xevous Posted October 20, 2010 ID:330600 Share Posted October 20, 2010 Hello I'm new to malwarebytes and would like some help with this problem. 2 days ago I noticed that my Google searches have been very slow and results often redirect to a different link. At first I dismissed the problem, then I noticed my computer began to slow down and I cannot log onto my gmail or my msn accounts. I've tried using my antivirus (avast) scan to no avail. Then I tried Malwarebytes anti-malware, again to no results. My compter has bluescreened twice, now I'm running in safe mode and it is still there although my system doesn't crash. A note to add: When i type in a search some weird symbols appear beside my results. It looks like —Sorry its small...Any help would be appreciated thanks!- Xevous Link to post Share on other sites More sharing options...
kahdah Posted October 20, 2010 ID:330603 Share Posted October 20, 2010 Hello xevousWelcome to Malwarebytes.=====================Download OTL to your desktop.Double click on OTL to run it.When the window appears, underneath Output at the top change it to Minimal Output.Under the Standard Registry box change it to All.Under Custom scan's and fixes section paste in the below in boldnetsvcs%SYSTEMDRIVE%\*.*%systemroot%\system32\*.dll /lockedfiles%systemroot%\Tasks\*.job /lockedfiles%systemroot%\system32\drivers\*.sys /90%systemroot%\system32\Spool\prtprocs\w32x86\*.dllCheck the boxes beside LOP Check and Purity Check.Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.====================Please download Rootkit Unhooker and save it to your desktop.Double-click RKUnhookerLE.exe to run it.Click the Report tab, then click ScanCheck Drivers, Stealth Code, Files, and Code HooksUncheck the rest, then click OKWhen prompted to Select Disks for Scan, make sure C:\ is checked and click OKWait till the scanner has finished then go File > Save ReportSave the report somewhere you can find it, typically your desktop. Click CloseCopy the entire contents of the report and paste it in your next reply.Note - You may get this warning it is ok, just ignore it."Rootkit Unhooker has detected a parasite inside itself!It is recommended to remove parasite, okay?" Link to post Share on other sites More sharing options...
xevous Posted October 20, 2010 Author ID:330610 Share Posted October 20, 2010 Thank you for your help!I have a small problem though rootkit unhooker does not initialize it has an error.Error loading driver, NTSTATUS code: 0xC000035FHere is my OTL.txtOTL logfile created on: 10/20/2010 6:38:05 PM - Run 1OTL by OldTimer - Version 3.2.16.0 Folder = C:\Users\Ryan\Desktop An unknown product (Version = 6.1.7600) - Type = NTWorkstationInternet Explorer (Version = 8.0.7600.16385)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 73.00% Memory free7.00 Gb Paging File | 6.00 Gb Available in Paging File | 91.00% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program FilesDrive C: | 285.50 Gb Total Space | 113.99 Gb Free Space | 39.93% Space Free | Partition Type: NTFSDrive D: | 10.00 Gb Total Space | 3.06 Gb Free Space | 30.65% Space Free | Partition Type: NTFSComputer Name: RYAN-PC | User Name: Ryan | Logged in as Administrator.Boot Mode: SafeMode with Networking | Scan Mode: Current userCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days========== Processes (SafeList) ==========PRC - C:\Users\Ryan\Desktop\OTL.exe (OldTimer Tools)PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)PRC - C:\Program Files\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)PRC - C:\Windows\explorer.exe (Microsoft Corporation)========== Modules (SafeList) ==========MOD - C:\Users\Ryan\Desktop\OTL.exe (OldTimer Tools)MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation)MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation)MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)========== Win32 Services (SafeList) ==========SRV - (avast! Web Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)SRV - (avast! Mail Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)SRV - (SwitchBoard) -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)SRV - (WwanSvc) -- C:\Windows\System32\wwansvc.dll (Microsoft Corporation)SRV - (WbioSrvc) -- C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)SRV - (Power) -- C:\Windows\System32\umpo.dll (Microsoft Corporation)SRV - (Themes) -- C:\Windows\System32\themeservice.dll (Microsoft Corporation)SRV - (sppuinotify) -- C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation)SRV - (RpcEptMapper) -- C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)SRV - (PNRPsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)SRV - (p2pimsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)SRV - (HomeGroupProvider) -- C:\Windows\System32\provsvc.dll (Microsoft Corporation)SRV - (PNRPAutoReg) -- C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)SRV - (HomeGroupListener) -- C:\Windows\System32\ListSvc.dll (Microsoft Corporation)SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)SRV - (Dhcp) -- C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)SRV - (defragsvc) -- C:\Windows\System32\defragsvc.dll (Microsoft Corporation)SRV - (BDESVC) -- C:\Windows\System32\bdesvc.dll (Microsoft Corporation)SRV - (AxInstSV) ActiveX Installer (AxInstSV) -- C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)SRV - (AppIDSvc) -- C:\Windows\System32\appidsvc.dll (Microsoft Corporation)SRV - (sppsvc) -- C:\Windows\System32\sppsvc.exe (Microsoft Corporation)SRV - (YahooAUService) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)========== Driver Services (SafeList) ==========DRV - (XDva349) -- C:\Windows\System32\XDva349.sys File not foundDRV - (RimUsb) -- C:\Windows\System32\Drivers\RimUsb.sys File not foundDRV - (aswTdi) -- C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)DRV - (aswSP) -- C:\Windows\System32\drivers\aswSP.sys (AVAST Software)DRV - (aswRdr) -- C:\Windows\System32\drivers\aswRdr.sys (AVAST Software)DRV - (aswMonFlt) -- C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)DRV - (aswFsBlk) -- C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)DRV - (SCDEmu) -- C:\Windows\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys (Duplex Secure Ltd.)DRV - (UsbDiag) -- C:\Windows\System32\drivers\lgusbdiag.sys (LG Electronics Inc.)DRV - (USBModem) -- C:\Windows\System32\drivers\lgusbmodem.sys (LG Electronics Inc.)DRV - (usbbus) -- C:\Windows\System32\drivers\lgusbbus.sys (LG Electronics Inc.)DRV - (KSecPkg) -- C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)DRV - (yukonw7) -- C:\Windows\System32\drivers\yk62x86.sys ()DRV - (cmdide) -- C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)DRV - (adpahci) -- C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)DRV - (adp94xx) -- C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)DRV - (amdsbs) -- C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)DRV - (adpu320) -- C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)DRV - (arcsas) -- C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)DRV - (amdsata) -- C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)DRV - (arc) -- C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)DRV - (amdxata) -- C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)DRV - (aliide) -- C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)DRV - (nfrd960) -- C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)DRV - (LSI_SAS) -- C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)DRV - (iaStorV) -- C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)DRV - (MegaSR) -- C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)DRV - (LSI_SCSI) -- C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)DRV - (LSI_FC) -- C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)DRV - (LSI_SAS2) -- C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)DRV - (iirsp) -- C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)DRV - (megasas) -- C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)DRV - (hwpolicy) -- C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)DRV - (elxstor) -- C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)DRV - (aic78xx) -- C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)DRV - (HpSAMD) -- C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)DRV - (FsDepends) -- C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)DRV - (vsmraid) -- C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)DRV - (vmbus) -- C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)DRV - (vhdmp) -- C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)DRV - (storflt) -- C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)DRV - (vdrvroot) -- C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)DRV - (storvsc) -- C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)DRV - (WIMMount) -- C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)DRV - (viaide) -- C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)DRV - (ql2300) -- C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)DRV - (rdyboost) -- C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)DRV - (ql40xx) -- C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)DRV - (SiSRaid4) -- C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)DRV - (pcw) -- C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)DRV - (SiSRaid2) -- C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)DRV - (stexstor) -- C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)DRV - (CNG) -- C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)DRV - (rdpbus) -- C:\Windows\System32\drivers\rdpbus.sys (Microsoft Corporation)DRV - (RDPREFMP) -- C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)DRV - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)DRV - (WfpLwf) -- C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)DRV - (NdisCap) -- C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)DRV - (vwififlt) -- C:\Windows\System32\drivers\vwififlt.sys (Microsoft Corporation)DRV - (vwifibus) -- C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)DRV - (1394ohci) -- C:\Windows\System32\drivers\1394ohci.sys (Microsoft Corporation)DRV - (UmPass) -- C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)DRV - (mshidkmdf) -- C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)DRV - (MTConfig) -- C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)DRV - (CompositeBus) -- C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)DRV - (AppID) -- C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)DRV - (scfilter) -- C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)DRV - (s3cap) -- C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)DRV - (VMBusHID) -- C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)DRV - (discache) -- C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)DRV - (AcpiPmi) -- C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)DRV - (AmdPPM) -- C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)DRV - (hcw85cir) -- C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)DRV - (BrUsbMdm) -- C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)DRV - (BrUsbSer) -- C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)DRV - (BrSerWdm) -- C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)DRV - (BrFiltLo) -- C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)DRV - (BrFiltUp) -- C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)DRV - (ebdrv) -- C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)DRV - (b06bdrv) -- C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)DRV - (BCM43XX) -- C:\Windows\System32\drivers\BCMWL6.SYS (Broadcom Corporation)DRV - (OEM02Dev) -- C:\Windows\System32\drivers\OEM02Dev.sys (Creative Technology Ltd.)DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC)DRV - (OEM02Vfx) -- C:\Windows\System32\drivers\OEM02Vfx.sys (EyePower Games Pte. Ltd.)DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC)DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)DRV - (speedfan) -- C:\Windows\system32\speedfan.sys (Windows ® 2000 DDK provider)DRV - (giveio) -- C:\Windows\system32\giveio.sys ()========== Standard Registry (All) ==================== Internet Explorer ==========IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-onsIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRiskIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ca.yahoo.comIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htmIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htmIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearchIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ca.yahoo.comIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-usIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 6E 80 23 5A 50 C2 CA 01 [binary data]IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local========== FireFox ==========FF - prefs.js..browser.search.defaultenginename: "Yahoo"FF - prefs.js..browser.search.defaulturl: "http://ca.search.yahoo.com/search?fr=ffsp1&p="FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"FF - prefs.js..browser.search.param.yahoo-type: "${8}"FF - prefs.js..browser.search.selectedEngine: "Google"FF - prefs.js..browser.startup.homepage: "http://ca.yahoo.com"FF - prefs.js..extensions.enabledItems: glasser@sixxgate.com:3.5.2FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100908FF - prefs.js..extensions.enabledItems: {097d3191-e6fa-4728-9826-b533d755359d}:0.7.11FF - prefs.js..extensions.enabledItems: {bee6eb20-01e0-ebd1-da83-080329fb9a3a}:0.1FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.7.1FF - prefs.js..extensions.enabledItems: smarterwiki@wikiatic.com:4.1.7FF - prefs.js..extensions.enabledItems: {5F590AA2-1221-4113-A6F4-A4BB62414FAC}:0.45.6.20100202.1FF - prefs.js..extensions.enabledItems: cfxHelper@Triton:1.2FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:5.0.31.0FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.10FF - prefs.js..extensions.enabledItems: {e213bb8f-8ebd-11db-96b7-005056c00008}:3.0.0.91FF - prefs.js..extensions.enabledItems: cfxe@Triton:3.6.5FF - prefs.js..keyword.URL: "http://ca.search.yahoo.com/search?fr=ffds1&p="FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/05/06 23:28:06 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/24 10:27:45 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/23 15:57:12 | 000,000,000 | ---D | M][2010/03/12 22:29:35 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Mozilla\Extensions[2010/03/12 22:29:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}[2010/10/20 18:08:01 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions[2010/03/12 22:33:37 | 000,000,000 | ---D | M] (All-in-One Sidebar) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}[2010/05/28 21:33:51 | 000,000,000 | ---D | M] (SmoothWheel (mozdev.org)) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\{5F590AA2-1221-4113-A6F4-A4BB62414FAC}[2010/09/09 19:17:23 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}[2010/09/17 20:52:18 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}[2010/03/12 22:33:37 | 000,000,000 | ---D | M] (Flash and Video Download) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}[2010/09/17 20:52:17 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}[2010/06/14 16:26:04 | 000,000,000 | ---D | M] (myFireFox) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\{e213bb8f-8ebd-11db-96b7-005056c00008}[2010/10/09 19:33:17 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\battlefieldheroespatcher@ea.com[2010/05/28 21:33:42 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\cfxe@Triton[2010/05/28 21:33:51 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\cfxHelper@Triton[2010/04/25 17:49:52 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\DTToolbar@toolbarnet.com[2010/03/12 22:33:37 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\glasser@sixxgate.com[2010/09/17 20:52:17 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\smarterwiki@wikiatic.com[2010/06/14 16:26:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\{e213bb8f-8ebd-11db-96b7-005056c00008}\chrome\mozapps\extensions[2010/04/25 17:49:45 | 000,002,059 | ---- | M] () -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\searchplugins\daemon-search.xml[2010/10/20 18:08:01 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions[2010/09/17 20:29:38 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}[2010/06/13 21:23:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}[2010/09/17 20:29:31 | 000,023,512 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll[2010/09/17 20:29:31 | 000,138,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll[2007/04/10 17:21:08 | 000,163,256 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll[2010/06/13 21:23:17 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll[2009/06/25 13:20:28 | 001,446,264 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll[2010/09/17 20:29:32 | 000,064,984 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll[2006/10/26 20:12:16 | 000,016,192 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL[2010/08/13 07:03:40 | 000,103,864 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll[2010/04/09 19:07:01 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll[2010/04/09 19:07:01 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll[2010/04/09 19:07:01 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll[2010/04/09 19:07:01 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll[2010/04/09 19:07:02 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll[2010/04/09 19:07:02 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll[2010/04/09 19:07:02 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll[2010/07/23 17:27:38 | 000,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml[2010/07/23 17:27:38 | 000,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml[2010/07/23 17:27:38 | 000,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml[2010/07/23 17:27:39 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml[2010/07/23 17:27:39 | 000,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml[2010/07/23 17:27:39 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml[2010/07/23 17:27:39 | 000,001,096 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xmlO1 HOSTS File: ([2010/05/13 17:53:40 | 000,001,204 | ---- | M]) - C:\Windows\System32\drivers\etc\hostsO1 - Hosts: 127.0.0.1 localhostO1 - Hosts: 127.0.0.1 activate.adobe.comO1 - Hosts: 127.0.0.1 3dns-3.adobe.comO1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.comO1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.comO1 - Hosts: 127.0.0.1 ereg.wip3.adobe.comO1 - Hosts: 127.0.0.1 activate-sea.adobe.comO1 - Hosts: 127.0.0.1 wip3.adobe.comO1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.comO1 - Hosts: 127.0.0.1 activate-sjc0.adobe.comO1 - Hosts: 127.0.0.1 practivate.adobe.comO1 - Hosts: 127.0.0.1 ereg.adobe.comO1 - Hosts: 127.0.0.1 activate.wip3.adobe.comO1 - Hosts: 127.0.0.1 3dns-2.adobe.comO1 - Hosts: 127.0.0.1 adobe-dns.adobe.com O1 - Hosts: ::1 localhostO2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\hpwuschd2.exe (Hewlett-Packard)O4 - HKLM..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe (Hewlett-Packard)O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)O4 - HKLM..\Run: [NVHotkey] C:\Windows\System32\nvHotkey.DLL (NVIDIA Corporation)O4 - HKLM..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe (Creative Technology Ltd.)O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)O4 - HKLM..\Run: [sunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)O4 - HKLM..\Run: [switchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)O4 - HKCU..\Run: [search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)O4 - HKLM..\RunOnce: [] File not foundO4 - HKLM..\RunOnce: [GrpConv] C:\Windows\System32\grpconv.exe (Microsoft Corporation)O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)O4 - Startup: C:\Users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)O9 - Extra Button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\nlaapi.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} http://catalog.update.microsoft.com/v7/sit...b?1274152888223 (MUCatalogWebControl Class)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not foundO21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not foundO28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)O31 - SafeBoot: AlternateShell - cmd.exeO32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]O34 - HKLM BootExecute: (autocheck autochk /p \??\F:) - File not foundO34 - HKLM BootExecute: (autocheck autochk *) - File not foundO34 - HKLM BootExecute: (aswBoot.exe /A:* /L:1033 /heur:100 /pup /archives /IA:0 /KBD:2 /dir:C:\Program) - C:\Windows\System32\aswBoot.exe (AVAST Software)O35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*O37 - HKCU\...com [@ = ComFile] -- Reg Error: Key error. File not foundO37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not foundNetSvcs: FastUserSwitchingCompatibility - File not foundNetSvcs: Ias - File not foundNetSvcs: Nla - File not foundNetSvcs: Ntmssvc - File not foundNetSvcs: NWCWorkstation - File not foundNetSvcs: Nwsapagent - File not foundNetSvcs: SRService - File not foundNetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)NetSvcs: WmdmPmSp - File not foundNetSvcs: LogonHours - File not foundNetSvcs: PCAudit - File not foundNetSvcs: helpsvc - File not foundNetSvcs: uploadmgr - File not foundNetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)========== Files/Folders - Created Within 30 Days ==========[2010/10/20 18:36:10 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\Ryan\Desktop\OTL.exe[2010/10/20 17:57:44 | 000,000,000 | ---D | C] -- C:\Users\Ryan\Desktop\GooredFix Backups[2010/10/20 17:56:46 | 000,071,398 | ---- | C] (jpshortstuff) -- C:\Users\Ryan\Desktop\GooredFix.exe[2010/10/20 17:43:02 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN[2010/10/20 17:41:48 | 000,000,000 | ---D | C] -- C:\Windows\temp[2010/10/20 17:29:57 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe[2010/10/20 17:29:57 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe[2010/10/20 17:29:57 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe[2010/10/20 17:29:51 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT[2010/10/20 17:29:34 | 000,000,000 | ---D | C] -- C:\Qoobox[2010/10/20 17:29:20 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe[2010/10/20 17:29:18 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW[2010/10/19 17:11:20 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys[2010/10/19 17:11:19 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys[2010/10/19 16:16:42 | 000,038,848 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr[2010/10/19 15:48:06 | 000,000,000 | ---D | C] -- C:\Windows\Minidump[2010/10/19 15:26:17 | 000,000,000 | ---D | C] -- C:\Users\Ryan\AppData\Roaming\Malwarebytes[2010/10/19 15:26:06 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware[2010/10/19 15:26:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes[2010/10/14 15:41:50 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll[2010/10/14 15:41:50 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll[2010/10/14 15:39:38 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll[2010/10/14 15:39:38 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll[2010/10/14 15:39:38 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll[2010/10/14 15:39:38 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll[2010/10/14 15:39:38 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll[2010/10/14 15:39:37 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb[2010/10/14 15:39:37 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec[2010/10/14 15:39:37 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll[2010/10/14 15:39:37 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll[2010/10/14 15:39:37 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll[2010/10/14 15:39:37 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe[2010/10/14 15:39:20 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll[2010/10/14 15:38:09 | 002,327,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys[2010/10/14 15:37:20 | 000,363,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\StructuredQuery.dll[2010/10/11 13:33:25 | 000,000,000 | ---D | C] -- C:\Users\Ryan\Documents\My Games[2010/10/09 20:11:45 | 000,000,000 | ---D | C] -- C:\Users\Ryan\AppData\Roaming\HPAppData[2010/10/09 19:45:05 | 000,000,000 | ---D | C] -- C:\Users\Ryan\Documents\Battlefield Heroes[2010/10/09 17:55:11 | 000,000,000 | ---D | C] -- C:\Program Files\GameSpy Arcade[2010/10/09 17:55:03 | 000,000,000 | ---D | C] -- C:\Users\Ryan\Documents\Battlefield 2[2010/10/04 09:08:00 | 001,325,656 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Ryan\Desktop\TDSSKiller.exe[2010/09/29 10:33:55 | 000,190,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\ks.sys[2010/09/28 16:01:34 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll[2010/09/27 17:11:19 | 000,000,000 | ---D | C] -- C:\Users\Ryan\AppData\Roaming\Subversion[2010/09/24 10:34:12 | 000,000,000 | ---D | C] -- C:\Users\Ryan\AppData\Roaming\Auslogics[2010/09/24 10:34:09 | 000,000,000 | ---D | C] -- C:\Program Files\Auslogics[2010/09/21 23:00:50 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe[2010/09/21 22:54:16 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe Media Player[2010/09/21 22:38:45 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe Photoshop CS5 Extended Edition========== Files - Modified Within 30 Days ==========[2010/10/20 18:36:11 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Ryan\Desktop\OTL.exe[2010/10/20 17:56:46 | 000,071,398 | ---- | M] (jpshortstuff) -- C:\Users\Ryan\Desktop\GooredFix.exe[2010/10/20 17:28:46 | 003,881,515 | R--- | M] () -- C:\Users\Ryan\Desktop\ComboFix.exe[2010/10/20 17:24:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat[2010/10/20 17:24:54 | 415,961,351 | ---- | M] () -- C:\Windows\MEMORY.DMP[2010/10/20 17:24:50 | 2817,048,576 | -HS- | M] () -- C:\hiberfil.sys[2010/10/19 17:24:19 | 001,325,656 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Ryan\Desktop\TDSSKiller.exe[2010/10/19 17:12:44 | 000,010,848 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0[2010/10/19 17:12:44 | 000,010,848 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0[2010/10/19 17:11:23 | 000,001,005 | ---- | M] () -- C:\Users\Ryan\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk[2010/10/19 16:16:45 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt[2010/10/19 16:03:42 | 003,766,608 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT[2010/10/11 13:33:13 | 000,624,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat[2010/10/11 13:33:13 | 000,106,522 | ---- | M] () -- C:\Windows\System32\perfc009.dat[2010/10/11 13:28:56 | 000,139,128 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys[2010/10/11 13:28:47 | 000,215,128 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr[2010/10/09 19:44:12 | 000,138,056 | ---- | M] () -- C:\Users\Ryan\AppData\Roaming\PnkBstrK.sys[2010/10/09 19:43:34 | 002,427,248 | ---- | M] () -- C:\Windows\System32\pbsvc_heroes.exe[2010/10/09 18:15:07 | 000,002,052 | ---- | M] () -- C:\Users\Public\Desktop\Play BF2 Online Now!.lnk[2010/10/09 18:15:07 | 000,002,030 | ---- | M] () -- C:\Users\Public\Desktop\Battlefield 2.lnk[2010/10/07 22:35:18 | 000,103,606 | ---- | M] () -- C:\Users\Ryan\Documents\Science Study Notes.docx[2010/10/04 00:24:33 | 000,013,798 | ---- | M] () -- C:\Users\Ryan\Documents\September 6th.docx[2010/10/03 22:55:22 | 000,010,508 | ---- | M] () -- C:\Users\Ryan\Documents\The Sound of Guns.docx[2010/09/27 17:10:36 | 000,001,457 | ---- | M] () -- C:\Users\Ryan\Desktop\garrysmod - Shortcut.lnk[2010/09/24 10:34:10 | 000,001,108 | ---- | M] () -- C:\Users\Ryan\Desktop\Auslogics Disk Defrag.lnk[2010/09/23 15:57:14 | 000,001,986 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk========== Files Created - No Company Name ==========[2010/10/20 17:29:57 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe[2010/10/20 17:29:57 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe[2010/10/20 17:29:57 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe[2010/10/20 17:29:57 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe[2010/10/20 17:29:57 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe[2010/10/20 17:28:39 | 003,881,515 | R--- | C] () -- C:\Users\Ryan\Desktop\ComboFix.exe[2010/10/20 17:24:54 | 415,961,351 | ---- | C] () -- C:\Windows\MEMORY.DMP[2010/10/19 16:34:31 | 000,001,005 | ---- | C] () -- C:\Users\Ryan\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk[2010/10/09 19:43:34 | 002,427,248 | ---- | C] () -- C:\Windows\System32\pbsvc_heroes.exe[2010/10/09 18:15:07 | 000,002,052 | ---- | C] () -- C:\Users\Public\Desktop\Play BF2 Online Now!.lnk[2010/10/09 18:15:07 | 000,002,030 | ---- | C] () -- C:\Users\Public\Desktop\Battlefield 2.lnk[2010/10/06 16:22:16 | 000,103,606 | ---- | C] () -- C:\Users\Ryan\Documents\Science Study Notes.docx[2010/10/04 00:17:28 | 000,013,798 | ---- | C] () -- C:\Users\Ryan\Documents\September 6th.docx[2010/10/03 22:50:54 | 000,010,508 | ---- | C] () -- C:\Users\Ryan\Documents\The Sound of Guns.docx[2010/09/27 17:10:36 | 000,001,457 | ---- | C] () -- C:\Users\Ryan\Desktop\garrysmod - Shortcut.lnk[2010/09/24 10:34:10 | 000,001,108 | ---- | C] () -- C:\Users\Ryan\Desktop\Auslogics Disk Defrag.lnk[2010/09/23 15:57:14 | 000,001,986 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk[2010/06/13 21:15:05 | 000,022,016 | ---- | C] () -- C:\Users\Ryan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2010/06/02 20:47:52 | 000,000,898 | ---- | C] () -- C:\Users\Ryan\AppData\Roaming\org.madan.notesgdg.txt[2010/04/29 23:03:21 | 000,002,153 | ---- | C] () -- C:\ProgramData\hpzinstall.log[2010/04/10 20:50:46 | 000,139,128 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys[2010/04/10 20:50:46 | 000,138,056 | ---- | C] () -- C:\Users\Ryan\AppData\Roaming\PnkBstrK.sys[2009/09/28 09:22:00 | 000,315,392 | ---- | C] () -- C:\Windows\System32\drivers\yk62x86.sys[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll[2005/05/06 20:06:00 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll[1996/04/03 15:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys========== LOP Check ==========[2010/06/13 21:36:36 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\AnvSoft[2010/09/24 10:34:12 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Auslogics[2010/09/29 14:57:26 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Azureus[2010/04/10 20:29:01 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\DAEMON Tools Lite[2010/05/30 18:35:24 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Facebook[2010/10/19 16:01:31 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Rainmeter[2010/08/21 13:07:04 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\SPORE[2010/09/27 17:11:19 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Subversion[2009/07/14 00:53:46 | 000,015,886 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT========== Purity Check ==================== Custom Scans ==========< %SYSTEMDRIVE%\*.* >[2010/03/09 16:26:32 | 000,000,630 | ---- | M] () -- C:\aaw7boot.log[2009/06/10 17:42:20 | 000,000,024 | ---- | M] () -- C:\autoexec.bat[2009/07/13 21:38:58 | 000,383,562 | RHS- | M] () -- C:\bootmgr[2010/03/12 22:42:16 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK[2010/10/20 17:44:02 | 000,012,334 | ---- | M] () -- C:\ComboFix.txt[2009/06/10 17:42:20 | 000,000,010 | ---- | M] () -- C:\config.sys[2008/12/31 18:54:44 | 000,004,953 | RH-- | M] () -- C:\dell.sdr[2010/10/20 17:24:50 | 2817,048,576 | -HS- | M] () -- C:\hiberfil.sys[2007/11/06 22:13:41 | 000,359,256 | ---- | M] (Hewlett-Packard) -- C:\hpzids40.dll[2010/03/04 23:10:12 | 000,000,000 | RHS- | M] () -- C:\IO.SYS[2006/12/02 01:37:14 | 000,904,704 | ---- | M] (Microsoft Corporation) -- C:\msdia80.dll[2010/03/04 23:10:12 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS[2010/10/20 17:24:54 | 3756,064,768 | -HS- | M] () -- C:\pagefile.sys[2010/04/18 21:03:13 | 000,005,776 | ---- | M] () -- C:\ST6UNST.LOG[2004/11/05 11:34:32 | 000,288,301 | ---- | M] () -- C:\StarForge Help.chm[2004/10/18 15:27:00 | 000,335,872 | ---- | M] () -- C:\StarForge.dll[2004/11/05 10:05:58 | 000,925,696 | ---- | M] (Flatline Productions) -- C:\StarForge.exe[2010/10/19 15:33:56 | 000,066,410 | ---- | M] () -- C:\TDSSKiller.2.4.4.0_19.10.2010_15.33.00_log.txt[2010/10/19 15:43:43 | 000,064,982 | ---- | M] () -- C:\TDSSKiller.2.4.4.0_19.10.2010_15.43.01_log.txt[2010/10/20 18:00:02 | 000,065,232 | ---- | M] () -- C:\TDSSKiller.2.4.4.0_20.10.2010_17.59.29_log.txt[2004/03/02 08:00:32 | 000,000,838 | ---- | M] () -- C:\Tips.txt[2004/11/05 10:55:37 | 000,019,123 | ---- | M] () -- C:\Version Info.htm< %systemroot%\system32\*.dll /lockedfiles >< %systemroot%\Tasks\*.job /lockedfiles >< %systemroot%\system32\drivers\*.sys /90 >[2010/09/07 10:47:07 | 000,017,744 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys[2010/09/07 10:47:30 | 000,050,768 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys[2010/09/07 10:47:46 | 000,023,376 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys[2010/09/07 10:52:03 | 000,165,584 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys[2010/09/07 10:52:25 | 000,046,672 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys[2010/10/11 13:28:56 | 000,139,128 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys[2010/08/26 23:31:30 | 000,310,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\srv.sys[2010/08/26 23:30:47 | 000,308,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\srv2.sys[2010/08/26 23:30:40 | 000,113,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\srvnet.sys< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >[2007/12/03 18:55:24 | 000,278,016 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\1_hpzpp5mu.dll[2007/12/03 18:55:24 | 000,278,016 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\hpzpp5mu.dll[2009/07/13 21:15:35 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll[2006/10/26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll[2009/07/13 21:16:19 | 000,029,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll< End of report >And my Extras.txtOTL Extras logfile created on: 10/20/2010 6:38:05 PM - Run 1OTL by OldTimer - Version 3.2.16.0 Folder = C:\Users\Ryan\Desktop An unknown product (Version = 6.1.7600) - Type = NTWorkstationInternet Explorer (Version = 8.0.7600.16385)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 73.00% Memory free7.00 Gb Paging File | 6.00 Gb Available in Paging File | 91.00% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program FilesDrive C: | 285.50 Gb Total Space | 113.99 Gb Free Space | 39.93% Space Free | Partition Type: NTFSDrive D: | 10.00 Gb Total Space | 3.06 Gb Free Space | 30.65% Space Free | Partition Type: NTFSComputer Name: RYAN-PC | User Name: Ryan | Logged in as Administrator.Boot Mode: SafeMode with Networking | Scan Mode: Current userCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days========== Extra Registry (SafeList) ==================== File Associations ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation).hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>].bat [@ = batfile] -- Reg Error: Key error. File not found.cmd [@ = cmdfile] -- Reg Error: Key error. File not found.com [@ = ComFile] -- Reg Error: Key error. File not found.exe [@ = exefile] -- Reg Error: Key error. File not found.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation).pif [@ = piffile] -- Reg Error: Key error. File not found.vbs [@ = VBSFile] -- Reg Error: Key error. File not found========== Shell Spawning ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)scrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)========== Security Center Settings ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"cval" = 1"FirewallDisableNotify" = 0"AntiVirusDisableNotify" = 0"UpdatesDisableNotify" = 0[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]"VistaSp1" = Reg Error: Unknown registry data type -- File not found"AntiVirusOverride" = 0"AntiSpywareOverride" = 0"FirewallOverride" = 0========== System Restore Settings ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]"DisableSR" = 0========== Firewall Settings ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile][HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]"DisableNotifications" = 0"EnableFirewall" = 1[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"DisableNotifications" = 0"EnableFirewall" = 1[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]"DisableNotifications" = 0"EnableFirewall" = 1========== Authorized Applications List ==========[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]========== HKEY_LOCAL_MACHINE Uninstall List ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help"{0DEA94ED-915A-4834-A87E-388D012C8E02}" = Medal of Honor Allied Assault"{0E549A13-2B3D-4633-BA41-DC88C2D6F9A3}" = ProductContext"{0EF5BEA9-B9D3-46d7-8958-FB69A0BAEACC}" = Status"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86"{1147FF9A-D576-4cb5-B5E7-FCA21D1E7D26}" = J4680"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319"{1EC71BFB-01A3-4239-B6AF-B1AE656B15C0}" = TrayApp"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java 6 Update 20"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm"{2FF8C687-DB7D-4adc-A5DC-57983EC25046}" = DeviceDiscovery"{3825B383-7880-48C8-AADD-49B0D764B151}" = 4660_4680_Help"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company Link to post Share on other sites More sharing options...
kahdah Posted October 20, 2010 ID:330625 Share Posted October 20, 2010 Please post these logs.C:\TDSSKiller.2.4.4.0_19.10.2010_15.33.00_log.txtC:\ComboFix.txtAlso why do you have adobe in your hosts file is it because it is cracked? Link to post Share on other sites More sharing options...
xevous Posted October 20, 2010 Author ID:330630 Share Posted October 20, 2010 If its Adobe Photoshop CS5 yes its cracked but i got that a while ago with no problems.Here is the TDSS killer txt2010/10/19 15:33:00.0732 TDSS rootkit removing tool 2.4.4.0 Oct 4 2010 09:06:592010/10/19 15:33:00.0732 ================================================================================2010/10/19 15:33:00.0732 SystemInfo:2010/10/19 15:33:00.0732 2010/10/19 15:33:00.0732 OS Version: 6.1.7600 ServicePack: 0.02010/10/19 15:33:00.0733 Product type: Workstation2010/10/19 15:33:00.0733 ComputerName: RYAN-PC2010/10/19 15:33:00.0734 UserName: Ryan2010/10/19 15:33:00.0734 Windows directory: C:\Windows2010/10/19 15:33:00.0734 System windows directory: C:\Windows2010/10/19 15:33:00.0734 Processor architecture: Intel x862010/10/19 15:33:00.0734 Number of processors: 22010/10/19 15:33:00.0734 Page size: 0x10002010/10/19 15:33:00.0734 Boot type: Normal boot2010/10/19 15:33:00.0734 ================================================================================2010/10/19 15:33:03.0586 Initialize success2010/10/19 15:33:07.0654 ================================================================================2010/10/19 15:33:07.0654 Scan started2010/10/19 15:33:07.0654 Mode: Manual;2010/10/19 15:33:07.0654 ================================================================================2010/10/19 15:33:09.0692 1394ohci (6d2aca41739bfe8cb86ee8e85f29697d) C:\Windows\system32\DRIVERS\1394ohci.sys2010/10/19 15:33:09.0735 ACPI (f0e07d144c8685b8774bc32fc8da4df0) C:\Windows\system32\DRIVERS\ACPI.sys2010/10/19 15:33:09.0873 AcpiPmi (98d81ca942d19f7d9153b095162ac013) C:\Windows\system32\DRIVERS\acpipmi.sys2010/10/19 15:33:09.0934 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys2010/10/19 15:33:10.0060 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys2010/10/19 15:33:10.0195 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys2010/10/19 15:33:10.0280 AFD (ddc040fdb01ef1712a6b13e52afb104c) C:\Windows\system32\drivers\afd.sys2010/10/19 15:33:10.0400 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\DRIVERS\agp440.sys2010/10/19 15:33:10.0448 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys2010/10/19 15:33:10.0604 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\DRIVERS\aliide.sys2010/10/19 15:33:10.0635 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\DRIVERS\amdagp.sys2010/10/19 15:33:10.0672 amdide (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\DRIVERS\amdide.sys2010/10/19 15:33:10.0793 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys2010/10/19 15:33:10.0831 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys2010/10/19 15:33:10.0885 amdsata (2101a86c25c154f8314b24ef49d7fbc2) C:\Windows\system32\DRIVERS\amdsata.sys2010/10/19 15:33:10.0998 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys2010/10/19 15:33:11.0022 amdxata (b81c2b5616f6420a9941ea093a92b150) C:\Windows\system32\DRIVERS\amdxata.sys2010/10/19 15:33:11.0061 AppID (feb834c02ce1e84b6a38f953ca067706) C:\Windows\system32\drivers\appid.sys2010/10/19 15:33:11.0234 arc (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys2010/10/19 15:33:11.0252 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys2010/10/19 15:33:11.0297 aswFsBlk (fb6a381c32a87ee6588eed61d22dc03b) C:\Windows\system32\drivers\aswFsBlk.sys2010/10/19 15:33:11.0420 aswMonFlt (0fa9908262d640a80813dba3fffcf688) C:\Windows\system32\drivers\aswMonFlt.sys2010/10/19 15:33:11.0458 aswRdr (7827f70b86b29fbf112cbce547205acc) C:\Windows\system32\drivers\aswRdr.sys2010/10/19 15:33:11.0485 aswSP (39bf48164a958f4bf0c0ec6cdc447db5) C:\Windows\system32\drivers\aswSP.sys2010/10/19 15:33:11.0601 aswTdi (755e4afb683e3306886a0f4df02a1575) C:\Windows\system32\drivers\aswTdi.sys2010/10/19 15:33:11.0658 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys2010/10/19 15:33:11.0683 atapi (338c86357871c167a96ab976519bf59e) C:\Windows\system32\DRIVERS\atapi.sys2010/10/19 15:33:11.0864 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys2010/10/19 15:33:12.0005 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys2010/10/19 15:33:12.0135 BCM43XX (f9ce9b5e049efc66b8e6c73c18ee8438) C:\Windows\system32\DRIVERS\bcmwl6.sys2010/10/19 15:33:12.0329 Beep (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys2010/10/19 15:33:12.0371 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys2010/10/19 15:33:12.0504 bowser (fcafaef6798d7b51ff029f99a9898961) C:\Windows\system32\DRIVERS\bowser.sys2010/10/19 15:33:12.0541 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys2010/10/19 15:33:12.0559 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys2010/10/19 15:33:12.0611 Brserid (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys2010/10/19 15:33:12.0734 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys2010/10/19 15:33:12.0751 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys2010/10/19 15:33:12.0770 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys2010/10/19 15:33:12.0790 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys2010/10/19 15:33:12.0843 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys2010/10/19 15:33:12.0992 cdrom (ba6e70aa0e6091bc39de29477d866a77) C:\Windows\system32\DRIVERS\cdrom.sys2010/10/19 15:33:13.0037 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys2010/10/19 15:33:13.0156 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys2010/10/19 15:33:13.0249 CmBatt (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys2010/10/19 15:33:13.0362 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\DRIVERS\cmdide.sys2010/10/19 15:33:13.0408 CNG (1b675691ed940766149c93e8f4488d68) C:\Windows\system32\Drivers\cng.sys2010/10/19 15:33:13.0538 Compbatt (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys2010/10/19 15:33:13.0573 CompositeBus (f1724ba27e97d627f808fb0ba77a28a6) C:\Windows\system32\DRIVERS\CompositeBus.sys2010/10/19 15:33:13.0612 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys2010/10/19 15:33:13.0758 CSC (27c9490bdd0ae48911ab8cf1932591ed) C:\Windows\system32\drivers\csc.sys2010/10/19 15:33:13.0893 DfsC (8e09e52ee2e3ceb199ef3dd99cf9e3fb) C:\Windows\system32\Drivers\dfsc.sys2010/10/19 15:33:13.0930 discache (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys2010/10/19 15:33:14.0002 Disk (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys2010/10/19 15:33:14.0113 Dot4 (b5e479eb83707dd698f66953e922042c) C:\Windows\system32\DRIVERS\Dot4.sys2010/10/19 15:33:14.0206 Dot4Print (c25fea07a8e7767e8b89ab96a3b96519) C:\Windows\system32\DRIVERS\Dot4Prt.sys2010/10/19 15:33:14.0312 dot4usb (cf491ff38d62143203c065260567e2f7) C:\Windows\system32\DRIVERS\dot4usb.sys2010/10/19 15:33:14.0423 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys2010/10/19 15:33:14.0482 DXGKrnl (8b6c3464d7fac176500061dbfff42ad4) C:\Windows\System32\drivers\dxgkrnl.sys2010/10/19 15:33:14.0700 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys2010/10/19 15:33:14.0955 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys2010/10/19 15:33:15.0072 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\DRIVERS\errdev.sys2010/10/19 15:33:15.0125 exfat (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys2010/10/19 15:33:15.0153 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys2010/10/19 15:33:15.0281 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys2010/10/19 15:33:15.0326 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys2010/10/19 15:33:15.0354 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys2010/10/19 15:33:15.0370 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys2010/10/19 15:33:15.0441 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys2010/10/19 15:33:15.0540 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys2010/10/19 15:33:15.0596 Fs_Rec (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys2010/10/19 15:33:15.0657 fvevol (dafbd9fe39197495aed6d51f3b85b5d2) C:\Windows\system32\DRIVERS\fvevol.sys2010/10/19 15:33:15.0762 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys2010/10/19 15:33:15.0840 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys2010/10/19 15:33:15.0977 giveio (77ebf3e9386daa51551af429052d88d0) C:\Windows\system32\giveio.sys2010/10/19 15:33:16.0091 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys2010/10/19 15:33:16.0208 HdAudAddService (3530cad25deba7dc7de8bb51632cbc5f) C:\Windows\system32\drivers\HdAudio.sys2010/10/19 15:33:16.0397 HDAudBus (717a2207fd6f13ad3e664c7d5a43c7bf) C:\Windows\system32\DRIVERS\HDAudBus.sys2010/10/19 15:33:16.0441 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys2010/10/19 15:33:16.0567 HidBth (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys2010/10/19 15:33:16.0599 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys2010/10/19 15:33:16.0693 HidUsb (25072fb35ac90b25f9e4e3bacf774102) C:\Windows\system32\DRIVERS\hidusb.sys2010/10/19 15:33:16.0854 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\DRIVERS\HpSAMD.sys2010/10/19 15:33:16.0914 HTTP (c531c7fd9e8b62021112787c4e2c5a5a) C:\Windows\system32\drivers\HTTP.sys2010/10/19 15:33:17.0039 hwpolicy (8305f33cde89ad6c7a0763ed0b5a8d42) C:\Windows\system32\drivers\hwpolicy.sys2010/10/19 15:33:17.0079 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\DRIVERS\i8042prt.sys2010/10/19 15:33:17.0116 iaStorV (934af4d7c5f457b9f0743f4299b77b67) C:\Windows\system32\DRIVERS\iaStorV.sys2010/10/19 15:33:17.0291 iirsp (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys2010/10/19 15:33:17.0333 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\DRIVERS\intelide.sys2010/10/19 15:33:17.0359 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys2010/10/19 15:33:17.0388 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys2010/10/19 15:33:17.0521 IPMIDRV (e4454b6c37d7ffd5649611f6496308a7) C:\Windows\system32\DRIVERS\IPMIDrv.sys2010/10/19 15:33:17.0558 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys2010/10/19 15:33:17.0722 IRENUM (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys2010/10/19 15:33:17.0747 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\DRIVERS\isapnp.sys2010/10/19 15:33:17.0788 iScsiPrt (ed46c223ae46c6866ab77cdc41c404b7) C:\Windows\system32\DRIVERS\msiscsi.sys2010/10/19 15:33:17.0935 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys2010/10/19 15:33:17.0971 kbdhid (3d9f0ebf350edcfd6498057301455964) C:\Windows\system32\DRIVERS\kbdhid.sys2010/10/19 15:33:18.0100 KSecDD (e36a061ec11b373826905b21be10948f) C:\Windows\system32\Drivers\ksecdd.sys2010/10/19 15:33:18.0141 KSecPkg (365c6154bbbc5377173f1ca7bfb6cc59) C:\Windows\system32\Drivers\ksecpkg.sys2010/10/19 15:33:18.0293 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys2010/10/19 15:33:18.0385 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys2010/10/19 15:33:18.0413 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys2010/10/19 15:33:18.0528 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys2010/10/19 15:33:18.0553 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys2010/10/19 15:33:18.0608 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys2010/10/19 15:33:18.0726 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys2010/10/19 15:33:18.0774 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys2010/10/19 15:33:18.0819 Modem (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys2010/10/19 15:33:18.0949 monitor (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys2010/10/19 15:33:18.0989 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys2010/10/19 15:33:19.0027 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys2010/10/19 15:33:19.0152 mountmgr (921c18727c5920d6c0300736646931c2) C:\Windows\system32\drivers\mountmgr.sys2010/10/19 15:33:19.0187 mpio (2af5997438c55fb79d33d015c30e1974) C:\Windows\system32\DRIVERS\mpio.sys2010/10/19 15:33:19.0227 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys2010/10/19 15:33:19.0280 MRxDAV (b1be47008d20e43da3adc37c24cdb89d) C:\Windows\system32\drivers\mrxdav.sys2010/10/19 15:33:19.0407 mrxsmb (f1b6aa08497ea86ca6ef6f7a08b0bfb8) C:\Windows\system32\DRIVERS\mrxsmb.sys2010/10/19 15:33:19.0437 mrxsmb10 (5613358b4050f46f5a9832da8050d6e4) C:\Windows\system32\DRIVERS\mrxsmb10.sys2010/10/19 15:33:19.0463 mrxsmb20 (25c9792778d80feb4c8201e62281bfdf) C:\Windows\system32\DRIVERS\mrxsmb20.sys2010/10/19 15:33:19.0516 msahci (4326d168944123f38dd3b2d9c37a0b12) C:\Windows\system32\DRIVERS\msahci.sys2010/10/19 15:33:19.0630 msdsm (455029c7174a2dbb03dba8a0d8bddd9a) C:\Windows\system32\DRIVERS\msdsm.sys2010/10/19 15:33:19.0684 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys2010/10/19 15:33:19.0712 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys2010/10/19 15:33:19.0837 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\DRIVERS\msisadrv.sys2010/10/19 15:33:19.0881 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys2010/10/19 15:33:19.0907 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys2010/10/19 15:33:20.0025 MSPQM (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys2010/10/19 15:33:20.0060 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys2010/10/19 15:33:20.0087 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\DRIVERS\mssmbios.sys2010/10/19 15:33:20.0227 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys2010/10/19 15:33:20.0279 MTConfig (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys2010/10/19 15:33:20.0320 Mup (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys2010/10/19 15:33:20.0475 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys2010/10/19 15:33:20.0534 NDIS (23759d175a0a9baaf04d05047bc135a8) C:\Windows\system32\drivers\ndis.sys2010/10/19 15:33:20.0672 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys2010/10/19 15:33:20.0716 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys2010/10/19 15:33:20.0757 Ndisuio (b30ae7f2b6d7e343b0df32e6c08fce75) C:\Windows\system32\DRIVERS\ndisuio.sys2010/10/19 15:33:20.0884 NdisWan (267c415eadcbe53c9ca873dee39cf3a4) C:\Windows\system32\DRIVERS\ndiswan.sys2010/10/19 15:33:20.0907 NDProxy (af7e7c63dcef3f8772726f86039d6eb4) C:\Windows\system32\drivers\NDProxy.sys2010/10/19 15:33:21.0051 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys2010/10/19 15:33:21.0076 NetBT (dd52a733bf4ca5af84562a5e2f963b91) C:\Windows\system32\DRIVERS\netbt.sys2010/10/19 15:33:21.0219 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys2010/10/19 15:33:21.0258 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys2010/10/19 15:33:21.0296 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys2010/10/19 15:33:21.0446 Ntfs (3795dcd21f740ee799fb7223234215af) C:\Windows\system32\drivers\Ntfs.sys2010/10/19 15:33:21.0573 Null (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys2010/10/19 15:33:21.0903 nvlddmkm (377140a534d013bd661c69f1741de43c) C:\Windows\system32\DRIVERS\nvlddmkm.sys2010/10/19 15:33:22.0300 OEM02Dev (19cac780b858822055f46c58a111723c) C:\Windows\system32\DRIVERS\OEM02Dev.sys2010/10/19 15:33:22.0326 OEM02Vfx (86326062a90494bdd79ce383511d7d69) C:\Windows\system32\DRIVERS\OEM02Vfx.sys2010/10/19 15:33:22.0398 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\DRIVERS\ohci1394.sys2010/10/19 15:33:22.0458 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys2010/10/19 15:33:22.0582 partmgr (ff4218952b51de44fe910953a3e686b9) C:\Windows\system32\drivers\partmgr.sys2010/10/19 15:33:22.0621 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys2010/10/19 15:33:22.0666 pci (c858cb77c577780ecc456a892e7e7d0f) C:\Windows\system32\DRIVERS\pci.sys2010/10/19 15:33:22.0701 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\DRIVERS\pciide.sys2010/10/19 15:33:22.0820 pcmcia (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys2010/10/19 15:33:22.0849 pcw (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys2010/10/19 15:33:22.0885 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys2010/10/19 15:33:23.0122 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys2010/10/19 15:33:23.0156 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys2010/10/19 15:33:23.0215 Psched (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys2010/10/19 15:33:23.0360 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys2010/10/19 15:33:23.0489 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys2010/10/19 15:33:23.0528 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys2010/10/19 15:33:23.0565 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys2010/10/19 15:33:23.0693 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys2010/10/19 15:33:23.0745 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys2010/10/19 15:33:23.0786 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys2010/10/19 15:33:23.0917 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys2010/10/19 15:33:23.0945 rdbss (835d7e81bf517a3b72384bdcc85e1ce6) C:\Windows\system32\DRIVERS\rdbss.sys2010/10/19 15:33:23.0974 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys2010/10/19 15:33:23.0994 RDPCDD (1e016846895b15a99f9a176a05029075) C:\Windows\system32\DRIVERS\RDPCDD.sys2010/10/19 15:33:24.0131 RDPDR (c5ff95883ffef704d50c40d21cfb3ab5) C:\Windows\system32\drivers\rdpdr.sys2010/10/19 15:33:24.0202 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys2010/10/19 15:33:24.0361 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys2010/10/19 15:33:24.0399 RDPWD (801371ba9782282892d00aadb08ee367) C:\Windows\system32\drivers\RDPWD.sys2010/10/19 15:33:24.0447 rdyboost (4ea225bf1cf05e158853f30a99ca29a7) C:\Windows\system32\drivers\rdyboost.sys2010/10/19 15:33:24.0587 rimmptsk (355aac141b214bef1dbc1483afd9bd50) C:\Windows\system32\DRIVERS\rimmptsk.sys2010/10/19 15:33:24.0614 rimsptsk (a4216c71dd4f60b26418ccfd99cd0815) C:\Windows\system32\DRIVERS\rimsptsk.sys2010/10/19 15:33:24.0761 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\Windows\system32\DRIVERS\RimSerial.sys2010/10/19 15:33:24.0833 rismxdp (d231b577024aa324af13a42f3a807d10) C:\Windows\system32\DRIVERS\rixdptsk.sys2010/10/19 15:33:24.0970 ROOTMODEM (564297827d213f52c7a3a2ff749568ca) C:\Windows\system32\Drivers\RootMdm.sys2010/10/19 15:33:25.0037 rspndr (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys2010/10/19 15:33:25.0084 s3cap (5423d8437051e89dd34749f242c98648) C:\Windows\system32\DRIVERS\vms3cap.sys2010/10/19 15:33:25.0228 sbp2port (34ee0c44b724e3e4ce2eff29126de5b5) C:\Windows\system32\DRIVERS\sbp2port.sys2010/10/19 15:33:25.0296 SCDEmu (20b2751cd4c8f3fd989739ca661b9f30) C:\Windows\system32\drivers\SCDEmu.sys2010/10/19 15:33:25.0325 scfilter (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\Windows\system32\DRIVERS\scfilter.sys2010/10/19 15:33:25.0468 sdbus (7b48cff3a475fe849dea65ec4d35c425) C:\Windows\system32\DRIVERS\sdbus.sys2010/10/19 15:33:25.0529 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys2010/10/19 15:33:25.0686 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys2010/10/19 15:33:25.0705 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys2010/10/19 15:33:25.0744 sermouse (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys2010/10/19 15:33:25.0799 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\DRIVERS\sffdisk.sys2010/10/19 15:33:25.0816 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\DRIVERS\sffp_mmc.sys2010/10/19 15:33:25.0841 sffp_sd (4f1e5b0fe7c8050668dbfade8999aefb) C:\Windows\system32\DRIVERS\sffp_sd.sys2010/10/19 15:33:25.0970 sfloppy (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys2010/10/19 15:33:26.0017 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\DRIVERS\sisagp.sys2010/10/19 15:33:26.0067 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys2010/10/19 15:33:26.0175 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys2010/10/19 15:33:26.0247 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys2010/10/19 15:33:26.0432 speedfan (5d6401db90ec81b71f8e2c5c8f0fef23) C:\Windows\system32\speedfan.sys2010/10/19 15:33:26.0522 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys2010/10/19 15:33:26.0651 sptd (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys2010/10/19 15:33:26.0651 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb487596735052010/10/19 15:33:26.0657 sptd - detected Locked file (1)2010/10/19 15:33:26.0775 srv (2dbedfb1853f06110ec2aa7f3213c89f) C:\Windows\system32\DRIVERS\srv.sys2010/10/19 15:33:26.0827 srv2 (db37131d1027c50ea7ee21c8bb4536aa) C:\Windows\system32\DRIVERS\srv2.sys2010/10/19 15:33:26.0950 srvnet (f5980b74124db9233b33f86fc5ebbb4f) C:\Windows\system32\DRIVERS\srvnet.sys2010/10/19 15:33:27.0021 stexstor (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys2010/10/19 15:33:27.0154 StillCam (edb05bd63148796f23ea78506404a538) C:\Windows\system32\DRIVERS\serscan.sys2010/10/19 15:33:27.0220 storflt (957e346ca948668f2496a6ccf6ff82cc) C:\Windows\system32\DRIVERS\vmstorfl.sys2010/10/19 15:33:27.0250 storvsc (d5751969dc3e4b88bf482ac8ec9fe019) C:\Windows\system32\DRIVERS\storvsc.sys2010/10/19 15:33:27.0365 swenum (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\DRIVERS\swenum.sys2010/10/19 15:33:27.0573 Tcpip (bb7f39c31c4a4417fd318e7cd184e225) C:\Windows\system32\drivers\tcpip.sys2010/10/19 15:33:27.0752 TCPIP6 (bb7f39c31c4a4417fd318e7cd184e225) C:\Windows\system32\DRIVERS\tcpip.sys2010/10/19 15:33:27.0885 tcpipreg (e64444523add154f86567c469bc0b17f) C:\Windows\system32\drivers\tcpipreg.sys2010/10/19 15:33:27.0927 TDPIPE (1875c1490d99e70e449e3afae9fcbadf) C:\Windows\system32\drivers\tdpipe.sys2010/10/19 15:33:27.0945 TDTCP (7551e91ea999ee9a8e9c331d5a9c31f3) C:\Windows\system32\drivers\tdtcp.sys2010/10/19 15:33:27.0984 tdx (cb39e896a2a83702d1737bfd402b3542) C:\Windows\system32\DRIVERS\tdx.sys2010/10/19 15:33:28.0005 TermDD (c36f41ee20e6999dbf4b0425963268a5) C:\Windows\system32\DRIVERS\termdd.sys2010/10/19 15:33:28.0154 tssecsrv (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\Windows\system32\DRIVERS\tssecsrv.sys2010/10/19 15:33:28.0244 tunnel (3e461d890a97f9d4c168f5fda36e1d00) C:\Windows\system32\DRIVERS\tunnel.sys2010/10/19 15:33:28.0367 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys2010/10/19 15:33:28.0401 udfs (09cc3e16f8e5ee7168e01cf8fcbe061a) C:\Windows\system32\DRIVERS\udfs.sys2010/10/19 15:33:28.0449 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\DRIVERS\uliagpkx.sys2010/10/19 15:33:28.0584 umbus (049b3a50b3d646baeeee9eec9b0668dc) C:\Windows\system32\DRIVERS\umbus.sys2010/10/19 15:33:28.0623 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys2010/10/19 15:33:28.0694 USBAAPL (4b8a9c16b6d9258ed99c512aecb8c555) C:\Windows\system32\Drivers\usbaapl.sys2010/10/19 15:33:28.0813 usbbus (8ef48ff1c23b1ce6f96d09a45959eb20) C:\Windows\system32\DRIVERS\lgusbbus.sys2010/10/19 15:33:28.0855 usbccgp (8455c4ed038efd09e99327f9d2d48ffa) C:\Windows\system32\DRIVERS\usbccgp.sys2010/10/19 15:33:28.0899 usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\DRIVERS\usbcir.sys2010/10/19 15:33:29.0040 UsbDiag (a0e24c5c2d0cff04bbd3753a72fae80b) C:\Windows\system32\DRIVERS\lgusbdiag.sys2010/10/19 15:33:29.0095 usbehci (1c333bfd60f2fed2c7ad5daf533cb742) C:\Windows\system32\DRIVERS\usbehci.sys2010/10/19 15:33:29.0139 usbhub (ee6ef93ccfa94fae8c6ab298273d8ae2) C:\Windows\system32\DRIVERS\usbhub.sys2010/10/19 15:33:29.0280 USBModem (cc09a1132b1f6a8362107cc134e90d0b) C:\Windows\system32\DRIVERS\lgusbmodem.sys2010/10/19 15:33:29.0324 usbohci (a6fb7957ea7afb1165991e54ce934b74) C:\Windows\system32\DRIVERS\usbohci.sys2010/10/19 15:33:29.0471 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys2010/10/19 15:33:29.0535 usbscan (576096ccbc07e7c4ea4f5e6686d6888f) C:\Windows\system32\DRIVERS\usbscan.sys2010/10/19 15:33:29.0563 USBSTOR (d8889d56e0d27e57ed4591837fe71d27) C:\Windows\system32\DRIVERS\USBSTOR.SYS2010/10/19 15:33:29.0692 usbuhci (78780c3ebce17405b1ccd07a3a8a7d72) C:\Windows\system32\DRIVERS\usbuhci.sys2010/10/19 15:33:29.0744 usbvideo (b5f6a992d996282b7fae7048e50af83a) C:\Windows\System32\Drivers\usbvideo.sys2010/10/19 15:33:29.0888 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\DRIVERS\vdrvroot.sys2010/10/19 15:33:29.0938 vga (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys2010/10/19 15:33:29.0956 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys2010/10/19 15:33:29.0982 vhdmp (3be6e1f3a4f1afec8cee0d7883f93583) C:\Windows\system32\DRIVERS\vhdmp.sys2010/10/19 15:33:30.0120 viaagp (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\DRIVERS\viaagp.sys2010/10/19 15:33:30.0140 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys2010/10/19 15:33:30.0174 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\DRIVERS\viaide.sys2010/10/19 15:33:30.0265 vmbus (379b349f65f453d2a6e75ea6b7448e49) C:\Windows\system32\DRIVERS\vmbus.sys2010/10/19 15:33:30.0396 VMBusHID (ec2bbab4b84d0738c6c83d2234dc36fe) C:\Windows\system32\DRIVERS\VMBusHID.sys2010/10/19 15:33:30.0471 volmgr (384e5a2aa49934295171e499f86ba6f3) C:\Windows\system32\DRIVERS\volmgr.sys2010/10/19 15:33:30.0508 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys2010/10/19 15:33:30.0646 volsnap (58df9d2481a56edde167e51b334d44fd) C:\Windows\system32\DRIVERS\volsnap.sys2010/10/19 15:33:30.0695 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys2010/10/19 15:33:30.0735 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\system32\DRIVERS\vwifibus.sys2010/10/19 15:33:30.0871 vwififlt (7090d3436eeb4e7da3373090a23448f7) C:\Windows\system32\DRIVERS\vwififlt.sys2010/10/19 15:33:30.0924 WacomPen (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys2010/10/19 15:33:31.0066 WANARP (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys2010/10/19 15:33:31.0079 Wanarpv6 (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys2010/10/19 15:33:31.0149 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys2010/10/19 15:33:31.0193 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys2010/10/19 15:33:31.0357 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys2010/10/19 15:33:31.0397 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys2010/10/19 15:33:31.0573 WinUsb (30fc6e5448d0cbaaa95280eeef7fedae) C:\Windows\system32\DRIVERS\WinUSB.sys2010/10/19 15:33:31.0635 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\DRIVERS\wmiacpi.sys2010/10/19 15:33:31.0791 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys2010/10/19 15:33:31.0836 WudfPf (6f9b6c0c93232cff47d0f72d6db1d21e) C:\Windows\system32\drivers\WudfPf.sys2010/10/19 15:33:31.0879 WUDFRd (f91ff1e51fca30b3c3981db7d5924252) C:\Windows\system32\DRIVERS\WUDFRd.sys2010/10/19 15:33:32.0172 yukonw7 (30b73eb97218a16cbc6de535782a1b35) C:\Windows\system32\DRIVERS\yk62x86.sys2010/10/19 15:33:32.0274 ================================================================================2010/10/19 15:33:32.0274 Scan finished2010/10/19 15:33:32.0274 ================================================================================2010/10/19 15:33:32.0284 Detected object count: 12010/10/19 15:33:52.0261 HKLM\SYSTEM\ControlSet001\services\sptd - will be deleted after reboot2010/10/19 15:33:52.0304 HKLM\SYSTEM\ControlSet002\services\sptd - will be deleted after reboot2010/10/19 15:33:52.0315 C:\Windows\system32\Drivers\sptd.sys - will be deleted after reboot2010/10/19 15:33:52.0315 Locked file(sptd) - User select action: Delete2010/10/19 15:33:56.0691 Deinitialize successComboFix.txtComboFix 10-10-19.04 - Ryan 10/20/2010 17:32:22.1.2 - x86 NETWORKMicrosoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3582.2988 [GMT -4:00]Running from: c:\users\Ryan\Desktop\ComboFix.exe * Created a new restore point.((((((((((((((((((((((((( Files Created from 2010-09-20 to 2010-10-20 ))))))))))))))))))))))))))))))).2010-10-20 21:41 . 2010-10-20 21:41 -------- d-----w- c:\users\Default\AppData\Local\temp2010-10-19 21:11 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2010-10-19 21:11 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys2010-10-19 20:16 . 2010-09-07 15:12 38848 ----a-w- c:\windows\avastSS.scr2010-10-19 20:11 . 2010-10-07 23:21 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{51828758-C0C2-4085-9748-8BD0A2533B0E}\mpengine.dll2010-10-19 19:26 . 2010-10-19 21:10 -------- d-----w- c:\users\Ryan\AppData\Roaming\Malwarebytes2010-10-19 19:26 . 2010-10-19 21:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2010-10-19 19:26 . 2010-10-19 21:10 -------- d-----w- c:\programdata\Malwarebytes2010-10-14 19:41 . 2010-08-31 04:32 954752 ----a-w- c:\windows\system32\mfc40.dll2010-10-14 19:41 . 2010-08-31 04:32 954288 ----a-w- c:\windows\system32\mfc40u.dll2010-10-14 19:40 . 2010-06-29 04:57 4247040 ----a-w- c:\program files\Windows NT\Accessories\wordpad.exe2010-10-14 19:40 . 2010-09-01 04:26 164864 ----a-w- c:\program files\Windows Media Player\wmplayer.exe2010-10-14 19:38 . 2010-09-01 02:34 2327552 ----a-w- c:\windows\system32\win32k.sys2010-10-14 19:37 . 2010-08-27 03:31 310784 ----a-w- c:\windows\system32\drivers\srv.sys2010-10-14 19:37 . 2010-08-27 03:30 308736 ----a-w- c:\windows\system32\drivers\srv2.sys2010-10-14 19:37 . 2010-08-27 03:30 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys2010-10-14 19:37 . 2010-05-05 06:46 363520 ----a-w- c:\windows\system32\StructuredQuery.dll2010-10-10 00:11 . 2010-10-10 00:11 -------- d-----w- c:\users\Ryan\AppData\Roaming\HPAppData2010-10-09 23:43 . 2010-10-09 23:43 2427248 ----a-w- c:\windows\system32\pbsvc_heroes.exe2010-10-09 21:55 . 2010-10-09 21:55 -------- d-----w- c:\program files\GameSpy Arcade2010-10-09 21:33 . 2004-10-22 06:17 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll2010-10-09 21:33 . 2004-10-22 06:17 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll2010-10-09 21:33 . 2004-10-22 06:16 180224 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll2010-10-09 21:33 . 2004-10-22 06:16 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe2010-10-09 21:33 . 2004-10-22 06:18 749568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll2010-10-09 21:33 . 2010-10-09 21:33 323716 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll2010-10-09 21:33 . 2010-10-09 21:33 192644 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll2010-09-29 14:33 . 2010-03-04 04:04 146304 ----a-w- c:\windows\system32\drivers\usbvideo.sys2010-09-29 14:33 . 2010-03-04 03:57 190976 ----a-w- c:\windows\system32\drivers\ks.sys2010-09-28 20:01 . 2010-06-19 06:15 2048 ----a-w- c:\windows\system32\tzres.dll2010-09-28 20:01 . 2010-08-27 05:30 13312 ----a-w- c:\program files\Internet Explorer\iecompat.dll2010-09-27 21:11 . 2010-09-27 21:11 -------- d-----w- c:\users\Ryan\AppData\Roaming\Subversion2010-09-24 14:34 . 2010-09-24 14:34 -------- d-----w- c:\users\Ryan\AppData\Roaming\Auslogics2010-09-24 14:34 . 2010-09-24 14:34 -------- d-----w- c:\program files\Auslogics2010-09-22 03:00 . 2010-09-22 03:18 -------- d-----w- c:\programdata\regid.1986-12.com.adobe2010-09-22 02:54 . 2010-09-22 02:54 -------- d-----w- c:\program files\Adobe Media Player2010-09-22 02:38 . 2010-04-30 19:37 -------- d-----w- c:\program files\Adobe Photoshop CS5 Extended Edition.(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2010-06-01 5252408]"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-05-09 36864]"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624]"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2010-07-09 261736]"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-23 402432][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]"GrpConv"="grpconv -o" [X]"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]c:\users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-23 270336]Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2010-7-25 113664][HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 0 (0x0)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableLUA"= 0 (0x0)"EnableUIADesktopToggle"= 0 (0x0)"PromptOnSecureDesktop"= 0 (0x0)[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]"aux"=wdmaud.drv[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]BootExecute REG_MULTI_SZ autocheck autochk /p \??\f:\0autocheck autochk *\0aswBoot.exe /A:* /L:1033 /heur:100 /pup /archives /IA:0 /KBD:2 /dir:C:\ProgramR1 aswSP;aswSP; [x]R2 aswFsBlk;aswFsBlk; [x]R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12HPService REG_MULTI_SZ HPSLPSVChpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc..------- Supplementary Scan -------.uStart Page = hxxp://ca.yahoo.commStart Page = hxxp://ca.yahoo.comuInternet Settings,ProxyOverride = *.localIE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000FF - ProfilePath - c:\users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\FF - prefs.js: browser.search.defaulturl - hxxp://ca.search.yahoo.com/search?fr=ffsp1&p=FF - prefs.js: browser.search.selectedEngine - GoogleFF - prefs.js: browser.startup.homepage - hxxp://ca.yahoo.comFF - prefs.js: keyword.URL - hxxp://ca.search.yahoo.com/search?fr=ffds1&p=FF - component: c:\users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\cfxHelper@Triton\components\dwmxpcom.dllFF - component: c:\users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\glasser@sixxgate.com\components\dwmxpcom.dllFF - plugin: c:\program files\Google\Picasa3\npPicasa3.dllFF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dllFF - plugin: c:\program files\Pando Networks\Media Booster\npPandoWebPlugin.dllFF - plugin: c:\users\Ryan\AppData\Roaming\Facebook\npfbplugin_1_0_3.dllFF - plugin: c:\users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll---- FIREFOX POLICIES ----FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);.- - - - ORPHANS REMOVED - - - -HKLM-RunOnce-<NO NAME> - (no file).--------------------- LOCKED REGISTRY KEYS ---------------------[HKEY_USERS\S-1-5-21-3614805724-1640397324-534972597-1001\Software\SecuROM\License information*]"datasecu"=hex:63,20,6f,61,8b,65,4d,2a,c6,4a,21,43,1f,b3,c1,f2,9c,ac,83,a8,cf, 2a,54,9f,b8,13,ef,2f,ce,d1,a5,0f,36,c3,88,0e,3a,08,0e,d9,4e,e8,31,d6,bc,c8,\"rkeysecu"=hex:64,b6,bd,e1,3e,80,9e,c4,40,b4,90,83,87,8e,33,49[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]"Enabled"=dword:00000001[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]@Denied: (A 2) (Everyone)@="IFlashBroker4"[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}"[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0"[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).Completion time: 2010-10-20 17:44:01ComboFix-quarantined-files.txt 2010-10-20 21:44Pre-Run: 120,869,011,456 bytes freePost-Run: 122,350,776,320 bytes free- - End Of File - - 6C1D630EA4826F3BF09CE0054EEEF9BB Link to post Share on other sites More sharing options...
kahdah Posted October 20, 2010 ID:330635 Share Posted October 20, 2010 HiJack This! Forum PolicyWe will not be party to obvious use of key gens, cracks, warez or other illegal means of downloading software, music, videos ect. This means no P2P evidence will be supported. Logs that show these in them, will given the option to remove the P2P items. Keygens, cracks, warez and similar will have the thread closed period. It's theft and against the law.For you this means the adobe software.It needs to be removed before we can finish please remove it before proceeding.Please click here to download Kaspersky Virus Removal Tool.Double click on the file you just downloaded and let it install.It will install to your desktop.After that leave what is selected and put a check next to My Computer.Click on the option that says Threat Detection and change it to Disinfect,delete if disinfection fails.Then click on Start Scan.Before it is done it may prompt for action regardless of the setting so choose delete if prompted.When the scan is done no log will be produced.Click on the bottom where it says Report to open the report.Then highlight of of the items found by using ctrl + a on your keyboard to select all or use your mouse to select all then right click and choose copy.This will copy the items that it found to the clipboard you can then open notepad (go to start then run then type in notepad) and choose paste to paste the contents into Notepad.You can save this on the desktop.Post the contents of the document in your next reply.Note: This tool will self uninstall when you close it so please save the log before closing it. Link to post Share on other sites More sharing options...
xevous Posted October 21, 2010 Author ID:330787 Share Posted October 21, 2010 Thanks for the help. Sorry about the piracy I removed it right away.Here are the results form the kaspersky scan:Autoscan: completed 4 minutes ago (events: 50, objects: 892097, time: 04:07:38) 10/20/2010 7:37:21 PM Task started 10/20/2010 7:39:26 PM Detected: http://www.viruslist.com/en/advisories/41340 C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe 10/20/2010 7:39:33 PM Detected: http://www.viruslist.com/en/advisories/41213 C:\Program Files\QuickTime\QuickTimePlayer.exe 10/20/2010 7:40:31 PM Detected: http://www.viruslist.com/en/advisories/41340 C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe 10/20/2010 7:40:35 PM Detected: http://www.viruslist.com/en/advisories/41213 C:\Program Files\QuickTime\QuickTimePlayer.exe 10/20/2010 7:44:14 PM Detected: Exploit.Java.Agent.bu C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\3a9c5000-41b4a3a3/vmain.class 10/20/2010 7:44:14 PM Detected: Exploit.Java.CVE-2010-0094.a C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10\35ace28a-2c66cef5/dostuff.class 10/20/2010 7:44:15 PM Deleted: Exploit.Java.Agent.bu C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\3a9c5000-41b4a3a3/vmain.class 10/20/2010 7:44:15 PM Deleted: Exploit.Java.CVE-2010-0094.a C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10\35ace28a-2c66cef5/dostuff.class 10/20/2010 7:44:15 PM Detected: Exploit.Java.Agent.bu C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\160ba957-4f97b82c/________vload.class 10/20/2010 7:44:15 PM Detected: Trojan-Downloader.JS.Agent.fns C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10\35ace28a-2c66cef5/mosdef.class 10/20/2010 7:44:15 PM Deleted: Trojan-Downloader.JS.Agent.fns C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10\35ace28a-2c66cef5/mosdef.class 10/20/2010 7:44:15 PM Detected: Exploit.Java.CVE-2010-0094.a C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10\35ace28a-2c66cef5/SiteError.class 10/20/2010 7:44:15 PM Deleted: Exploit.Java.CVE-2010-0094.a C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10\35ace28a-2c66cef5/SiteError.class 10/20/2010 7:44:15 PM Detected: Exploit.Java.Agent.bu C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\68a9cc5c-4f25c1b9/________vload.class 10/20/2010 7:44:16 PM Deleted: Exploit.Java.Agent.bu C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\160ba957-4f97b82c/________vload.class 10/20/2010 7:44:16 PM Detected: Exploit.Java.Agent.bu C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\160ba957-4f97b82c/vmain.class 10/20/2010 7:44:16 PM Deleted: Exploit.Java.Agent.bu C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\160ba957-4f97b82c/vmain.class 10/20/2010 7:44:16 PM Detected: Exploit.Java.Agent.bu C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\170f8765-72d338b0/vmain.class 10/20/2010 7:44:16 PM Deleted: Exploit.Java.Agent.bu C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\68a9cc5c-4f25c1b9/________vload.class 10/20/2010 7:44:16 PM Detected: Exploit.Java.Agent.bu C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\68a9cc5c-4f25c1b9/vmain.class 10/20/2010 7:44:16 PM Deleted: Exploit.Java.Agent.bu C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\68a9cc5c-4f25c1b9/vmain.class 10/20/2010 7:44:17 PM Deleted: Exploit.Java.Agent.bu C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\170f8765-72d338b0/vmain.class 10/20/2010 7:44:17 PM Detected: Exploit.Java.Agent.bu C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\6a183b45-6c0b0a24/vmain.class 10/20/2010 7:44:17 PM Deleted: Exploit.Java.Agent.bu C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\6a183b45-6c0b0a24/vmain.class 10/20/2010 7:44:17 PM Detected: Exploit.Java.Agent.bu C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\d552d7a-6a227fdd/vmain.class 10/20/2010 7:44:17 PM Deleted: Exploit.Java.Agent.bu C:\Documents and Settings\Ryan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\d552d7a-6a227fdd/vmain.class 10/20/2010 8:13:34 PM Detected: Trojan.Win32.Agent.dnhg C:\Documents and Settings\Ryan\Documents\Vuze Downloads\Battlefield Bad Company 2 Patch - RELOADED\Battlefield Bad Company 2 Patch - RELOADED.rar/ BFBC2Game.exe/data0003 10/20/2010 8:13:34 PM Untreated: Trojan.Win32.Agent.dnhg C:\Documents and Settings\Ryan\Documents\Vuze Downloads\Battlefield Bad Company 2 Patch - RELOADED\Battlefield Bad Company 2 Patch - RELOADED.rar/ BFBC2Game.exe/data0003 Write not supported 10/20/2010 8:49:53 PM Detected: Trojan.Win32.Agent.dnhg C:\Documents and Settings\Ryan\My Documents\Vuze Downloads\Battlefield Bad Company 2 Patch - RELOADED\Battlefield Bad Company 2 Patch - RELOADED.rar/ BFBC2Game.exe/data0003 10/20/2010 8:49:53 PM Untreated: Trojan.Win32.Agent.dnhg C:\Documents and Settings\Ryan\My Documents\Vuze Downloads\Battlefield Bad Company 2 Patch - RELOADED\Battlefield Bad Company 2 Patch - RELOADED.rar/ BFBC2Game.exe/data0003 Write not supported 10/20/2010 8:52:48 PM Detected: http://www.viruslist.com/en/advisories/41340 C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe 10/20/2010 9:31:49 PM Detected: http://www.viruslist.com/en/advisories/40907 C:\Program Files\HP\Digital Imaging\Help\player\FlashPla.exe 10/20/2010 9:32:44 PM Detected: http://www.viruslist.com/en/advisories/41791 C:\Program Files\Java\jre6\bin\java.exe 10/20/2010 9:45:13 PM Detected: http://www.viruslist.com/en/advisories/41652 C:\Program Files\Steam\steamapps\068775154\garrysmod\garrysmod\addons\svn\subversion.exe 10/20/2010 10:30:27 PM Detected: Trojan.Win32.Agent.dikv C:\Program Files (x86)\Fallout 3\Fallout.3.FinalFix.Skullptura.rar/Fallout.3.FinalFix.Skullptura/Data/extract.exe 10/20/2010 10:30:27 PM Untreated: Trojan.Win32.Agent.dikv C:\Program Files (x86)\Fallout 3\Fallout.3.FinalFix.Skullptura.rar/Fallout.3.FinalFix.Skullptura/Data/extract.exe Write not supported 10/20/2010 10:32:05 PM Detected: http://www.viruslist.com/en/advisories/29966 C:\Program Files (x86)\HP\HP Software Update\HPWUCli.exe 10/20/2010 10:32:46 PM Detected: http://www.viruslist.com/en/advisories/41791 C:\Program Files (x86)\Java\jre1.6.0_07\bin\java.exe 10/20/2010 10:32:58 PM Detected: http://www.viruslist.com/en/advisories/41791 C:\Program Files (x86)\Java\jre6\bin\java.exe 10/20/2010 10:38:12 PM Detected: http://www.viruslist.com/en/advisories/41297 C:\Program Files (x86)\Mozilla Firefox\firefox.exe 10/20/2010 10:38:15 PM Detected: http://www.viruslist.com/en/advisories/41065 C:\Program Files (x86)\Mozilla Firefox\plugins\np32dsw.dll 10/20/2010 10:39:21 PM Detected: http://www.viruslist.com/en/advisories/33196 C:\Program Files (x86)\Mozilla Firefox\plugins\npdivx32.dll 10/20/2010 11:10:46 PM Detected: Trojan.Win32.Agent.dnhg C:\Users\Ryan\Documents\Vuze Downloads\Battlefield Bad Company 2 Patch - RELOADED\Battlefield Bad Company 2 Patch - RELOADED.rar/ BFBC2Game.exe/data0003 10/20/2010 11:10:46 PM Untreated: Trojan.Win32.Agent.dnhg C:\Users\Ryan\Documents\Vuze Downloads\Battlefield Bad Company 2 Patch - RELOADED\Battlefield Bad Company 2 Patch - RELOADED.rar/ BFBC2Game.exe/data0003 Write not supported 10/20/2010 11:23:53 PM Detected: Trojan.Win32.Agent.dnhg C:\Users\Ryan\My Documents\Vuze Downloads\Battlefield Bad Company 2 Patch - RELOADED\Battlefield Bad Company 2 Patch - RELOADED.rar/ BFBC2Game.exe/data0003 10/20/2010 11:23:53 PM Untreated: Trojan.Win32.Agent.dnhg C:\Users\Ryan\My Documents\Vuze Downloads\Battlefield Bad Company 2 Patch - RELOADED\Battlefield Bad Company 2 Patch - RELOADED.rar/ BFBC2Game.exe/data0003 Write not supported 10/20/2010 11:34:35 PM Detected: http://www.viruslist.com/en/advisories/41065 C:\Windows\System32\Adobe\Director\np32dsw.dll 10/20/2010 11:34:37 PM Detected: http://www.viruslist.com/en/advisories/41065 C:\Windows\System32\Adobe\Shockwave 11\Plugin.dll 10/20/2010 11:44:59 PM Task completed Link to post Share on other sites More sharing options...
kahdah Posted October 21, 2010 ID:330900 Share Posted October 21, 2010 Ok are you still getting redirected?Open OTL once more and click on the run scan button and post the newest log.Please download mbrcheck from HereSave that file to your desktop and double click on it to run it.It will show a Black screen with some data on it then hit any key to continue.Once it finishes there will be a log produced on your desktop that is labeled mbrcheck*.txt (where the * is date)Please post the contents of that log in your next reply. Link to post Share on other sites More sharing options...
xevous Posted October 21, 2010 Author ID:331177 Share Posted October 21, 2010 Yeah im still getting redirected. However, it is getting worse now.heres the OTL log....OTL logfile created on: 10/21/2010 3:51:12 PM - Run 2OTL by OldTimer - Version 3.2.16.0 Folder = C:\Users\Ryan\Desktop An unknown product (Version = 6.1.7600) - Type = NTWorkstationInternet Explorer (Version = 8.0.7600.16385)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 82.00% Memory free7.00 Gb Paging File | 6.00 Gb Available in Paging File | 92.00% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program FilesDrive C: | 285.50 Gb Total Space | 114.20 Gb Free Space | 40.00% Space Free | Partition Type: NTFSDrive D: | 10.00 Gb Total Space | 3.06 Gb Free Space | 30.65% Space Free | Partition Type: NTFSComputer Name: RYAN-PC | User Name: Ryan | Logged in as Administrator.Boot Mode: SafeMode with Networking | Scan Mode: Current userCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days========== Processes (SafeList) ==========PRC - C:\Users\Ryan\Desktop\OTL.exe (OldTimer Tools)PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)PRC - C:\Program Files\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)PRC - C:\Windows\explorer.exe (Microsoft Corporation)========== Modules (SafeList) ==========MOD - C:\Users\Ryan\Desktop\OTL.exe (OldTimer Tools)MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation)MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation)MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)========== Win32 Services (SafeList) ==========SRV - (avast! Web Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)SRV - (avast! Mail Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)SRV - (WwanSvc) -- C:\Windows\System32\wwansvc.dll (Microsoft Corporation)SRV - (WbioSrvc) -- C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)SRV - (Power) -- C:\Windows\System32\umpo.dll (Microsoft Corporation)SRV - (Themes) -- C:\Windows\System32\themeservice.dll (Microsoft Corporation)SRV - (sppuinotify) -- C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation)SRV - (RpcEptMapper) -- C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)SRV - (PNRPsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)SRV - (p2pimsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)SRV - (HomeGroupProvider) -- C:\Windows\System32\provsvc.dll (Microsoft Corporation)SRV - (PNRPAutoReg) -- C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)SRV - (HomeGroupListener) -- C:\Windows\System32\ListSvc.dll (Microsoft Corporation)SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)SRV - (Dhcp) -- C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)SRV - (defragsvc) -- C:\Windows\System32\defragsvc.dll (Microsoft Corporation)SRV - (BDESVC) -- C:\Windows\System32\bdesvc.dll (Microsoft Corporation)SRV - (AxInstSV) ActiveX Installer (AxInstSV) -- C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)SRV - (AppIDSvc) -- C:\Windows\System32\appidsvc.dll (Microsoft Corporation)SRV - (sppsvc) -- C:\Windows\System32\sppsvc.exe (Microsoft Corporation)SRV - (YahooAUService) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)========== Driver Services (SafeList) ==========DRV - (XDva349) -- C:\Windows\System32\XDva349.sys File not foundDRV - (RimUsb) -- C:\Windows\System32\Drivers\RimUsb.sys File not foundDRV - (catchme) -- C:\Users\Ryan\AppData\Local\Temp\catchme.sys File not foundDRV - (Normandy) -- C:\Windows\System32\drivers\Normandy.sys ()DRV - (aswTdi) -- C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)DRV - (aswSP) -- C:\Windows\System32\drivers\aswSP.sys (AVAST Software)DRV - (aswRdr) -- C:\Windows\System32\drivers\aswRdr.sys (AVAST Software)DRV - (aswMonFlt) -- C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)DRV - (aswFsBlk) -- C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)DRV - (SCDEmu) -- C:\Windows\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys (Duplex Secure Ltd.)DRV - (UsbDiag) -- C:\Windows\System32\drivers\lgusbdiag.sys (LG Electronics Inc.)DRV - (USBModem) -- C:\Windows\System32\drivers\lgusbmodem.sys (LG Electronics Inc.)DRV - (usbbus) -- C:\Windows\System32\drivers\lgusbbus.sys (LG Electronics Inc.)DRV - (KSecPkg) -- C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)DRV - (yukonw7) -- C:\Windows\System32\drivers\yk62x86.sys ()DRV - (cmdide) -- C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)DRV - (adpahci) -- C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)DRV - (adp94xx) -- C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)DRV - (amdsbs) -- C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)DRV - (adpu320) -- C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)DRV - (arcsas) -- C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)DRV - (amdsata) -- C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)DRV - (arc) -- C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)DRV - (amdxata) -- C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)DRV - (aliide) -- C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)DRV - (nfrd960) -- C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)DRV - (LSI_SAS) -- C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)DRV - (iaStorV) -- C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)DRV - (MegaSR) -- C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)DRV - (LSI_SCSI) -- C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)DRV - (LSI_FC) -- C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)DRV - (LSI_SAS2) -- C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)DRV - (iirsp) -- C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)DRV - (megasas) -- C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)DRV - (hwpolicy) -- C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)DRV - (elxstor) -- C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)DRV - (aic78xx) -- C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)DRV - (HpSAMD) -- C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)DRV - (FsDepends) -- C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)DRV - (vsmraid) -- C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)DRV - (vmbus) -- C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)DRV - (vhdmp) -- C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)DRV - (storflt) -- C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)DRV - (vdrvroot) -- C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)DRV - (storvsc) -- C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)DRV - (WIMMount) -- C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)DRV - (viaide) -- C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)DRV - (ql2300) -- C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)DRV - (rdyboost) -- C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)DRV - (ql40xx) -- C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)DRV - (SiSRaid4) -- C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)DRV - (pcw) -- C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)DRV - (SiSRaid2) -- C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)DRV - (stexstor) -- C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)DRV - (CNG) -- C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)DRV - (rdpbus) -- C:\Windows\System32\drivers\rdpbus.sys (Microsoft Corporation)DRV - (RDPREFMP) -- C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)DRV - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)DRV - (WfpLwf) -- C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)DRV - (NdisCap) -- C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)DRV - (vwififlt) -- C:\Windows\System32\drivers\vwififlt.sys (Microsoft Corporation)DRV - (vwifibus) -- C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)DRV - (1394ohci) -- C:\Windows\System32\drivers\1394ohci.sys (Microsoft Corporation)DRV - (UmPass) -- C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)DRV - (mshidkmdf) -- C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)DRV - (MTConfig) -- C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)DRV - (CompositeBus) -- C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)DRV - (AppID) -- C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)DRV - (scfilter) -- C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)DRV - (s3cap) -- C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)DRV - (VMBusHID) -- C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)DRV - (discache) -- C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)DRV - (AcpiPmi) -- C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)DRV - (AmdPPM) -- C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)DRV - (hcw85cir) -- C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)DRV - (BrUsbMdm) -- C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)DRV - (BrUsbSer) -- C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)DRV - (BrSerWdm) -- C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)DRV - (BrFiltLo) -- C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)DRV - (BrFiltUp) -- C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)DRV - (ebdrv) -- C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)DRV - (b06bdrv) -- C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)DRV - (BCM43XX) -- C:\Windows\System32\drivers\BCMWL6.SYS (Broadcom Corporation)DRV - (OEM02Dev) -- C:\Windows\System32\drivers\OEM02Dev.sys (Creative Technology Ltd.)DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC)DRV - (OEM02Vfx) -- C:\Windows\System32\drivers\OEM02Vfx.sys (EyePower Games Pte. Ltd.)DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC)DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)DRV - (speedfan) -- C:\Windows\system32\speedfan.sys (Windows ® 2000 DDK provider)DRV - (giveio) -- C:\Windows\system32\giveio.sys ()========== Standard Registry (All) ==================== Internet Explorer ==========IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-onsIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRiskIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ca.yahoo.comIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htmIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htmIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearchIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ca.yahoo.comIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-usIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 6E 80 23 5A 50 C2 CA 01 [binary data]IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local========== FireFox ==========FF - prefs.js..browser.search.defaultenginename: "Yahoo"FF - prefs.js..browser.search.defaulturl: "http://ca.search.yahoo.com/search?fr=ffsp1&p="FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"FF - prefs.js..browser.search.param.yahoo-type: "${8}"FF - prefs.js..browser.search.selectedEngine: "Google"FF - prefs.js..browser.startup.homepage: "http://ca.yahoo.com"FF - prefs.js..extensions.enabledItems: glasser@sixxgate.com:3.5.2FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100908FF - prefs.js..extensions.enabledItems: {097d3191-e6fa-4728-9826-b533d755359d}:0.7.11FF - prefs.js..extensions.enabledItems: {bee6eb20-01e0-ebd1-da83-080329fb9a3a}:0.1FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.7.1FF - prefs.js..extensions.enabledItems: smarterwiki@wikiatic.com:4.1.7FF - prefs.js..extensions.enabledItems: {5F590AA2-1221-4113-A6F4-A4BB62414FAC}:0.45.6.20100202.1FF - prefs.js..extensions.enabledItems: cfxHelper@Triton:1.2FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:5.0.31.0FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.10FF - prefs.js..extensions.enabledItems: {e213bb8f-8ebd-11db-96b7-005056c00008}:3.0.0.91FF - prefs.js..extensions.enabledItems: cfxe@Triton:3.6.5FF - prefs.js..keyword.URL: "http://ca.search.yahoo.com/search?fr=ffds1&p="FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/05/06 23:28:06 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/24 10:27:45 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/23 15:57:12 | 000,000,000 | ---D | M][2010/03/12 22:29:35 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Mozilla\Extensions[2010/03/12 22:29:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}[2010/10/20 18:08:01 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions[2010/03/12 22:33:37 | 000,000,000 | ---D | M] (All-in-One Sidebar) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}[2010/05/28 21:33:51 | 000,000,000 | ---D | M] (SmoothWheel (mozdev.org)) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\{5F590AA2-1221-4113-A6F4-A4BB62414FAC}[2010/09/09 19:17:23 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}[2010/09/17 20:52:18 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}[2010/03/12 22:33:37 | 000,000,000 | ---D | M] (Flash and Video Download) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}[2010/09/17 20:52:17 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}[2010/06/14 16:26:04 | 000,000,000 | ---D | M] (myFireFox) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\{e213bb8f-8ebd-11db-96b7-005056c00008}[2010/10/09 19:33:17 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\battlefieldheroespatcher@ea.com[2010/05/28 21:33:42 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\cfxe@Triton[2010/05/28 21:33:51 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\cfxHelper@Triton[2010/04/25 17:49:52 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\DTToolbar@toolbarnet.com[2010/03/12 22:33:37 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\glasser@sixxgate.com[2010/09/17 20:52:17 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\smarterwiki@wikiatic.com[2010/06/14 16:26:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\{e213bb8f-8ebd-11db-96b7-005056c00008}\chrome\mozapps\extensions[2010/04/25 17:49:45 | 000,002,059 | ---- | M] () -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\searchplugins\daemon-search.xml[2010/10/20 18:08:01 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions[2010/09/17 20:29:38 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}[2010/06/13 21:23:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}[2010/09/17 20:29:31 | 000,023,512 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll[2010/09/17 20:29:31 | 000,138,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll[2007/04/10 17:21:08 | 000,163,256 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll[2010/06/13 21:23:17 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll[2009/06/25 13:20:28 | 001,446,264 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll[2010/09/17 20:29:32 | 000,064,984 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll[2006/10/26 20:12:16 | 000,016,192 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL[2010/08/13 07:03:40 | 000,103,864 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll[2010/04/09 19:07:01 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll[2010/04/09 19:07:01 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll[2010/04/09 19:07:01 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll[2010/04/09 19:07:01 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll[2010/04/09 19:07:02 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll[2010/04/09 19:07:02 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll[2010/04/09 19:07:02 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll[2010/07/23 17:27:38 | 000,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml[2010/07/23 17:27:38 | 000,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml[2010/07/23 17:27:38 | 000,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml[2010/07/23 17:27:39 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml[2010/07/23 17:27:39 | 000,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml[2010/07/23 17:27:39 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml[2010/07/23 17:27:39 | 000,001,096 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xmlO1 HOSTS File: ([2010/05/13 17:53:40 | 000,001,204 | ---- | M]) - C:\Windows\System32\drivers\etc\hostsO1 - Hosts: 127.0.0.1 localhostO1 - Hosts: 127.0.0.1 activate.adobe.comO1 - Hosts: 127.0.0.1 3dns-3.adobe.comO1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.comO1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.comO1 - Hosts: 127.0.0.1 ereg.wip3.adobe.comO1 - Hosts: 127.0.0.1 activate-sea.adobe.comO1 - Hosts: 127.0.0.1 wip3.adobe.comO1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.comO1 - Hosts: 127.0.0.1 activate-sjc0.adobe.comO1 - Hosts: 127.0.0.1 practivate.adobe.comO1 - Hosts: 127.0.0.1 ereg.adobe.comO1 - Hosts: 127.0.0.1 activate.wip3.adobe.comO1 - Hosts: 127.0.0.1 3dns-2.adobe.comO1 - Hosts: 127.0.0.1 adobe-dns.adobe.com O1 - Hosts: ::1 localhostO2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\hpwuschd2.exe (Hewlett-Packard)O4 - HKLM..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe (Hewlett-Packard)O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)O4 - HKLM..\Run: [NVHotkey] C:\Windows\System32\nvHotkey.DLL (NVIDIA Corporation)O4 - HKLM..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe (Creative Technology Ltd.)O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)O4 - HKLM..\Run: [sunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)O4 - HKLM..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)O4 - HKCU..\Run: [search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)O4 - HKLM..\RunOnce: [] File not foundO4 - HKLM..\RunOnce: [GrpConv] C:\Windows\System32\grpconv.exe (Microsoft Corporation)O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)O4 - Startup: C:\Users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)O9 - Extra Button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\nlaapi.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} http://catalog.update.microsoft.com/v7/sit...b?1274152888223 (MUCatalogWebControl Class)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not foundO21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not foundO28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)O31 - SafeBoot: AlternateShell - cmd.exeO32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]O34 - HKLM BootExecute: (autocheck autochk /p \??\F:) - File not foundO34 - HKLM BootExecute: (autocheck autochk *) - File not foundO34 - HKLM BootExecute: (aswBoot.exe /A:* /L:1033 /heur:100 /pup /archives /IA:0 /KBD:2 /dir:C:\Program) - C:\Windows\System32\aswBoot.exe (AVAST Software)O35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*O37 - HKCU\...com [@ = ComFile] -- Reg Error: Key error. File not foundO37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not foundNetSvcs: FastUserSwitchingCompatibility - File not foundNetSvcs: Ias - File not foundNetSvcs: Nla - File not foundNetSvcs: Ntmssvc - File not foundNetSvcs: NWCWorkstation - File not foundNetSvcs: Nwsapagent - File not foundNetSvcs: SRService - File not foundNetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)NetSvcs: WmdmPmSp - File not foundNetSvcs: LogonHours - File not foundNetSvcs: PCAudit - File not foundNetSvcs: helpsvc - File not foundNetSvcs: uploadmgr - File not foundNetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)========== Files/Folders - Created Within 30 Days ==========[2010/10/20 19:35:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab[2010/10/20 18:36:10 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\Ryan\Desktop\OTL.exe[2010/10/20 17:43:02 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN[2010/10/20 17:41:48 | 000,000,000 | ---D | C] -- C:\Windows\temp[2010/10/20 17:29:57 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe[2010/10/20 17:29:57 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe[2010/10/20 17:29:57 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe[2010/10/20 17:29:51 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT[2010/10/20 17:29:34 | 000,000,000 | ---D | C] -- C:\Qoobox[2010/10/20 17:29:20 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe[2010/10/20 17:29:18 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW[2010/10/19 17:11:20 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys[2010/10/19 17:11:19 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys[2010/10/19 16:16:42 | 000,038,848 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr[2010/10/19 15:48:06 | 000,000,000 | ---D | C] -- C:\Windows\Minidump[2010/10/19 15:26:17 | 000,000,000 | ---D | C] -- C:\Users\Ryan\AppData\Roaming\Malwarebytes[2010/10/19 15:26:06 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware[2010/10/19 15:26:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes[2010/10/14 15:41:50 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll[2010/10/14 15:41:50 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll[2010/10/14 15:39:38 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll[2010/10/14 15:39:38 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll[2010/10/14 15:39:38 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll[2010/10/14 15:39:38 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll[2010/10/14 15:39:38 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll[2010/10/14 15:39:37 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb[2010/10/14 15:39:37 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec[2010/10/14 15:39:37 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll[2010/10/14 15:39:37 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll[2010/10/14 15:39:37 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll[2010/10/14 15:39:37 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe[2010/10/14 15:39:20 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll[2010/10/14 15:38:09 | 002,327,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys[2010/10/14 15:37:20 | 000,363,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\StructuredQuery.dll[2010/10/11 13:33:25 | 000,000,000 | ---D | C] -- C:\Users\Ryan\Documents\My Games[2010/10/09 20:11:45 | 000,000,000 | ---D | C] -- C:\Users\Ryan\AppData\Roaming\HPAppData[2010/10/09 19:45:05 | 000,000,000 | ---D | C] -- C:\Users\Ryan\Documents\Battlefield Heroes[2010/10/09 17:55:11 | 000,000,000 | ---D | C] -- C:\Program Files\GameSpy Arcade[2010/10/09 17:55:03 | 000,000,000 | ---D | C] -- C:\Users\Ryan\Documents\Battlefield 2[2010/09/29 10:33:55 | 000,190,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\ks.sys[2010/09/28 16:01:34 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll[2010/09/27 17:11:19 | 000,000,000 | ---D | C] -- C:\Users\Ryan\AppData\Roaming\Subversion[2010/09/24 10:34:12 | 000,000,000 | ---D | C] -- C:\Users\Ryan\AppData\Roaming\Auslogics[2010/09/24 10:34:09 | 000,000,000 | ---D | C] -- C:\Program Files\Auslogics[2010/09/21 23:00:50 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe[2010/09/21 22:54:16 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe Media Player[2010/09/21 22:38:45 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe Photoshop CS5 Extended Edition========== Files - Modified Within 30 Days ==========[2010/10/21 15:43:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat[2010/10/21 15:43:42 | 2817,048,576 | -HS- | M] () -- C:\hiberfil.sys[2010/10/20 18:43:49 | 000,034,560 | ---- | M] () -- C:\Windows\System32\drivers\Normandy.sys[2010/10/20 18:36:11 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Ryan\Desktop\OTL.exe[2010/10/20 17:24:54 | 415,961,351 | ---- | M] () -- C:\Windows\MEMORY.DMP[2010/10/19 17:12:44 | 000,010,848 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0[2010/10/19 17:12:44 | 000,010,848 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0[2010/10/19 17:11:23 | 000,001,005 | ---- | M] () -- C:\Users\Ryan\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk[2010/10/19 16:16:45 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt[2010/10/19 16:03:42 | 003,766,608 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT[2010/10/11 13:33:13 | 000,624,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat[2010/10/11 13:33:13 | 000,106,522 | ---- | M] () -- C:\Windows\System32\perfc009.dat[2010/10/11 13:28:56 | 000,139,128 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys[2010/10/11 13:28:47 | 000,215,128 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr[2010/10/09 19:44:12 | 000,138,056 | ---- | M] () -- C:\Users\Ryan\AppData\Roaming\PnkBstrK.sys[2010/10/09 19:43:34 | 002,427,248 | ---- | M] () -- C:\Windows\System32\pbsvc_heroes.exe[2010/10/09 18:15:07 | 000,002,052 | ---- | M] () -- C:\Users\Public\Desktop\Play BF2 Online Now!.lnk[2010/10/09 18:15:07 | 000,002,030 | ---- | M] () -- C:\Users\Public\Desktop\Battlefield 2.lnk[2010/10/07 22:35:18 | 000,103,606 | ---- | M] () -- C:\Users\Ryan\Documents\Science Study Notes.docx[2010/10/04 00:24:33 | 000,013,798 | ---- | M] () -- C:\Users\Ryan\Documents\September 6th.docx[2010/10/03 22:55:22 | 000,010,508 | ---- | M] () -- C:\Users\Ryan\Documents\The Sound of Guns.docx[2010/09/27 17:10:36 | 000,001,457 | ---- | M] () -- C:\Users\Ryan\Desktop\garrysmod - Shortcut.lnk[2010/09/24 10:34:10 | 000,001,108 | ---- | M] () -- C:\Users\Ryan\Desktop\Auslogics Disk Defrag.lnk[2010/09/23 15:57:14 | 000,001,986 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk========== Files Created - No Company Name ==========[2010/10/20 18:42:16 | 000,034,560 | ---- | C] () -- C:\Windows\System32\drivers\Normandy.sys[2010/10/20 17:29:57 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe[2010/10/20 17:29:57 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe[2010/10/20 17:29:57 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe[2010/10/20 17:29:57 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe[2010/10/20 17:29:57 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe[2010/10/20 17:24:54 | 415,961,351 | ---- | C] () -- C:\Windows\MEMORY.DMP[2010/10/19 16:34:31 | 000,001,005 | ---- | C] () -- C:\Users\Ryan\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk[2010/10/09 19:43:34 | 002,427,248 | ---- | C] () -- C:\Windows\System32\pbsvc_heroes.exe[2010/10/09 18:15:07 | 000,002,052 | ---- | C] () -- C:\Users\Public\Desktop\Play BF2 Online Now!.lnk[2010/10/09 18:15:07 | 000,002,030 | ---- | C] () -- C:\Users\Public\Desktop\Battlefield 2.lnk[2010/10/06 16:22:16 | 000,103,606 | ---- | C] () -- C:\Users\Ryan\Documents\Science Study Notes.docx[2010/10/04 00:17:28 | 000,013,798 | ---- | C] () -- C:\Users\Ryan\Documents\September 6th.docx[2010/10/03 22:50:54 | 000,010,508 | ---- | C] () -- C:\Users\Ryan\Documents\The Sound of Guns.docx[2010/09/27 17:10:36 | 000,001,457 | ---- | C] () -- C:\Users\Ryan\Desktop\garrysmod - Shortcut.lnk[2010/09/24 10:34:10 | 000,001,108 | ---- | C] () -- C:\Users\Ryan\Desktop\Auslogics Disk Defrag.lnk[2010/09/23 15:57:14 | 000,001,986 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk[2010/06/13 21:15:05 | 000,022,016 | ---- | C] () -- C:\Users\Ryan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2010/06/02 20:47:52 | 000,000,898 | ---- | C] () -- C:\Users\Ryan\AppData\Roaming\org.madan.notesgdg.txt[2010/04/29 23:03:21 | 000,002,153 | ---- | C] () -- C:\ProgramData\hpzinstall.log[2010/04/10 20:50:46 | 000,139,128 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys[2010/04/10 20:50:46 | 000,138,056 | ---- | C] () -- C:\Users\Ryan\AppData\Roaming\PnkBstrK.sys[2009/09/28 09:22:00 | 000,315,392 | ---- | C] () -- C:\Windows\System32\drivers\yk62x86.sys[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll[2005/05/06 20:06:00 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll[1996/04/03 15:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys========== LOP Check ==========[2010/06/13 21:36:36 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\AnvSoft[2010/09/24 10:34:12 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Auslogics[2010/09/29 14:57:26 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Azureus[2010/04/10 20:29:01 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\DAEMON Tools Lite[2010/05/30 18:35:24 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Facebook[2010/10/19 16:01:31 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Rainmeter[2010/08/21 13:07:04 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\SPORE[2010/09/27 17:11:19 | 000,000,000 | ---D | M] -- C:\Users\Ryan\AppData\Roaming\Subversion[2009/07/14 00:53:46 | 000,015,886 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT========== Purity Check ==================== Custom Scans ==========< %SYSTEMDRIVE%\*.* >[2010/03/09 16:26:32 | 000,000,630 | ---- | M] () -- C:\aaw7boot.log[2009/06/10 17:42:20 | 000,000,024 | ---- | M] () -- C:\autoexec.bat[2009/07/13 21:38:58 | 000,383,562 | RHS- | M] () -- C:\bootmgr[2010/03/12 22:42:16 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK[2010/10/20 17:44:02 | 000,012,334 | ---- | M] () -- C:\ComboFix.txt[2009/06/10 17:42:20 | 000,000,010 | ---- | M] () -- C:\config.sys[2008/12/31 18:54:44 | 000,004,953 | RH-- | M] () -- C:\dell.sdr[2010/10/21 15:43:42 | 2817,048,576 | -HS- | M] () -- C:\hiberfil.sys[2007/11/06 22:13:41 | 000,359,256 | ---- | M] (Hewlett-Packard) -- C:\hpzids40.dll[2010/03/04 23:10:12 | 000,000,000 | RHS- | M] () -- C:\IO.SYS[2006/12/02 01:37:14 | 000,904,704 | ---- | M] (Microsoft Corporation) -- C:\msdia80.dll[2010/03/04 23:10:12 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS[2010/10/21 15:43:43 | 3756,064,768 | -HS- | M] () -- C:\pagefile.sys[2010/04/18 21:03:13 | 000,005,776 | ---- | M] () -- C:\ST6UNST.LOG[2004/11/05 11:34:32 | 000,288,301 | ---- | M] () -- C:\StarForge Help.chm[2004/10/18 15:27:00 | 000,335,872 | ---- | M] () -- C:\StarForge.dll[2004/11/05 10:05:58 | 000,925,696 | ---- | M] (Flatline Productions) -- C:\StarForge.exe[2010/10/19 15:33:56 | 000,066,410 | ---- | M] () -- C:\TDSSKiller.2.4.4.0_19.10.2010_15.33.00_log.txt[2010/10/19 15:43:43 | 000,064,982 | ---- | M] () -- C:\TDSSKiller.2.4.4.0_19.10.2010_15.43.01_log.txt[2010/10/20 18:00:02 | 000,065,232 | ---- | M] () -- C:\TDSSKiller.2.4.4.0_20.10.2010_17.59.29_log.txt[2004/03/02 08:00:32 | 000,000,838 | ---- | M] () -- C:\Tips.txt[2004/11/05 10:55:37 | 000,019,123 | ---- | M] () -- C:\Version Info.htm< %systemroot%\system32\*.dll /lockedfiles >< %systemroot%\Tasks\*.job /lockedfiles >< %systemroot%\system32\drivers\*.sys /90 >[2010/09/07 10:47:07 | 000,017,744 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys[2010/09/07 10:47:30 | 000,050,768 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys[2010/09/07 10:47:46 | 000,023,376 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys[2010/09/07 10:52:03 | 000,165,584 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys[2010/09/07 10:52:25 | 000,046,672 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys[2010/10/20 18:43:49 | 000,034,560 | ---- | M] () -- C:\Windows\System32\drivers\Normandy.sys[2010/10/11 13:28:56 | 000,139,128 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys[2010/08/26 23:31:30 | 000,310,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\srv.sys[2010/08/26 23:30:47 | 000,308,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\srv2.sys[2010/08/26 23:30:40 | 000,113,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\srvnet.sys< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >[2007/12/03 18:55:24 | 000,278,016 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\1_hpzpp5mu.dll[2007/12/03 18:55:24 | 000,278,016 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\hpzpp5mu.dll[2009/07/13 21:15:35 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll[2006/10/26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll[2009/07/13 21:16:19 | 000,029,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll< End of report >Heres the MBRcheckMBRCheck, version 1.2.3© 2010, ADCommand-line: Windows Version: Windows 7 ProfessionalWindows Information: (build 7600), 32-bitBase Board Manufacturer: Dell Inc.BIOS Manufacturer: Dell Inc.System Manufacturer: Dell Inc.System Product Name: XPS M1530Logical Drives Mask: 0x0000001cKernel Drivers (total 134): 0x8200F000 \SystemRoot\system32\ntkrnlpa.exe 0x8241F000 \SystemRoot\system32\halmacpi.dll 0x80B99000 \SystemRoot\system32\kdcom.dll 0x8260A000 \SystemRoot\system32\mcupdate_GenuineIntel.dll 0x82682000 \SystemRoot\system32\PSHED.dll 0x82693000 \SystemRoot\system32\BOOTVID.dll 0x8269B000 \SystemRoot\system32\CLFS.SYS 0x826DD000 \SystemRoot\system32\CI.dll 0x82788000 \SystemRoot\system32\drivers\Wdf01000.sys 0x8B817000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x8B918000 \SystemRoot\System32\Drivers\WMILIB.SYS 0x8B921000 \SystemRoot\System32\Drivers\SCSIPORT.SYS 0x8B947000 \SystemRoot\system32\DRIVERS\ACPI.sys 0x8B98F000 \SystemRoot\system32\DRIVERS\msisadrv.sys 0x8B997000 \SystemRoot\system32\DRIVERS\vdrvroot.sys 0x8B9A2000 \SystemRoot\system32\DRIVERS\pci.sys 0x8B9CC000 \SystemRoot\System32\drivers\partmgr.sys 0x8B9DD000 \SystemRoot\system32\DRIVERS\compbatt.sys 0x8B9E5000 \SystemRoot\system32\DRIVERS\BATTC.SYS 0x8B9F0000 \SystemRoot\system32\DRIVERS\volmgr.sys 0x8BA2F000 \SystemRoot\System32\drivers\volmgrx.sys 0x8BA7A000 \SystemRoot\system32\DRIVERS\intelide.sys 0x8BA81000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS 0x8BA8F000 \SystemRoot\System32\drivers\mountmgr.sys 0x8BAA5000 \SystemRoot\system32\DRIVERS\atapi.sys 0x8BAAE000 \SystemRoot\system32\DRIVERS\ataport.SYS 0x8BAD1000 \SystemRoot\system32\DRIVERS\msahci.sys 0x8BADB000 \SystemRoot\system32\DRIVERS\amdxata.sys 0x8BAE4000 \SystemRoot\system32\drivers\fltmgr.sys 0x8BB18000 \SystemRoot\system32\drivers\fileinfo.sys 0x8BC02000 \SystemRoot\System32\Drivers\Ntfs.sys 0x8BD31000 \SystemRoot\System32\Drivers\msrpc.sys 0x8BD5C000 \SystemRoot\System32\Drivers\ksecdd.sys 0x8BD6F000 \SystemRoot\System32\Drivers\cng.sys 0x8BDCC000 \SystemRoot\System32\drivers\pcw.sys 0x8BDDA000 \SystemRoot\System32\Drivers\Fs_Rec.sys 0x8BB29000 \SystemRoot\system32\drivers\ndis.sys 0x8BE0E000 \SystemRoot\system32\drivers\NETIO.SYS 0x8BE4C000 \SystemRoot\System32\Drivers\ksecpkg.sys 0x8BE71000 \SystemRoot\System32\drivers\tcpip.sys 0x8BFBA000 \SystemRoot\System32\drivers\fwpkclnt.sys 0x8BFEB000 \SystemRoot\system32\DRIVERS\vmstorfl.sys 0x8C032000 \SystemRoot\system32\DRIVERS\volsnap.sys 0x8C079000 \SystemRoot\system32\speedfan.sys 0x8C07B000 \SystemRoot\System32\drivers\rdyboost.sys 0x8C0A8000 \SystemRoot\System32\Drivers\mup.sys 0x8C0B8000 \SystemRoot\System32\drivers\hwpolicy.sys 0x8C0C0000 \SystemRoot\system32\giveio.sys 0x8C0C1000 \SystemRoot\System32\DRIVERS\fvevol.sys 0x8C0F3000 \SystemRoot\system32\DRIVERS\disk.sys 0x8C104000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS 0x8C15C000 \SystemRoot\System32\Drivers\Null.SYS 0x8C163000 \SystemRoot\System32\Drivers\Beep.SYS 0x8C16A000 \SystemRoot\System32\drivers\vga.sys 0x8C176000 \SystemRoot\System32\drivers\VIDEOPRT.SYS 0x8C197000 \SystemRoot\System32\drivers\watchdog.sys 0x8C1A4000 \SystemRoot\system32\drivers\rdpencdd.sys 0x8C1AC000 \SystemRoot\System32\Drivers\Msfs.SYS 0x8C1B7000 \SystemRoot\System32\Drivers\Npfs.SYS 0x8C1C5000 \SystemRoot\system32\DRIVERS\tdx.sys 0x8C1DC000 \SystemRoot\system32\DRIVERS\TDI.SYS 0x8B825000 \SystemRoot\system32\drivers\afd.sys 0x8C1F1000 \SystemRoot\System32\Drivers\aswRdr.SYS 0x8C000000 \SystemRoot\System32\DRIVERS\netbt.sys 0x8C071000 \SystemRoot\system32\DRIVERS\wfplwf.sys 0x8BBE0000 \SystemRoot\system32\DRIVERS\pacer.sys 0x8BDE3000 \SystemRoot\system32\DRIVERS\vwififlt.sys 0x8BE00000 \SystemRoot\system32\DRIVERS\netbios.sys 0x8B87F000 \SystemRoot\system32\DRIVERS\rdbss.sys 0x8C1E7000 \SystemRoot\system32\drivers\nsiproxy.sys 0x8FA3C000 \SystemRoot\system32\drivers\csc.sys 0x8FAA0000 \SystemRoot\System32\Drivers\dfsc.sys 0x8FAB8000 \SystemRoot\system32\DRIVERS\tunnel.sys 0x8FAD9000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0x8FAE4000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x8FB2F000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x8FB3E000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0x8FB5D000 \SystemRoot\system32\DRIVERS\yk62x86.sys 0x90011000 \SystemRoot\system32\DRIVERS\bcmwl6.sys 0x90278000 \SystemRoot\system32\DRIVERS\vwifibus.sys 0x90282000 \SystemRoot\system32\DRIVERS\1394ohci.sys 0x902AE000 \SystemRoot\system32\DRIVERS\rimmptsk.sys 0x902BD000 \SystemRoot\system32\DRIVERS\rimsptsk.sys 0x902D1000 \SystemRoot\system32\DRIVERS\rixdptsk.sys 0x90322000 \SystemRoot\system32\DRIVERS\i8042prt.sysAgain thanks for the help. Link to post Share on other sites More sharing options...
kahdah Posted October 21, 2010 ID:331272 Share Posted October 21, 2010 You are welcome was that the complete mbr check log?Please try to attach it.Please also delete combofix from off of your desktop then do the following.Please visit this webpage for download links, and instructions for running ComboFix: http://www.bleepingcomputer.com/combofix/how-to-use-combofix* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Please include the C:\ComboFix.txt in your next reply for further review. Link to post Share on other sites More sharing options...
xevous Posted October 22, 2010 Author ID:331398 Share Posted October 22, 2010 Yes the MBR log did not go furthur than that. Here is the new ComboFix Log...ComboFix 10-10-21.02 - Ryan 10/21/2010 20:32:48.2.2 - x86Running from: c:\users\Ryan\Downloads\ComboFix.exe.((((((((((((((((((((((((( Files Created from 2010-09-22 to 2010-10-22 ))))))))))))))))))))))))))))))).2010-10-22 00:42 . 2010-10-22 00:42 -------- d-----w- c:\users\Default\AppData\Local\temp2010-10-20 23:35 . 2010-10-20 23:35 -------- d-----w- c:\programdata\Kaspersky Lab2010-10-20 22:42 . 2010-10-20 22:43 34560 ----a-w- c:\windows\system32\drivers\Normandy.sys2010-10-19 21:11 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2010-10-19 21:11 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys2010-10-19 20:16 . 2010-09-07 15:12 38848 ----a-w- c:\windows\avastSS.scr2010-10-19 20:11 . 2010-10-07 23:21 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{51828758-C0C2-4085-9748-8BD0A2533B0E}\mpengine.dll2010-10-19 19:26 . 2010-10-19 21:10 -------- d-----w- c:\users\Ryan\AppData\Roaming\Malwarebytes2010-10-19 19:26 . 2010-10-19 21:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2010-10-19 19:26 . 2010-10-19 21:10 -------- d-----w- c:\programdata\Malwarebytes2010-10-14 19:41 . 2010-08-31 04:32 954752 ----a-w- c:\windows\system32\mfc40.dll2010-10-14 19:41 . 2010-08-31 04:32 954288 ----a-w- c:\windows\system32\mfc40u.dll2010-10-14 19:40 . 2010-06-29 04:57 4247040 ----a-w- c:\program files\Windows NT\Accessories\wordpad.exe2010-10-14 19:40 . 2010-09-01 04:26 164864 ----a-w- c:\program files\Windows Media Player\wmplayer.exe2010-10-14 19:38 . 2010-09-01 02:34 2327552 ----a-w- c:\windows\system32\win32k.sys2010-10-14 19:37 . 2010-08-27 03:31 310784 ----a-w- c:\windows\system32\drivers\srv.sys2010-10-14 19:37 . 2010-08-27 03:30 308736 ----a-w- c:\windows\system32\drivers\srv2.sys2010-10-14 19:37 . 2010-08-27 03:30 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys2010-10-14 19:37 . 2010-05-05 06:46 363520 ----a-w- c:\windows\system32\StructuredQuery.dll2010-10-10 00:11 . 2010-10-10 00:11 -------- d-----w- c:\users\Ryan\AppData\Roaming\HPAppData2010-10-09 23:43 . 2010-10-09 23:43 2427248 ----a-w- c:\windows\system32\pbsvc_heroes.exe2010-10-09 21:55 . 2010-10-09 21:55 -------- d-----w- c:\program files\GameSpy Arcade2010-10-09 21:33 . 2004-10-22 06:17 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll2010-10-09 21:33 . 2004-10-22 06:17 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll2010-10-09 21:33 . 2004-10-22 06:16 180224 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll2010-10-09 21:33 . 2004-10-22 06:16 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe2010-10-09 21:33 . 2004-10-22 06:18 749568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll2010-10-09 21:33 . 2010-10-09 21:33 323716 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll2010-10-09 21:33 . 2010-10-09 21:33 192644 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll2010-09-29 14:33 . 2010-03-04 04:04 146304 ----a-w- c:\windows\system32\drivers\usbvideo.sys2010-09-29 14:33 . 2010-03-04 03:57 190976 ----a-w- c:\windows\system32\drivers\ks.sys2010-09-28 20:01 . 2010-06-19 06:15 2048 ----a-w- c:\windows\system32\tzres.dll2010-09-28 20:01 . 2010-08-27 05:30 13312 ----a-w- c:\program files\Internet Explorer\iecompat.dll2010-09-27 21:11 . 2010-09-27 21:11 -------- d-----w- c:\users\Ryan\AppData\Roaming\Subversion2010-09-24 14:34 . 2010-09-24 14:34 -------- d-----w- c:\users\Ryan\AppData\Roaming\Auslogics2010-09-24 14:34 . 2010-09-24 14:34 -------- d-----w- c:\program files\Auslogics2010-09-22 03:00 . 2010-09-22 03:18 -------- d-----w- c:\programdata\regid.1986-12.com.adobe2010-09-22 02:54 . 2010-09-22 02:54 -------- d-----w- c:\program files\Adobe Media Player2010-09-22 02:38 . 2010-04-30 19:37 -------- d-----w- c:\program files\Adobe Photoshop CS5 Extended Edition.(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2010-06-01 5252408]"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-05-09 36864]"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624]"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2010-07-09 261736]"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]c:\users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-23 270336]Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2010-7-25 113664][HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 0 (0x0)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableLUA"= 0 (0x0)"EnableUIADesktopToggle"= 0 (0x0)"PromptOnSecureDesktop"= 0 (0x0)[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]"aux"=wdmaud.drv[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]BootExecute REG_MULTI_SZ autocheck autochk /p \??\f:\0autocheck autochk *\0aswBoot.exe /A:* /L:1033 /heur:100 /pup /archives /IA:0 /KBD:2 /dir:C:\ProgramR2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]R3 Normandy;Normandy SR2; [x]R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-03-27 1343400]R3 XDva349;XDva349;c:\windows\system32\XDva349.sys [x]R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-04-11 691696]S1 aswSP;aswSP; [x]S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]S2 aswFsBlk;aswFsBlk; [x]S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12HPService REG_MULTI_SZ HPSLPSVChpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc..------- Supplementary Scan -------.uStart Page = hxxp://ca.yahoo.commStart Page = hxxp://ca.yahoo.comuInternet Settings,ProxyOverride = *.localIE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000FF - ProfilePath - c:\users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\FF - prefs.js: browser.search.defaulturl - hxxp://ca.search.yahoo.com/search?fr=ffsp1&p=FF - prefs.js: browser.search.selectedEngine - GoogleFF - prefs.js: browser.startup.homepage - hxxp://ca.yahoo.comFF - prefs.js: keyword.URL - hxxp://ca.search.yahoo.com/search?fr=ffds1&p=FF - component: c:\users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\cfxHelper@Triton\components\dwmxpcom.dllFF - component: c:\users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\glasser@sixxgate.com\components\dwmxpcom.dllFF - plugin: c:\program files\Google\Picasa3\npPicasa3.dllFF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dllFF - plugin: c:\program files\Pando Networks\Media Booster\npPandoWebPlugin.dllFF - plugin: c:\users\Ryan\AppData\Roaming\Facebook\npfbplugin_1_0_3.dllFF - plugin: c:\users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\i5bk8k6d.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll---- FIREFOX POLICIES ----FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);..--------------------- LOCKED REGISTRY KEYS ---------------------[HKEY_USERS\S-1-5-21-3614805724-1640397324-534972597-1001\Software\SecuROM\License information*]"datasecu"=hex:63,20,6f,61,8b,65,4d,2a,c6,4a,21,43,1f,b3,c1,f2,9c,ac,83,a8,cf, 2a,54,9f,b8,13,ef,2f,ce,d1,a5,0f,36,c3,88,0e,3a,08,0e,d9,4e,e8,31,d6,bc,c8,\"rkeysecu"=hex:64,b6,bd,e1,3e,80,9e,c4,40,b4,90,83,87,8e,33,49[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]"Enabled"=dword:00000001[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]@Denied: (A 2) (Everyone)@="IFlashBroker4"[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}"[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0"[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).Completion time: 2010-10-21 20:46:18ComboFix-quarantined-files.txt 2010-10-22 00:46ComboFix2.txt 2010-10-20 21:44Pre-Run: 122,361,802,752 bytes freePost-Run: 122,311,528,448 bytes free- - End Of File - - 595C89558129B9431A49662B37F35D34 Link to post Share on other sites More sharing options...
xevous Posted October 22, 2010 Author ID:331424 Share Posted October 22, 2010 Sorry about the double post, but I was just curious. My MBAM doesnt update and I get this error is there anything else to this problem? Link to post Share on other sites More sharing options...
kahdah Posted October 22, 2010 ID:331550 Share Posted October 22, 2010 What error are you referring to?Are you connected via a router? Link to post Share on other sites More sharing options...
LDTate Posted November 13, 2010 ID:344373 Share Posted November 13, 2010 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts