2010/06/30 00:10:58 | 000,023,952 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nuidfltr.sys -- (NuidFltr)

DRV:64bit: - [2010/06/23 09:10:56 | 000,344,680 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2010/03/03 19:51:40 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2010/02/26 03:22:38 | 006,369,792 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)

DRV:64bit: - [2010/02/26 03:22:38 | 006,369,792 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atipmdag.sys -- (amdkmdag)

DRV:64bit: - [2010/02/26 02:12:10 | 000,188,928 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)

DRV:64bit: - [2010/01/28 18:33:38 | 000,116,736 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)

DRV:64bit: - [2010/01/18 20:40:26 | 000,004,608 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rcmirror.sys -- (rcmirror)

DRV:64bit: - [2009/10/27 03:19:48 | 000,176,640 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)

DRV:64bit: - [2009/10/27 03:19:46 | 000,075,264 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)

DRV:64bit: - [2009/10/16 10:44:56 | 001,309,696 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\P17.sys -- (P17)

DRV:64bit: - [2009/09/17 19:04:18 | 001,250,816 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService)

DRV:64bit: - [2009/07/15 23:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)

DRV:64bit: - [2009/07/13 21:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2009/07/13 21:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009/07/13 21:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)

DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009/05/13 15:31:02 | 000,063,616 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\intelsmb.sys -- (smbusp) Intel®

DRV:64bit: - [2009/02/17 18:22:22 | 000,039,424 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATKDispLowFilter.sys -- (atkdisplf)

DRV:64bit: - [2009/02/17 18:22:22 | 000,017,792 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asusgsb.sys -- (asusgsb)

DRV - [2010/10/17 01:00:00 | 001,804,336 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20101018.054\EX64.SYS -- (NAVEX15)

DRV - [2010/10/17 01:00:00 | 000,117,808 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20101018.054\ENG64.SYS -- (NAVENG)

DRV - [2010/10/13 15:59:27 | 000,476,720 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20101015.005\IDSviA64.sys -- (IDSVia64)

DRV - [2010/09/22 04:57:47 | 000,475,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)

DRV - [2010/09/22 04:57:47 | 000,132,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)

DRV - [2010/08/31 18:57:03 | 000,954,928 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20101001.001\BHDrvx64.sys -- (BHDrvx64)

DRV - [2010/03/17 16:53:38 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Motive\MREMP50.sys -- (MREMP50)

DRV - [2010/03/17 16:53:22 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Motive\MRESP50.sys -- (MRESP50)

DRV - [2009/12/18 10:58:52 | 000,017,864 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys -- (cpudrv64)

DRV - [2009/07/09 10:53:00 | 000,027,096 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\ProgramData\Intel\Extreme Tuning Utility\IOCbios\64bit\iOCbios.sys -- (IOCBIOS)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1222173880-4280229480-1958654446-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/

IE - HKU\S-1-5-21-1222173880-4280229480-1958654446-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us

IE - HKU\S-1-5-21-1222173880-4280229480-1958654446-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 30 BF 22 43 34 C9 CA 01 [binary data]

IE - HKU\S-1-5-21-1222173880-4280229480-1958654446-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.foxnews.com/

IE - HKU\S-1-5-21-1222173880-4280229480-1958654446-1001\..\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files (x86)\Search Toolbar\tbhelper.dll ()

IE - HKU\S-1-5-21-1222173880-4280229480-1958654446-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{203FB6B2-2E1E-4474-863B-4C483ECCE78E}: C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_1.0.1.8\coFFNST\ [2010/08/22 22:30:43 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1449.0\Firefox

FF - HKLM\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010/09/15 16:25:02 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\IPSFFPlgn\ [2010/10/18 10:25:28 | 000,000,000 | ---D | M]

[2010/06/13 07:10:52 | 000,000,000 | ---D | M] -- C:\Users\Em\AppData\Roaming\Mozilla\Extensions

[2010/02/27 08:43:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Em\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.

O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton AntiVirus\Engine\18.1.0.37\IPSBHO.dll (Symantec Corporation)

O2 - BHO: (no name) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - Reg Error: Value error. File not found

O2 - BHO: (Norton Safe Web Lite BHO) - {F0DA78E9-6B60-42fb-BC26-EF2CFB8C8FF3} - C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.0.1.8\CoIEPlg.dll (Symantec Corporation)

O2 - BHO: (TBSB05974 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files (x86)\Search Toolbar\tbcore3.dll ()

O3 - HKLM\..\Toolbar: (Search Toolbar) - {0C8413C1-FAD1-446C-8584-BE50576F863E} - C:\Program Files (x86)\Search Toolbar\tbcore3.dll ()

O3 - HKLM\..\Toolbar: (Norton Safe Web Lite) - {30CEEEA2-3742-40e4-85DD-812BF1CBB83D} - C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.0.1.8\CoIEPlg.dll (Symantec Corporation)

O3 - HKLM\..\Toolbar: (no name) - {8dcb7100-df86-4384-8842-8fa844297b3f} - Reg Error: Value error. File not found

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKU\S-1-5-21-1222173880-4280229480-1958654446-1001\..\Toolbar\WebBrowser: (Search Toolbar) - {0C8413C1-FAD1-446C-8584-BE50576F863E} - C:\Program Files (x86)\Search Toolbar\tbcore3.dll ()

O3 - HKU\S-1-5-21-1222173880-4280229480-1958654446-1001\..\Toolbar\WebBrowser: (Norton Safe Web Lite) - {30CEEEA2-3742-40E4-85DD-812BF1CBB83D} - C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.0.1.8\CoIEPlg.dll (Symantec Corporation)

O4 - HKLM..\Run: [bCU] C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)

O4 - HKLM..\Run: [bing Bar] C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe (Microsoft Corp.)

O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()

O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)

O4 - HKLM..\Run: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)

O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()

O4 - HKLM..\Run: [P17RunE] C:\Windows\SysWow64\P17RunE.dll (Creative Technology Ltd.)

O4 - HKLM..\Run: [QFan Help] C:\Program Files (x86)\ASUS\AI Suite\QFan3\QFanHelp.exe (ASUSTeK Computer Inc.)

O4 - HKU\S-1-5-19..\Run: [sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKU\S-1-5-21-1222173880-4280229480-1958654446-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O13 - gopher Prefix: missing

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co...ex/qtplugin.cab (Reg Error: Key error.)

O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} http://cdn.scan.onecare.live.com/resource/...s/wlscctrl2.cab (Windows Live OneCare safety scanner control)

O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/inst...tDetection2.cab (Reg Error: Key error.)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O16 - DPF: vzTCPConfig http://my.verizon.com/micro/speedoptimizer...vzTCPConfig.CAB (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O28 - HKLM ShellExecuteHooks: {EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - C:\Program Files (x86)Eudora\EuShlExt.dll (Qualcomm Inc.)

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{faebca53-c052-11df-ac6c-806e6f6e6963}\Shell - "" = AutoRun

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2010/10/19 08:30:36 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Users\Em\Desktop\OTL.exe

[2010/10/18 01:30:37 | 000,000,000 | ---D | C] -- C:\Users\Em\AppData\Roaming\Malwarebytes

[2010/10/18 01:30:27 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys

[2010/10/18 01:30:26 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2010/10/18 01:30:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2010/10/18 01:30:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2010/10/17 15:11:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Seagate

[2010/10/06 01:20:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe

[2010/10/06 01:02:09 | 000,016,384 | ---- | C] (ASUSTeK Computer Inc.) -- C:\Windows\SysNative\drivers\EIO64.sys

[2010/10/06 01:01:49 | 005,473,280 | ---- | C] (ASUSTeK COMPUTER INC.) -- C:\Windows\SysNative\ATKOSDX64.dll

[2010/10/06 01:01:49 | 005,463,552 | ---- | C] (ASUSTeK COMPUTER INC.) -- C:\Windows\SysWow64\ATKOSDX32.dll

[2010/10/06 01:01:49 | 002,210,304 | ---- | C] (ASUSTeK COMPUTER INC.) -- C:\Windows\SysNative\ATKDispCPL.dll

[2010/10/06 01:01:49 | 001,354,240 | ---- | C] (ASUSTeK Computer Inc.) -- C:\Windows\SysNative\atklumdispx.dll

[2010/10/06 01:01:49 | 000,150,528 | ---- | C] (ASUSTeK Computer Inc.) -- C:\Windows\SysNative\atkdxtdispx.dll

[2010/10/06 01:01:49 | 000,102,400 | ---- | C] (ASUSTeK Computer Inc.) -- C:\Windows\SysWow64\NetVideo_SBS.ax

[2010/10/06 01:01:49 | 000,063,488 | ---- | C] (ASUSTeK COMPUTER INC.) -- C:\Windows\SysNative\ATKFUSService.exe

[2010/10/06 01:01:49 | 000,039,424 | ---- | C] (ASUSTeK Computer Inc.) -- C:\Windows\SysNative\ATKDispLowFilter.sys

[2010/10/06 01:01:49 | 000,017,792 | ---- | C] (ASUSTeK Computer Inc.) -- C:\Windows\SysNative\asusgsb.sys

[2010/10/06 01:01:49 | 000,016,896 | ---- | C] (ASUSTeK COMPUTER INC.) -- C:\Windows\SysNative\ATKOGL64.dll

[2010/10/06 01:01:49 | 000,015,360 | ---- | C] (ASUSTeK COMPUTER INC.) -- C:\Windows\SysWow64\ATKOGL32.dll

[2010/10/06 01:01:49 | 000,000,000 | ---D | C] -- C:\Program Files\ASUS

[2010/10/06 01:01:48 | 001,335,808 | ---- | C] (ASUSTeK Computer Inc.) -- C:\Windows\SysWow64\ATKLUMDISP.dll

[2010/10/06 01:01:48 | 000,134,144 | ---- | C] (ASUSTeK Computer Inc.) -- C:\Windows\SysWow64\atkdxtdisp.dll

[2010/10/06 01:01:48 | 000,102,400 | ---- | C] (ASMedia Techonology) -- C:\Windows\ASMT_CE.dll

[2010/10/06 01:01:48 | 000,071,680 | ---- | C] (ASMedia Technology) -- C:\Windows\i2c.dll

[2010/10/06 01:01:48 | 000,069,632 | ---- | C] (ASMedia Technology) -- C:\Windows\i2c_i.dll

[2010/10/06 01:01:48 | 000,068,608 | ---- | C] (ASMedia Technology) -- C:\Windows\nVGA_i2c.dll

[2010/10/03 11:51:33 | 000,200,704 | ---- | C] (vbAccelerator) -- C:\Windows\SysWow64\vbalExpBar6.ocx

[2010/10/03 11:51:33 | 000,040,960 | ---- | C] (vbAccelerator) -- C:\Windows\SysWow64\SSubTmr6.dll

[2010/10/03 11:51:32 | 000,000,000 | ---D | C] -- C:\Users\Em\AppData\Roaming\FreeBurner

[2010/10/03 11:51:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Free Easy Burner

[2010/10/02 04:51:59 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft IntelliType Pro

[2010/10/02 04:51:58 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH

[2010/09/28 03:48:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live Safety Center

[2010/09/27 18:05:21 | 000,000,000 | ---D | C] -- C:\ProgramData\EPU

[2010/09/25 03:23:08 | 000,000,000 | ---D | C] -- C:\Users\Em\AppData\Roaming\Intel Corporation

[2010/09/25 02:13:31 | 000,000,000 | ---D | C] -- C:\RaidTool

[2010/09/22 06:20:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Symantec Shared

[2010/09/22 04:55:54 | 000,174,640 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS

[2010/09/22 04:55:51 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec

[2010/09/22 04:55:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Norton AntiVirus

[2010/09/21 09:11:28 | 000,000,000 | ---D | C] -- C:\Program Files\Creative

[2010/09/21 09:11:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Creative

[2010/09/21 09:11:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Creative Labs Shared

[2010/09/16 21:14:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Motive

[2010/09/16 21:09:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Creative

[2010/09/15 18:26:29 | 000,000,000 | ---D | C] -- C:\Windows\File & Folder List Maker

[2010/09/15 16:23:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2

[2010/09/15 10:20:49 | 000,000,000 | ---D | C] -- C:\Users\Em\AppData\Roaming\Tific

[2010/09/10 12:33:01 | 000,000,000 | ---D | C] -- C:\Windows\Downloaded Installations

[2010/09/10 11:54:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Hewlett-Packard

[2010/09/10 11:54:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\HP

[2010/09/09 08:24:56 | 000,000,000 | ---D | C] -- C:\Program Files\DivX

[2010/09/09 08:23:50 | 000,000,000 | ---D | C] -- C:\ProgramData\DivX

[2010/09/07 00:09:24 | 000,000,000 | ---D | C] -- C:\ProgramData\WEBREG

[2010/09/06 23:55:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft

[2010/09/06 23:55:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSN Toolbar

[2010/09/06 23:55:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight

[2010/09/06 23:53:14 | 000,235,008 | ---- | C] (Hewlett Packard Corporation) -- C:\Windows\SysWow64\hpzc35oe.dll

[2010/09/06 10:28:07 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft IntelliPoint

[2010/08/31 00:18:37 | 000,000,000 | ---D | C] -- C:\Windows\Minidump

[2010/08/26 15:59:52 | 000,016,896 | ---- | C] (ASUS) -- C:\Windows\AsTaskSched.dll

[2010/08/26 15:54:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Marvell

[2010/08/25 03:16:22 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR

[2010/08/24 12:34:56 | 000,000,000 | ---D | C] -- C:\Users\Em\AppData\Local\CrashDumps

[2010/08/22 22:30:35 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\NSTx64

[2010/08/22 22:30:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Norton Safe Web Lite

[2010/08/22 22:30:35 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\NSTx64\0100010.008

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/10/19 08:54:08 | 000,034,560 | ---- | M] () -- C:\Windows\SysWow64\drivers\Normandy.sys

[2010/10/19 08:39:14 | 000,133,632 | ---- | M] () -- C:\Users\Em\Desktop\RKUnhookerLE.EXE

[2010/10/19 08:30:37 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Em\Desktop\OTL.exe

[2010/10/18 10:58:16 | 000,015,888 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2010/10/18 10:58:16 | 000,015,888 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2010/10/18 10:57:48 | 000,730,320 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2010/10/18 10:57:48 | 000,626,844 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2010/10/18 10:57:48 | 000,107,160 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2010/10/18 10:50:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2010/10/18 10:50:47 | 4293,431,294 | -HS- | M] () -- C:\hiberfil.sys

[2010/10/18 10:24:45 | 001,202,862 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1201000.025\Cat.DB

[2010/10/18 10:00:48 | 000,174,640 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS

[2010/10/18 10:00:48 | 000,007,440 | ---- | M] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT

[2010/10/18 10:00:48 | 000,000,854 | ---- | M] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.INF

[2010/10/18 09:58:58 | 000,001,940 | ---- | M] () -- C:\Users\Em\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini

[2010/10/18 03:26:07 | 000,293,376 | ---- | M] () -- C:\Users\Em\Desktop\vu1l46fo.exe

[2010/10/18 03:21:06 | 000,544,768 | ---- | M] () -- C:\Users\Em\Desktop\dds.scr

[2010/10/18 03:18:42 | 000,050,477 | ---- | M] () -- C:\Users\Em\Desktop\Defogger.exe

[2010/10/18 01:30:29 | 000,001,017 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/10/14 03:18:55 | 000,168,288 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2010/10/06 01:02:09 | 000,016,384 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Windows\SysNative\drivers\EIO64.sys

[2010/10/03 11:51:33 | 000,001,101 | ---- | M] () -- C:\Users\Em\Desktop\Free Easy Burner.lnk

[2010/10/02 11:24:01 | 000,059,568 | -H-- | M] () -- C:\Windows\SysWow64\mlfcache.dat

[2010/09/28 04:36:08 | 000,007,606 | ---- | M] () -- C:\Users\Em\AppData\Local\resmon.resmoncfg

[2010/09/21 09:11:17 | 000,419,840 | ---- | M] (Creative Labs) -- C:\Windows\SysNative\wrap_oal.dll

[2010/09/21 09:11:17 | 000,413,696 | ---- | M] (Creative Labs) -- C:\Windows\SysWow64\wrap_oal.dll

[2010/09/21 03:00:31 | 000,000,159 | RH-- | M] () -- C:\Windows\ctfile.rfc

[2010/09/19 22:20:10 | 000,001,769 | ---- | M] () -- C:\Windows\Language_trs.ini

[2010/09/16 03:31:23 | 000,237,748 | ---- | M] () -- C:\Windows\hpwins20.dat.temp

[2010/09/06 10:28:13 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf

[2010/09/06 10:27:24 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01009.Wdf

[2010/08/26 15:59:52 | 000,016,896 | ---- | M] (ASUS) -- C:\Windows\AsTaskSched.dll

[2010/08/25 03:11:36 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_NuidFltr_01009.Wdf

[2010/08/17 02:21:53 | 000,000,172 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1201000.025\isolate.ini

[2010/08/04 14:08:49 | 000,030,406 | ---- | M] () -- C:\Windows\Ascd_tmp.ini

[2010/08/03 21:39:19 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_NuidFltr_01005.Wdf

[2010/08/03 21:36:03 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64k_01009.Wdf

[2010/07/28 23:33:05 | 000,821,808 | R--- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NAVx64\1201000.025\SymEFA64.sys

[2010/07/28 23:33:05 | 000,007,412 | R--- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1201000.025\SymEFA64.cat

[2010/07/28 23:33:05 | 000,003,373 | R--- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1201000.025\SymEFA.inf

[2010/07/28 22:54:37 | 000,715,824 | R--- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NAVx64\1201000.025\srtsp64.sys

[2010/07/28 22:54:37 | 000,040,496 | R--- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NAVx64\1201000.025\srtspx64.sys

[2010/07/28 22:54:37 | 000,007,414 | R--- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1201000.025\srtspx64.cat

[2010/07/28 22:54:37 | 000,001,422 | R--- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1201000.025\srtspx64.inf

[2010/07/28 22:54:36 | 000,007,410 | R--- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1201000.025\srtsp64.cat

[2010/07/28 22:54:36 | 000,001,438 | R--- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1201000.025\srtsp64.inf

[2010/07/28 09:56:28 | 000,001,678 | ---- | M] () -- C:\Windows\hpwmdl20.dat.temp

[2010/07/21 21:27:14 | 000,007,410 | R--- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1201000.025\symnet64.cat

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/10/19 08:38:16 | 000,034,560 | ---- | C] () -- C:\Windows\SysWow64\drivers\Normandy.sys

[2010/10/19 08:38:00 | 000,133,632 | ---- | C] () -- C:\Users\Em\Desktop\RKUnhookerLE.EXE

[2010/10/18 03:26:05 | 000,293,376 | ---- | C] () -- C:\Users\Em\Desktop\vu1l46fo.exe

[2010/10/18 03:21:04 | 000,544,768 | ---- | C] () -- C:\Users\Em\Desktop\dds.scr

[2010/10/18 03:18:42 | 000,050,477 | ---- | C] () -- C:\Users\Em\Desktop\Defogger.exe

[2010/10/18 01:30:29 | 000,001,017 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/10/14 17:43:29 | 000,001,940 | ---- | C] () -- C:\Users\Em\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini

[2010/10/06 01:01:49 | 000,077,824 | ---- | C] () -- C:\Windows\SysWow64\xvid.ax

[2010/10/06 01:01:49 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\asrussian.dll

[2010/10/06 01:01:49 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\askorean.dll

[2010/10/06 01:01:49 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\asjapan.dll

[2010/10/06 01:01:49 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\asgerman.dll

[2010/10/06 01:01:49 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\asfrench.dll

[2010/10/06 01:01:49 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\aseng.dll

[2010/10/06 01:01:49 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\ASCHT.dll

[2010/10/06 01:01:49 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\aschs.dll

[2010/10/06 01:01:49 | 000,010,766 | ---- | C] () -- C:\Windows\SysNative\asusgsb.cat

[2010/10/06 01:01:49 | 000,010,733 | ---- | C] () -- C:\Windows\SysNative\ATKDispLowFilter.cat

[2010/10/06 01:01:49 | 000,002,109 | ---- | C] () -- C:\Windows\SysNative\asusgsb.inf

[2010/10/06 01:01:49 | 000,001,849 | ---- | C] () -- C:\Windows\SysNative\ATKDispLowFilter.inf

[2010/10/06 01:01:48 | 000,761,856 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll

[2010/10/06 01:01:48 | 000,180,224 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll

[2010/10/06 01:01:48 | 000,002,963 | ---- | C] () -- C:\Windows\SysWow64\xvid.inf

[2010/10/03 11:51:33 | 000,044,544 | ---- | C] () -- C:\Windows\SysWow64\GIF89.DLL

[2010/10/03 11:51:33 | 000,001,101 | ---- | C] () -- C:\Users\Em\Desktop\Free Easy Burner.lnk

[2010/10/03 11:51:32 | 000,484,352 | ---- | C] () -- C:\Windows\SysWow64\lame_enc.dll

[2010/09/22 04:55:54 | 000,007,440 | ---- | C] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT

[2010/09/22 04:55:54 | 000,000,854 | ---- | C] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.INF

[2010/09/19 22:23:17 | 000,008,897 | ---- | C] () -- C:\Windows\SysWow64\CTAPO64.cat

[2010/09/06 10:28:13 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf

[2010/09/06 10:27:24 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01009.Wdf

[2010/08/25 03:11:36 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_NuidFltr_01009.Wdf

[2010/08/22 22:30:35 | 000,000,172 | ---- | C] () -- C:\Windows\SysNative\drivers\NSTx64\0100010.008\isolate.ini

[2010/08/03 21:39:19 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_NuidFltr_01005.Wdf

[2010/08/03 21:36:03 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64k_01009.Wdf

[2010/08/02 01:17:51 | 000,059,568 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat

[2010/05/27 03:53:14 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys

[2010/05/27 03:53:14 | 000,010,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys

[2010/05/20 14:45:41 | 000,747,070 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2010/04/06 01:02:09 | 000,007,606 | ---- | C] () -- C:\Users\Em\AppData\Local\resmon.resmoncfg

[2010/04/02 17:17:34 | 000,179,091 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat

[2010/03/15 01:51:36 | 000,003,348 | ---- | C] () -- C:\Windows\SysWow64\ludap17.ini

[2010/03/15 01:51:36 | 000,000,078 | ---- | C] () -- C:\Windows\SysWow64\ctzapxx.ini

[2010/03/11 21:33:23 | 000,013,368 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsUpIO.sys

[2010/03/01 20:22:53 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI

[2010/02/28 11:24:49 | 000,068,987 | ---- | C] () -- C:\ProgramData\hpzinstall.log

[2010/02/27 14:58:24 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\Iyvu9_32.dll

[2010/02/27 14:56:49 | 000,102,400 | ---- | C] () -- C:\Windows\SysWow64\APmpg4v1.dll

[2010/02/27 11:04:32 | 000,000,000 | ---- | C] () -- C:\Windows\winfile.ini

[2010/02/27 03:31:09 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\AsIO.dll

[2010/02/27 03:31:09 | 000,013,440 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys

[2010/02/27 03:29:13 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini

[2010/02/27 03:29:10 | 000,030,406 | ---- | C] () -- C:\Windows\Ascd_tmp.ini

[2010/02/27 02:17:03 | 000,166,912 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL

[2010/02/27 02:17:03 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL

[2009/08/03 19:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\SysWow64\OGACheckControl.DLL

[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll

[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll

[2009/04/02 08:30:14 | 000,010,296 | ---- | C] () -- C:\Windows\SysWow64\drivers\ASUSHWIO.SYS

[2008/11/13 10:07:24 | 000,002,177 | ---- | C] () -- C:\Windows\P17EP.ini

[2008/01/14 21:47:06 | 000,099,712 | ---- | C] () -- C:\Windows\HPBroker.dll

[2007/12/04 09:20:30 | 000,001,489 | ---- | C] () -- C:\Windows\P17EP51.ini

[2007/06/07 09:25:42 | 000,001,578 | ---- | C] () -- C:\Windows\P17EPLS.ini

[2004/01/27 08:13:54 | 000,421,888 | ---- | C] () -- C:\Windows\SysWow64\OpenQuicktimeLib.dll

[2004/01/27 08:13:14 | 000,061,440 | ---- | C] () -- C:\Windows\SysWow64\libfaac.dll

========== LOP Check ==========

[2010/10/13 15:41:42 | 000,000,000 | ---D | M] -- C:\Users\Em\AppData\Roaming\FreeBurner

[2010/03/21 22:52:32 | 000,000,000 | ---D | M] -- C:\Users\Em\AppData\Roaming\GARMIN

[2010/02/27 08:52:25 | 000,000,000 | ---D | M] -- C:\Users\Em\AppData\Roaming\Qualcomm

[2010/07/01 16:19:56 | 000,000,000 | ---D | M] -- C:\Users\Em\AppData\Roaming\TechWizard

[2010/02/27 08:43:54 | 000,000,000 | ---D | M] -- C:\Users\Em\AppData\Roaming\Thunderbird

[2010/09/15 10:20:49 | 000,000,000 | ---D | M] -- C:\Users\Em\AppData\Roaming\Tific

[2010/02/27 11:19:27 | 000,000,000 | ---D | M] -- C:\Users\Em\AppData\Roaming\WeatherBug

[2010/10/18 02:14:33 | 000,032,572 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >