muckdork Posted December 24, 2010 ID:365146 Share Posted December 24, 2010 Hello, I was hoping you could help me. I've been having a couple of problems for months now and now I'm trying to systematically go about removing as much malware I can. I'm running Windows VistaI've downloaded Malwarebytes and registered the product but a few things happen. I can install perfectly fine and when it asks me to update and scan it does so. Except when it scans, it freezes for a second, and then it gets a (Not Responding) next to the title bar then it closes. When I try to run it again I get a "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item."I've read around and it was suggested to rename mbam.exe into something else but even I can't do that. When I try to rename it tells me "I need permission to perform this action."I've tried to follow the instructions here. The defogger works but it doesn't prompt me to restart the computer. I can download DDS but when I try to run it, a black screen pops up with some text but closes the instant it opens. It says I need to disable any script blockers but I don't have any other av programs on my computer.I've downloaded and run the GMER Rootkit Scanner on two instances. The first one ended in a blue screen of death. I tried it again, it worked for awhile, but then it closes unexpectedly.I tried following what was in this thread. It ran once, closed unexpectedly, and when I tried opening it again it said I did not have permission.Other things: The problem started when I no longer could run iexplore and firefox, I can only use Safari and Google Chrome. For awhile I had a google redirect bug, but I believe I fixed that. Windows Security Center doesn't work. Right now the service is off and when I try to turn it on it keeps telling me that it can't be started. I had so many av programs and whatnots that I have uninstalled, but am unsure if it is completely uninstalled. I've had AVG, Spyware Doctor, and RegCure run and tell me I have viruses. On Spyware Doctor, everytime I try to remove or quarantine the 26-40 bugs (it would cycle between these numbers depending on the day) I would get a Blue Screen of Death. I would love to give you logs but DDS isn't working for me. I've been using torrents, but have just recently stopped. Apparently, I have everything going against me and probably have deserved it. I do hope to get the problem fixed so if it does happen again, I'll know what to do. Thanks for your time. Link to post Share on other sites More sharing options...
kahdah Posted December 24, 2010 ID:365251 Share Posted December 24, 2010 Hello muckdorkWelcome to Malwarebytes.=====================Download OTL to your desktop.Double click on OTL to run it.When the window appears, underneath Output at the top change it to Minimal Output.Under the Standard Registry box change it to All.Check the boxes beside LOP Check and Purity Check.Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.====================Download This file. Note its name and save it to your root folder, such as C:\.Disconnect from the Internet and close all running programs.Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.Click on this link to see a list of programs that should be disabled.Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")Allow the driver to load if asked.You may be prompted to scan immediately if it detects rootkit activity.If you are prompted to scan your system click "Yes" to begin the scan.If not prompted, click the "Rootkit/Malware" tab.On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.Select all drives that are connected to your system to be scanned.Click the Scan button to begin. (Please be patient as it can take some time to complete)When the scan is finished, click Save to save the scan results to your Desktop.Save the file as Results.log and copy/paste the contents in your next reply.Exit the program and re-enable all active protection when done. Link to post Share on other sites More sharing options...
muckdork Posted December 24, 2010 Author ID:365336 Share Posted December 24, 2010 OTL worked, here are the resulting logs. OTL.txt: OTL logfile created on: 12/24/2010 5:09:19 PM - Run 1 OTL by OldTimer - Version 3.2.18.0 Folder = C:\Users\Neal\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18999) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 58.00% Memory free 6.00 Gb Paging File | 5.00 Gb Available in Paging File | 77.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 287.95 Gb Total Space | 31.44 Gb Free Space | 10.92% Space Free | Partition Type: NTFS Drive D: | 10.00 Gb Total Space | 4.62 Gb Free Space | 46.18% Space Free | Partition Type: NTFS Computer Name: NEAL-PC | User Name: Neal | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Neal\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - C:\Users\Neal\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) PRC - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom) PRC - C:\Program Files\Search Settings\SearchSettings.exe (Spigot, Inc.) PRC - C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe () PRC - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.) PRC - C:\ProgramData\SingleClick Systems\Remote Access File Sync Service\dsl_fs_sync.exe (SingleClick Systems) PRC - C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation) PRC - C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation) PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.) PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.) PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.) PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.) PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.) PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_2ba5baa4\stacsv.exe (IDT, Inc.) PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_2ba5baa4\AEstSrv.exe (Andrea Electronics Corporation) PRC - C:\Program Files\Dell Video Chat\DellVideoChat.exe (Dell Inc. and SightSpeed Inc.) PRC - C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.) PRC - C:\Windows\System32\wermgr.exe (Microsoft Corporation) PRC - C:\ProgramData\SingleClick Systems\apache\bin\httpd.exe (Apache Software Foundation) PRC - C:\ProgramData\SingleClick Systems\MySQL\bin\mysqld.exe () PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation) ========== Modules (SafeList) ========== MOD - C:\Users\Neal\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (Lavasoft Ad-Aware Service) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe File not found SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) SRV - (WAS) -- C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation) SRV - (W3SVC) -- C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation) SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.) SRV - (TomTomHOMEService) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom) SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (AppHostSvc) -- C:\Windows\System32\inetsrv\apphostsvc.dll (Microsoft Corporation) SRV - (GoToAssist) -- C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.) SRV - (GoogleDesktopManager-092308-165331) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) SRV - (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.) SRV - (hnmsvc) -- c:\ProgramData\SingleClick Systems\Advanced Networking Service\hnm_svc.exe (Dell Inc.) SRV - (dsl-fs-sync) -- C:\ProgramData\SingleClick Systems\Remote Access File Sync Service\dsl_fs_sync.exe (SingleClick Systems) SRV - (DockLoginService) -- C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation) SRV - (STacSV) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_2ba5baa4\stacsv.exe (IDT, Inc.) SRV - (AESTFilters) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_2ba5baa4\AEstSrv.exe (Andrea Electronics Corporation) SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (Apache2.2) -- C:\ProgramData\SingleClick Systems\apache\bin\httpd.exe (Apache Software Foundation) SRV - (dsl-db) -- C:\ProgramData\SingleClick Systems\MySQL\bin\mysqld.exe () SRV - (Viewpoint Manager Service) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation) ========== Driver Services (SafeList) ========== DRV - (rootrepeal) -- C:\Windows\System32\drivers\rootrepeal.sys File not found DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found DRV - (Lavasoft Kernexplorer) -- C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys File not found DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation) DRV - (SCDEmu) -- C:\Windows\System32\drivers\scdemu.sys (PowerISO Computing, Inc.) DRV - (BCM42RLY) -- C:\Windows\System32\drivers\bcm42rly.sys (Broadcom Corporation) DRV - (BCM43XX) -- C:\Windows\System32\drivers\BCMWL6.SYS (Broadcom Corporation) DRV - (OA001Ufd) -- C:\Windows\System32\drivers\OA001Ufd.sys (Creative Technology Ltd.) DRV - (OA001Vid) -- C:\Windows\System32\drivers\OA001Vid.sys (Creative Technology Ltd.) DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.) DRV - (k57nd60x) Broadcom NetLink -- C:\Windows\System32\drivers\k57nd60x.sys (Broadcom Corporation) DRV - (itecir) -- C:\Windows\System32\drivers\itecir.sys (ITE Tech. Inc. ) DRV - (STHDA) -- C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.) DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC) DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC) DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC) DRV - (Packet) -- C:\Windows\System32\drivers\packet.sys (SingleClick Systems) DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (e1express) Intel® -- C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (E1G60) Intel® -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (xnacc) -- C:\Windows\System32\drivers\xnacc.sys (Microsoft Corporation) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (XBCD) -- C:\Windows\System32\drivers\xbcd.sys (Redcl0ud) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (BrUsbSer) -- C:\Windows\System32\drivers\BrUsbSer.sys (Brother Industries Ltd.) DRV - (BrSerIf) -- C:\Windows\System32\drivers\BrSerIf.sys (Brother Industries Ltd.) ========== Standard Registry (All) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&cl...amp;ibd=4081218 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data over 100 bytes] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [binary data over 100 bytes] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/dell?hl=en&cl...amp;ibd=4081218 IE - HKLM\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&cl...amp;ibd=4081218 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm...tf8&oe=utf8 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/dell?hl=en&cl...amp;ibd=4081218 IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation) IE - HKCU\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb128\SearchSettings.dll (Spigot, Inc.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:56566 FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2010/11/20 16:32:07 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord\firefox\ext [2010/11/20 16:32:26 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\FFToolbar@bitdefender.com: C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\ [2010/11/13 08:40:06 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.4\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/24 09:50:17 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.4\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/12 17:46:11 | 000,000,000 | ---D | M] [2010/01/29 19:34:04 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\Mozilla\Extensions [2010/01/29 19:34:04 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com [2010/06/25 22:50:53 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2010/06/25 22:50:53 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2010/06/14 07:16:50 | 000,023,512 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll [2010/06/14 07:16:51 | 000,138,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll [2010/06/14 07:16:52 | 000,064,984 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll [2010/12/12 17:46:10 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll [2010/12/12 17:46:10 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll [2010/12/12 17:46:10 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll [2010/12/12 17:46:10 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll [2010/12/12 17:46:11 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll [2010/12/12 17:46:11 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll [2010/12/12 17:46:11 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll [2010/06/11 17:14:06 | 000,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml [2010/06/11 17:14:06 | 000,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml [2010/06/11 17:14:06 | 000,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml [2010/06/11 17:14:06 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml [2010/06/11 17:14:06 | 000,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml [2010/06/11 17:14:06 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml O1 HOSTS File: ([2006/09/18 16:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll File not found O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found. O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (no name) - {99E00A4C-D35E-11DD-BA95-9B6A56D89593} - No CLSID value found. O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.) O2 - BHO: (AIM Toolbar Loader) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.) O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.) O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.) O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (SearchSettings Class) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb128\SearchSettings.dll (Spigot, Inc.) O3 - HKLM\..\Toolbar: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll File not found O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKLM\..\Toolbar: (AIM Toolbar) - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (AIM Toolbar) - {61539ECD-CC67-4437-A03C-9AACCBD14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.) O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.) O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.) O4 - HKLM..\Run: [broadcom Wireless Manager UI] C:\Windows\System32\WLTRAY.EXE (Dell Inc.) O4 - HKLM..\Run: [Dell DataSafe Online] C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe () O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.) O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.) O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.) O4 - HKLM..\Run: [searchSettings] C:\Program Files\Search Settings\SearchSettings.exe (Spigot, Inc.) O4 - HKLM..\Run: [startCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [sunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.) O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe File not found O4 - HKCU..\Run: [ehTray.exe] C:\Windows\ehome\ehtray.exe (Microsoft Corporation) O4 - HKCU..\Run: [Google Update] C:\Users\Neal\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.) O4 - HKCU..\Run: [sightSpeed] C:\Program Files\Dell Video Chat\DellVideoChat.exe (Dell Inc. and SightSpeed Inc.) O4 - HKCU..\Run: [steam] C:\Program Files\Steam\Steam.exe (Valve Corporation) O4 - HKCU..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe File not found O4 - HKCU..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom) O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O4 - Startup: C:\Users\Neal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BindDirectlyToPropertySetStorage = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O9 - Extra Button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll () O9 - Extra 'Tools' menuitem : Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll () O9 - Extra Button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPLive.exe () O9 - Extra 'Tools' menuitem : PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPLive.exe () O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\nlaapi.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 65.32.5.111 65.32.5.112 O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation) O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation) O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation) O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\Windows\System32\shell32.dll (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\Windows\System32\sysdm.cpl (Microsoft Corporation) O20 - HKCU Winlogon: Shell - (EXPLORER.EXE) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation) O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\Windows\System32\browseui.dll (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\Seagull_1920x1200.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\Seagull_1920x1200.jpg O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation) O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation) O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation) O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation) O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{013b04e9-d2d9-11dd-9ff6-00217090355d}\Shell - "" = AutoRun O33 - MountPoints2\{013b04e9-d2d9-11dd-9ff6-00217090355d}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found O33 - MountPoints2\F\Shell - "" = AutoRun O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010/12/24 17:08:24 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\Neal\Desktop\OTL.exe [2010/12/24 10:26:38 | 007,734,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Neal\Desktop\mbam-setup.exe [2010/12/24 02:22:21 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010/12/24 02:22:18 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010/12/24 02:22:18 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010/12/23 22:09:29 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com [2010/12/23 22:09:28 | 000,000,000 | ---D | C] -- C:\Users\Neal\AppData\Roaming\SUPERAntiSpyware.com [2010/12/19 18:59:33 | 000,000,000 | ---D | C] -- C:\New Folder [2010/12/15 17:34:35 | 000,352,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll [2010/12/15 17:34:34 | 000,345,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll [2010/12/15 17:34:34 | 000,270,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll [2010/12/15 17:34:29 | 002,038,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2010/12/15 17:34:19 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe [2010/12/15 17:34:16 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2010/12/15 17:34:16 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll [2010/12/15 17:34:16 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2010/12/15 17:34:09 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2010/12/15 17:34:08 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2010/12/15 17:34:07 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2010/12/15 17:34:07 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2010/12/15 17:34:07 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2010/12/15 17:34:07 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2010/12/15 17:34:07 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2010/12/15 17:34:07 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2010/12/15 17:34:06 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2010/12/15 17:34:06 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2010/12/15 17:34:06 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2010/12/15 17:34:06 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll [2010/12/15 17:34:06 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2010/12/15 17:34:06 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2010/12/15 17:34:06 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2010/12/15 17:34:06 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll [2010/12/15 17:34:06 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2010/12/15 17:33:43 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll [2010/12/12 18:22:17 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2010/12/12 17:53:28 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2010/12/12 17:53:20 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2010/12/12 17:45:18 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime [2010/12/12 17:41:44 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update [2010/12/08 15:27:07 | 000,000,000 | ---D | C] -- C:\Qoobox [2010/12/08 15:12:24 | 000,000,000 | ---D | C] -- C:\Users\Neal\AppData\Roaming\Malwarebytes [2010/12/08 15:12:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010/11/28 18:28:23 | 000,000,000 | R--D | C] -- C:\32788R22FWJFW [2010/11/28 18:27:29 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW.0.tmp [2010/11/27 20:38:03 | 000,000,000 | ---D | C] -- C:\Users\Neal\Desktop\Final Fantasy Guitar Collections [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2049/12/31 15:00:00 | 000,011,300 | ---- | M] () -- C:\Users\Neal\Desktop\line-up September 2009 revised 09-04-09.pdf [2049/12/31 15:00:00 | 000,010,628 | ---- | M] () -- C:\Users\Neal\Desktop\line-up September 2009 revised 09-04-09 CHOIR.pdf [2010/12/24 17:10:33 | 000,296,448 | ---- | M] () -- C:\2216yc0d.exe [2010/12/24 17:08:30 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Neal\Desktop\OTL.exe [2010/12/24 17:05:59 | 000,961,204 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010/12/24 17:05:59 | 000,227,840 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010/12/24 17:04:04 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job [2010/12/24 17:01:18 | 000,002,463 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Dell Remote Access.lnk [2010/12/24 16:58:48 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010/12/24 16:58:48 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010/12/24 16:58:28 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010/12/24 16:58:28 | 000,000,000 | ---- | M] () -- C:\Windows\win32k.sys [2010/12/24 16:58:13 | 3215,867,904 | -HS- | M] () -- C:\hiberfil.sys [2010/12/24 13:13:05 | 000,007,620 | ---- | M] () -- C:\Users\Neal\AppData\Local\d3d9caps.dat [2010/12/24 12:27:33 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1197788753-1558133579-3234769001-1000UA.job [2010/12/24 11:00:36 | 000,296,448 | ---- | M] () -- C:\Users\Neal\Desktop\f95nbw5h.exe [2010/12/24 11:00:07 | 000,624,128 | ---- | M] () -- C:\Users\Neal\Desktop\dds.scr [2010/12/24 10:59:10 | 000,000,000 | ---- | M] () -- C:\Users\Neal\defogger_reenable [2010/12/24 10:46:06 | 000,000,932 | ---- | M] () -- C:\Users\Neal\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk [2010/12/24 10:46:06 | 000,000,908 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010/12/24 10:27:39 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Neal\Desktop\mbam-setup.exe [2010/12/24 10:17:10 | 000,000,000 | ---- | M] () -- C:\Users\Neal\Desktop\settings.dat [2010/12/24 02:20:44 | 000,780,283 | ---- | M] () -- C:\Users\Neal\Desktop\rkill.exe [2010/12/24 00:55:29 | 000,061,225 | ---- | M] () -- C:\Users\Neal\AppData\Roaming\E1EA.F89 [2010/12/23 21:28:24 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1197788753-1558133579-3234769001-1000Core.job [2010/12/22 22:16:29 | 000,675,646 | ---- | M] () -- C:\Users\Neal\Desktop\60450.htm [2010/12/22 22:16:09 | 000,080,502 | ---- | M] () -- C:\Users\Neal\Desktop\60451.htm [2010/12/22 22:14:42 | 000,546,699 | ---- | M] () -- C:\Users\Neal\Desktop\60437.htm [2010/12/21 22:29:04 | 005,877,964 | ---- | M] () -- C:\Users\Neal\Desktop\lotro_quickstart_lowres.pdf [2010/12/21 22:28:57 | 005,654,641 | ---- | M] () -- C:\Users\Neal\Desktop\lotro_mines_of_moria_manual.pdf [2010/12/21 11:50:01 | 000,108,544 | ---- | M] () -- C:\Users\Neal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010/12/21 03:16:34 | 000,063,379 | ---- | M] () -- C:\Users\Neal\Desktop\sobad.jpg [2010/12/21 02:51:42 | 000,102,444 | ---- | M] () -- C:\Users\Neal\Desktop\2007-05-22-302moon.gif [2010/12/21 02:14:56 | 000,035,543 | ---- | M] () -- C:\Users\Neal\Desktop\ahh.jpg [2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010/12/20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010/12/19 19:00:06 | 000,000,564 | ---- | M] () -- C:\Users\Public\Desktop\DSM Movie Encoder.lnk [2010/12/16 03:30:55 | 001,631,768 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010/12/12 18:22:18 | 000,001,878 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2010/12/12 17:56:00 | 000,001,666 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk [2010/12/11 08:48:24 | 000,001,049 | ---- | M] () -- C:\Users\Public\Desktop\EA Download Manager.lnk [2010/12/01 23:42:39 | 000,047,972 | ---- | M] () -- C:\Users\Neal\Desktop\pOV0C4YoPcxka63.jpg [2010/12/01 22:33:48 | 000,013,002 | ---- | M] () -- C:\Users\Neal\Desktop\doug-23808.jpg [2010/12/01 07:58:52 | 000,122,380 | -H-- | M] () -- C:\Windows\System32\mlfcache.dat [2010/11/26 13:01:42 | 021,655,516 | ---- | M] () -- C:\Users\Neal\Desktop\FE QUANTUM blue .pptx [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2010/12/24 16:58:13 | 3215,867,904 | -HS- | C] () -- C:\hiberfil.sys [2010/12/24 11:00:33 | 000,296,448 | ---- | C] () -- C:\Users\Neal\Desktop\f95nbw5h.exe [2010/12/24 11:00:03 | 000,624,128 | ---- | C] () -- C:\Users\Neal\Desktop\dds.scr [2010/12/24 10:59:10 | 000,000,000 | ---- | C] () -- C:\Users\Neal\defogger_reenable [2010/12/24 10:46:06 | 000,000,932 | ---- | C] () -- C:\Users\Neal\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk [2010/12/24 10:17:10 | 000,000,000 | ---- | C] () -- C:\Users\Neal\Desktop\settings.dat [2010/12/24 10:17:07 | 000,472,064 | ---- | C] () -- C:\Users\Neal\Desktop\RootRepeal.exe [2010/12/24 02:22:21 | 000,000,908 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010/12/24 02:20:36 | 000,780,283 | ---- | C] () -- C:\Users\Neal\Desktop\rkill.exe [2010/12/23 15:04:16 | 000,559,916 | ---- | C] () -- C:\Users\Neal\Desktop\Userguide_en.pdf [2010/12/22 22:16:28 | 000,675,646 | ---- | C] () -- C:\Users\Neal\Desktop\60450.htm [2010/12/22 22:16:10 | 000,080,502 | ---- | C] () -- C:\Users\Neal\Desktop\60451.htm [2010/12/22 22:14:43 | 000,546,699 | ---- | C] () -- C:\Users\Neal\Desktop\60437.htm [2010/12/21 22:28:22 | 005,877,964 | ---- | C] () -- C:\Users\Neal\Desktop\lotro_quickstart_lowres.pdf [2010/12/21 22:28:17 | 005,654,641 | ---- | C] () -- C:\Users\Neal\Desktop\lotro_mines_of_moria_manual.pdf [2010/12/21 03:16:42 | 000,063,379 | ---- | C] () -- C:\Users\Neal\Desktop\sobad.jpg [2010/12/21 02:51:46 | 000,102,444 | ---- | C] () -- C:\Users\Neal\Desktop\2007-05-22-302moon.gif [2010/12/21 02:14:56 | 000,035,543 | ---- | C] () -- C:\Users\Neal\Desktop\ahh.jpg [2010/12/19 21:15:01 | 134,217,728 | ---- | C] () -- C:\Users\Neal\Desktop\9 Hours 9 Persons 9 Doors.nds [2010/12/19 19:00:06 | 000,000,564 | ---- | C] () -- C:\Users\Public\Desktop\DSM Movie Encoder.lnk [2010/12/12 18:22:18 | 000,001,878 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk [2010/12/12 17:56:00 | 000,001,666 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk [2010/12/11 08:48:24 | 000,001,049 | ---- | C] () -- C:\Users\Public\Desktop\EA Download Manager.lnk [2010/12/03 14:40:05 | 000,061,225 | ---- | C] () -- C:\Users\Neal\AppData\Roaming\E1EA.F89 [2010/12/01 23:42:42 | 000,047,972 | ---- | C] () -- C:\Users\Neal\Desktop\pOV0C4YoPcxka63.jpg [2010/12/01 22:33:55 | 000,013,002 | ---- | C] () -- C:\Users\Neal\Desktop\doug-23808.jpg [2010/12/01 07:58:52 | 000,122,380 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat [2010/11/26 16:50:26 | 021,655,516 | ---- | C] () -- C:\Users\Neal\Desktop\FE QUANTUM blue .pptx [2010/10/23 02:00:20 | 000,000,552 | ---- | C] () -- C:\Users\Neal\AppData\Local\d3d8caps.dat [2010/08/20 19:41:08 | 000,000,262 | ---- | C] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini [2010/08/18 10:32:50 | 000,000,025 | ---- | C] () -- C:\Users\Neal\AppData\Roaming\bdfvconp.ini [2010/07/24 21:50:04 | 000,000,419 | ---- | C] () -- C:\Windows\BRWMARK.INI [2010/07/24 21:50:04 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI [2010/07/24 21:41:31 | 000,000,804 | ---- | C] () -- C:\Windows\Brpfx04a.ini [2010/07/24 21:41:31 | 000,000,094 | ---- | C] () -- C:\Windows\brpcfx.ini [2010/07/24 21:28:58 | 000,106,496 | ---- | C] () -- C:\Windows\System32\BrMuSNMP.dll [2010/02/19 22:20:13 | 000,006,336 | ---- | C] () -- C:\Windows\System32\ABTsc18.ini [2010/02/19 22:19:30 | 000,000,059 | ---- | C] () -- C:\Windows\System32\CBWsc18.ini [2009/12/12 17:17:16 | 000,000,600 | ---- | C] () -- C:\Users\Neal\AppData\Roaming\winscp.rnd [2009/10/25 13:49:01 | 000,000,000 | ---- | C] () -- C:\Windows\win32k.sys [2009/09/18 21:53:59 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009/08/03 14:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll [2009/01/27 20:28:40 | 000,168,448 | ---- | C] () -- C:\Windows\System32\unrar.dll [2009/01/06 22:05:28 | 000,007,620 | ---- | C] () -- C:\Users\Neal\AppData\Local\d3d9caps.dat [2008/12/25 18:18:04 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI [2008/12/24 11:11:31 | 000,108,544 | ---- | C] () -- C:\Users\Neal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008/12/18 15:07:37 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2008/12/18 13:33:38 | 000,055,808 | ---- | C] () -- C:\Windows\System32\bcmwlrmt.dll [2008/10/03 18:07:10 | 003,754,896 | ---- | C] () -- C:\Windows\System32\erdmpg-6.dll [2008/09/28 12:33:01 | 000,253,952 | ---- | C] () -- C:\Windows\System32\Manipulate.dll [2008/08/28 06:20:38 | 000,065,536 | ---- | C] () -- C:\Windows\System32\comLyricGetter.dll [2008/08/28 06:17:22 | 000,097,280 | ---- | C] () -- C:\Windows\System32\Uncommon.dll [2008/08/28 06:17:20 | 000,061,440 | ---- | C] () -- C:\Windows\System32\NormalizeDSP.dll [2006/11/06 14:30:38 | 000,262,144 | ---- | C] () -- C:\Windows\System32\lame_enc.dll [2006/11/02 07:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006/11/02 03:43:04 | 000,061,952 | ---- | C] () -- C:\Windows\System32\cngaudit.dll [2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2003/11/16 04:48:02 | 000,909,312 | ---- | C] () -- C:\Windows\System32\vorbisenc.dll [2003/11/16 04:48:00 | 001,060,864 | ---- | C] () -- C:\Windows\System32\vorbis.dll [2003/11/15 11:54:18 | 000,036,864 | ---- | C] () -- C:\Windows\System32\ogg.dll [2002/10/06 17:42:58 | 000,237,568 | ---- | C] () -- C:\Windows\System32\OggDS.dll ========== LOP Check ========== [2009/03/03 23:06:54 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\acccore [2010/11/20 16:32:40 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\BitDefender [2010/11/20 16:32:23 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\CoreCodec [2010/02/26 21:09:08 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\Facebook [2009/10/13 23:45:21 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\FreeFLVConverter [2009/06/03 22:05:28 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\GetRightToGo [2010/08/15 19:58:39 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\LolClient [2009/06/06 10:46:46 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\NetMedia Providers [2010/06/27 20:29:23 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\ooVoo Details [2010/07/24 21:46:22 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\PC-FAX TX [2010/09/26 12:41:46 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\PPLive [2009/06/06 10:46:46 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\Publish Providers [2010/04/21 09:38:01 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\Red Kawa [2010/11/20 16:15:07 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\runic games [2009/06/06 10:46:45 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\Sony [2010/09/26 12:36:18 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\StreamTorrent [2010/08/27 21:42:09 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\SystemRequirementsLab [2010/11/20 16:32:32 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\TomTom [2010/12/24 10:39:56 | 000,032,596 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 64 bytes -> C:\Users\Neal\Desktop\Zach Galifianakis - Live at the Purple Onion.mp4:TOC.WMV @Alternate Data Stream - 64 bytes -> C:\Users\Neal\Desktop\Stripped.mp4:TOC.WMV @Alternate Data Stream - 64 bytes -> C:\Users\Neal\Desktop\Better Shooting II pt.2.mp4:TOC.WMV @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:5D432CE3 @Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2 @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:BC359956 < End of report > Extras.Txt: OTL Extras logfile created on: 12/24/2010 5:09:19 PM - Run 1 OTL by OldTimer - Version 3.2.18.0 Folder = C:\Users\Neal\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18999) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 58.00% Memory free 6.00 Gb Paging File | 5.00 Gb Available in Paging File | 77.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 287.95 Gb Total Space | 31.44 Gb Free Space | 10.92% Space Free | Partition Type: NTFS Drive D: | 10.00 Gb Total Space | 4.62 Gb Free Space | 46.18% Space Free | Partition Type: NTFS Computer Name: NEAL-PC | User Name: Neal | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = ChromeHTML] -- Reg Error: Key error. File not found ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{09014A00-7114-4BD9-B813-C98643F43C53}" = rport=445 | protocol=6 | dir=out | app=system | "{0C7A9217-04C3-4C66-89BC-67B22B42F29D}" = lport=40094 | protocol=6 | dir=in | name=streaming web cam | "{0D5A23E6-DEA6-476A-8D0D-B1F04F611EFE}" = lport=40092 | protocol=6 | dir=in | name=streaming web cam | "{0ED1B6C5-9DFB-4975-886D-4ADE5CD8EA78}" = lport=8377 | protocol=17 | dir=in | name=league of legends launcher | "{116B341D-D40B-4755-9549-845E94EC9385}" = lport=8380 | protocol=6 | dir=in | name=league of legends launcher | "{1319A345-CD3C-465C-BA8C-AAC7F5565B05}" = lport=8370 | protocol=17 | dir=in | name=league of legends launcher | "{13F8579D-9A98-4B49-BABD-F800FE378B2B}" = rport=139 | protocol=6 | dir=out | app=system | "{15AE15CC-058B-4754-BCB2-AFEC3481B5A4}" = lport=8373 | protocol=6 | dir=in | name=league of legends launcher | "{177C2E83-ADB9-44D4-8C8B-47084B5C48A5}" = lport=8380 | protocol=17 | dir=in | name=league of legends launcher | "{1B37B762-A774-4156-BF2D-AAF3886FE91E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{1B6F2C19-7AF6-4930-AFA3-66816BAD9D51}" = lport=445 | protocol=6 | dir=in | app=system | "{1DF3B2F6-FB61-48D7-B313-F92BC34E43C9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{2232D3C7-04C2-4F0E-A10B-E8EAAD39D658}" = lport=8381 | protocol=17 | dir=in | name=league of legends launcher | "{277BA5B1-AD4B-429F-81E0-FA30760BDDBF}" = lport=139 | protocol=6 | dir=in | app=system | "{3AC16044-EC9E-49D2-8DB7-4F7EC274DC9C}" = lport=8381 | protocol=6 | dir=in | name=league of legends launcher | "{3F3F1D28-91D7-4391-B830-D3B35C1E27D7}" = lport=8379 | protocol=6 | dir=in | name=league of legends launcher | "{3FF80CEE-4DCF-4AA6-9967-0A2B7A513062}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{4AD27320-A1C0-4E67-959F-8A37CB569ADF}" = lport=8375 | protocol=17 | dir=in | name=league of legends launcher | "{5885537D-49D8-4280-B49C-09AC43B080D6}" = lport=8378 | protocol=17 | dir=in | name=league of legends launcher | "{5C4118B8-AA63-4E74-B7F7-ED8A993FAAF3}" = lport=137 | protocol=17 | dir=in | app=system | "{6670E4C1-80A8-45AD-8E57-44FA489552EE}" = lport=8379 | protocol=6 | dir=in | name=league of legends launcher | "{67FF498E-434A-4238-BFA2-75F800021801}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{6B9BA43B-21D7-45A9-82A7-C1CA3BAA6D47}" = lport=8381 | protocol=6 | dir=in | name=league of legends launcher | "{6D2C0653-65C3-4CB3-8FAF-48A7019217F6}" = lport=40080 | protocol=6 | dir=in | name=remote access media server | "{74C14F16-C5C7-4B5C-A1D7-21FBAC14CD2F}" = lport=8380 | protocol=17 | dir=in | name=league of legends launcher | "{7711851A-107E-4208-AEA6-B4C1FDC7AA4B}" = lport=8374 | protocol=17 | dir=in | name=league of legends launcher | "{7A921711-5274-48AB-BC62-A99F4F4F391C}" = lport=8377 | protocol=6 | dir=in | name=league of legends launcher | "{83345128-FAFE-45DD-A235-54AC8FA13D4F}" = lport=40091 | protocol=6 | dir=in | name=streaming web cam | "{8433EB48-E590-479D-995E-91EED83F999E}" = lport=8371 | protocol=17 | dir=in | name=league of legends launcher | "{88A8C80B-38CD-4D40-B333-CF1316218820}" = lport=8376 | protocol=17 | dir=in | name=league of legends launcher | "{8DD8AC52-748C-41AC-8DEA-30753546206C}" = lport=8370 | protocol=6 | dir=in | name=league of legends launcher | "{90399FAE-6CDE-4B94-80EC-559307F77E46}" = lport=8379 | protocol=17 | dir=in | name=league of legends launcher | "{98C68311-D2AE-435B-A5FC-E593A676A210}" = rport=138 | protocol=17 | dir=out | app=system | "{994DED2B-093C-4A9B-8664-72BA8E2AF9CF}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{A11E83D9-0CFD-4586-9D80-3D45F90AF39F}" = rport=137 | protocol=17 | dir=out | app=system | "{A27357A9-EC90-49D5-B48D-8DA1BEFAF87A}" = lport=8372 | protocol=17 | dir=in | name=league of legends launcher | "{A2F5B5F0-F053-49EB-A44D-3617F68CAD84}" = lport=8374 | protocol=6 | dir=in | name=league of legends launcher | "{A3BFCDFE-AB4F-4D96-AD86-1709BB0BBA92}" = lport=8379 | protocol=17 | dir=in | name=league of legends launcher | "{AC83B66A-8826-4263-BA95-52975809E845}" = lport=40093 | protocol=6 | dir=in | name=streaming web cam | "{B3928F15-3837-419D-A253-DCFD6E004294}" = lport=40090 | protocol=6 | dir=in | name=streaming web cam | "{B75838AF-A4C7-43D9-8DAB-8058085959EB}" = lport=8372 | protocol=6 | dir=in | name=league of legends launcher | "{B8CB5262-D9B1-4477-856B-A7600D151C98}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{C571AADF-259E-44B1-8BBA-0C72ECE6142A}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{C5F4DA68-4094-4997-A951-EFE01D712FDA}" = lport=8381 | protocol=17 | dir=in | name=league of legends launcher | "{DBB06764-4182-4690-B76F-220931FECC5E}" = lport=8371 | protocol=6 | dir=in | name=league of legends launcher | "{DD64CC3A-1159-46A6-99A4-30D6228EF2D1}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{E2878657-7137-4642-BA05-3CED325A945E}" = lport=138 | protocol=17 | dir=in | app=system | "{E9549219-9A4F-49C2-810A-96CF146600C9}" = lport=8375 | protocol=6 | dir=in | name=league of legends launcher | "{EB170369-C557-444E-9EE7-CB79EB914E3F}" = lport=8376 | protocol=6 | dir=in | name=league of legends launcher | "{F5D47D21-C919-4AAF-8E11-5C167DE5BC15}" = lport=8378 | protocol=6 | dir=in | name=league of legends launcher | "{FA893DDC-428F-42B6-A151-20A71A1D735E}" = lport=8373 | protocol=17 | dir=in | name=league of legends launcher | "{FB3CF927-3C04-49EE-9361-43CDE5285603}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{FB8EDC34-13B5-4F92-8A7A-EA3F249AB4A0}" = lport=8380 | protocol=6 | dir=in | name=league of legends launcher | "{FE6D38E8-A09F-45BF-95BA-77AE1343A905}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{010760BB-AAF0-4E51-941A-F912889ED9C4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{03BE2D90-15C9-498A-A82C-90100A863B01}" = protocol=6 | dir=in | app=c:\program files\ventrilo\ventrilo.exe | "{0BE15196-05DD-4BC4-A8CD-B0E1D948A2AF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{0DD76420-3D42-4357-9B5E-AB0C3EDB5DB7}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | "{0DF630F8-FE90-4512-9EE9-DC79E40F0842}" = protocol=17 | dir=in | app=c:\program files\dell remote access\ezi_ra.exe | "{1ADEB428-BB7D-410E-9CD1-95C8C1C49827}" = protocol=17 | dir=in | app=c:\programdata\singleclick systems\vlc\vlc.exe | "{1BD4023F-DFF0-4EC4-8EE1-633BDB197D9B}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{2021F08D-9249-40E4-AB92-1B777F97EFDF}" = protocol=17 | dir=in | app=c:\program files\dell video chat\dellvideochat.exe | "{2215A69C-9FC1-4EDA-B9C0-CA75E8469BD9}" = protocol=17 | dir=in | app=c:\riot games\league of legends\air\lolclient.exe | "{26282311-2421-48E3-80FD-2F47BEEC6783}" = protocol=17 | dir=in | app=c:\programdata\singleclick systems\mysql\bin\mysqld.exe | "{2902F8E5-9A40-416A-8489-FA0FD2C9F88C}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{2D1FB7DB-4D20-494F-93E5-5DD6638B37C6}" = protocol=17 | dir=in | app=c:\program files\ventrilo\ventrilo.exe | "{31478294-3143-477E-86FE-54FDAFC3E186}" = protocol=6 | dir=in | app=c:\programdata\singleclick systems\apache\bin\httpd.exe | "{408DDCC1-E3A7-4721-8363-312EAC56D6FE}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\sid meier's civilization v\civilizationv.exe | "{472DC336-F13A-48F9-97B6-F792C13AAB1B}" = protocol=17 | dir=in | app=c:\programdata\singleclick systems\advanced networking service\hnm_svc.exe | "{4B066477-0174-4248-841F-4FDDE35047E0}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\recettear\recettear.exe | "{4BACDCAB-BB05-4D42-91E7-D677D969D478}" = protocol=17 | dir=in | app=c:\riot games\league of legends\air\lolclient.exe | "{5116F280-0983-4CF2-B61F-25261A6B4087}" = protocol=17 | dir=in | app=c:\programdata\singleclick systems\mysql\bin\mysql.exe | "{5A080C91-B094-437E-82FB-4B4CC89B5EB7}" = protocol=6 | dir=in | app=c:\program files\aim\aim.exe | "{5B8C1CD2-BFFF-4677-83D8-45BC02B7335D}" = protocol=6 | dir=in | app=c:\program files\aim6\aim6.exe | "{5FD95502-7BE3-4EAA-834E-EC7E7B39918F}" = protocol=17 | dir=in | app=c:\programdata\singleclick systems\apache\bin\httpd.exe | "{60C2282D-94EB-4AA8-A3F5-004F4503FFB0}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\recettear\recettear.exe | "{64B9DD96-45EB-4FB0-AA9E-C553333AF428}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\recettear\custom.exe | "{66A1D6F8-9BD1-46E3-9380-03C7DEAE7E6D}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{67EAA138-A5DD-4F9F-B005-50B80510CDA6}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | "{6B3E04FF-C307-488A-BA64-24BB2BD1CACF}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{6D7D9E94-3553-437D-9042-7EBA335BB9ED}" = protocol=17 | dir=in | app=c:\riot games\league of legends\game\league of legends.exe | "{70334035-3A8C-4373-B557-6EA1662C92DB}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{70711CD6-FA0B-4272-8D72-811363171174}" = protocol=6 | dir=in | app=c:\programdata\singleclick systems\mysql\bin\mysqld.exe | "{70D6B6AA-1025-452F-A2A3-4A85C518CDD5}" = protocol=6 | dir=in | app=c:\riot games\league of legends\air\lolclient.exe | "{85464979-1358-4A2E-9D1C-E11BB98F32F8}" = protocol=17 | dir=in | app=c:\program files\dell video chat\dellvideochat.exe | "{8997E436-98F9-4F2E-8706-D9A48813E0AE}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\sid meier's civilization v\launcher.exe | "{8EFAF45C-F035-489C-B45C-F93FB220B676}" = dir=in | app=c:\program files\dell\mediadirect\kernel\dms\clmsservice.exe | "{8FD9A775-3D38-42E3-9654-EB049C981453}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\recettear\recettear.exe | "{904D850C-B677-45BD-81A9-6ACEF5477284}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\recettear\custom.exe | "{9076EF15-1165-4EDF-9966-5EB650846774}" = protocol=17 | dir=in | app=c:\program files\pplive\pplive.exe | "{928E4FBA-D55B-4FB7-907D-6EEA05C1D0AC}" = protocol=17 | dir=in | app=c:\riot games\league of legends\game\league of legends.exe | "{96AAFBE3-A726-4A88-82B4-C00CD6A7B401}" = protocol=6 | dir=in | app=c:\program files\dell remote access\ezi_ra.exe | "{9FCE3338-78AE-46C7-9D7D-ACA7771CF3F7}" = protocol=6 | dir=in | app=c:\programdata\singleclick systems\advanced networking service\hnm_svc.exe | "{A04642FA-5152-4AF5-A07F-C5AD7F5A7B49}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\recettear\recettear.exe | "{A0AB331D-95C0-437D-91C6-B63DA197F472}" = protocol=17 | dir=in | app=c:\program files\aim\aim.exe | "{A6EB970D-EC65-45D8-8D57-EF529DDB2B8C}" = protocol=6 | dir=in | app=c:\riot games\league of legends\game\league of legends.exe | "{A907D920-EA49-434C-BEC6-A84A2A4E7FA3}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\sid meier's civilization v\civilizationv.exe | "{AA1DCBDF-13C8-4589-8165-0ECF27F83684}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | "{ABD32CAB-575C-48CA-ABEA-840FAD2544B8}" = protocol=6 | dir=in | app=c:\programdata\singleclick systems\vlc\vlc.exe | "{AC49452B-5602-4DA5-A35F-DE5A76DE00F0}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\recettear\custom.exe | "{B27B9320-7DAC-4A68-A0AF-47006E98EA0D}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | "{B2DFE86A-F85E-4C13-B691-B2EC23425218}" = protocol=6 | dir=in | app=c:\programdata\singleclick systems\apache\php.exe | "{B52F6908-BAE7-4FF3-8831-7280E6CA109F}" = protocol=6 | dir=in | app=c:\riot games\league of legends\game\league of legends.exe | "{B6274050-6764-452E-B222-510F4C7B5C06}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\sid meier's civilization v\launcher.exe | "{BBBF507A-F504-40F7-AD6B-05DE799D8606}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe | "{BCDE7343-17FC-4F17-A16C-ECEA626ADCA2}" = protocol=6 | dir=in | app=c:\riot games\league of legends\air\lolclient.exe | "{C02DD0C5-B34D-4402-9348-BD50C57F4092}" = dir=in | app=c:\program files\dell\mediadirect\kernel\dmp\clbrowserengine.exe | "{C0FF291C-6C0E-40BB-A6E3-5A6B3FA0F708}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe | "{C283A118-6630-4C6E-8CCF-871A907CFE1A}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{C884EB3A-24B0-4DC5-9072-4386096A6F11}" = protocol=17 | dir=in | app=c:\program files\aim6\aim6.exe | "{C98071D2-B7FE-45C3-A1C2-F7043479D673}" = protocol=17 | dir=in | app=c:\programdata\singleclick systems\apache\php.exe | "{CC765253-39B8-4350-930C-92EB1803F0A9}" = protocol=6 | dir=in | app=c:\program files\pplive\pplive.exe | "{CEF7F246-B0FD-4168-A04E-CEF004E86536}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\recettear\custom.exe | "{D68CF06C-694F-42FD-8C68-CBFE0C5A978A}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{D86302BB-6862-4EA2-B12F-463284EC2DE4}" = dir=in | app=c:\program files\dell\mediadirect\pcmservice.exe | "{DFF65903-9AB5-4226-BDEE-4CB7AA725E9D}" = protocol=6 | dir=in | app=c:\programdata\singleclick systems\mysql\bin\mysql.exe | "{E708ABE4-BAD7-4A10-95AB-7EA7A00B0752}" = protocol=6 | dir=in | app=c:\program files\dell video chat\dellvideochat.exe | "{E840F755-AD76-4896-B25B-DB1F4CF1EFD8}" = protocol=6 | dir=in | app=c:\programdata\singleclick systems\remote access file sync service\dsl_fs_sync.exe | "{E9D5A486-CB9F-41B4-B406-03CCA3EE6051}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | "{F1BA6132-47E9-4BA4-8EB3-3C2A833F74F3}" = protocol=17 | dir=in | app=c:\programdata\singleclick systems\remote access file sync service\dsl_fs_sync.exe | "{F346C5E6-E7AD-47D9-A9E3-45B9C7FEE2A3}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | "{F4DA4329-9254-405D-A3A8-359A2C631245}" = dir=in | app=c:\program files\dell\mediadirect\mediadirect.exe | "{FBFE3C26-B015-4F16-890C-9290D0B45F29}" = protocol=6 | dir=in | app=c:\program files\dell video chat\dellvideochat.exe | "TCP Query User{0AF6EA89-074E-4D39-A7D1-0ADD996AD46A}C:\program files\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | "TCP Query User{12BA2527-B50E-4033-A735-150B7833942E}C:\program files\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe | "TCP Query User{1548856F-E274-42FE-BB9A-42B8113DF405}C:\program files\pfportchecker\pfportchecker.exe" = protocol=6 | dir=in | app=c:\program files\pfportchecker\pfportchecker.exe | "TCP Query User{18B3DB23-10E3-40F3-83AB-78D45FAEDF78}C:\program files\aim6\aim6.exe" = protocol=6 | dir=in | app=c:\program files\aim6\aim6.exe | "TCP Query User{445EBC3F-BAF3-436C-8EBC-9D60EB5DC2AC}C:\program files\streamtorrent 1.0\streamtorrent.exe" = protocol=6 | dir=in | app=c:\program files\streamtorrent 1.0\streamtorrent.exe | "TCP Query User{5EDA798D-9294-4E7E-B7DA-6EC34E147D41}C:\program files\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | "TCP Query User{9F98540F-2EB1-40B4-9037-1D8F8B1E1666}C:\program files\oovoo\oovoo.exe" = protocol=6 | dir=in | app=c:\program files\oovoo\oovoo.exe | "TCP Query User{B62B4769-4CED-4808-8768-51038040725F}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | "TCP Query User{CD78ED16-F054-4E94-A974-6A2F016F128C}C:\windows\rundll22.exe" = protocol=6 | dir=in | app=c:\windows\rundll22.exe | "TCP Query User{D44C1558-414F-4E95-94BC-F4ACEF276376}C:\program files\aim\aim.exe" = protocol=6 | dir=in | app=c:\program files\aim\aim.exe | "TCP Query User{E700DFF9-9A35-456D-B8C7-21D716F86FF5}C:\windows\rundll22.exe" = protocol=6 | dir=in | app=c:\windows\rundll22.exe | "UDP Query User{0074A60D-1872-4DAF-8DD1-20F711D835A6}C:\program files\oovoo\oovoo.exe" = protocol=17 | dir=in | app=c:\program files\oovoo\oovoo.exe | "UDP Query User{0B407C5A-77D3-4D0E-92A6-2AEAE8536FD5}C:\program files\aim\aim.exe" = protocol=17 | dir=in | app=c:\program files\aim\aim.exe | "UDP Query User{550B0AE2-25EA-4E8F-8B77-9EF93B3A9D6C}C:\windows\rundll22.exe" = protocol=17 | dir=in | app=c:\windows\rundll22.exe | "UDP Query User{8E07909C-99A5-4660-8171-FFC7C80EA3D2}C:\program files\streamtorrent 1.0\streamtorrent.exe" = protocol=17 | dir=in | app=c:\program files\streamtorrent 1.0\streamtorrent.exe | "UDP Query User{ACD15955-248C-4444-BF3E-D6C2A612FCF4}C:\program files\itunes\itunes.exe" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | "UDP Query User{B17106A5-AD64-4D50-818E-4AEE2B0BB520}C:\program files\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe | "UDP Query User{B8994187-B028-4244-A5C2-CD2700D04E5F}C:\program files\itunes\itunes.exe" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | "UDP Query User{C6345C61-A363-400E-B4B5-D888600864B3}C:\windows\rundll22.exe" = protocol=17 | dir=in | app=c:\windows\rundll22.exe | "UDP Query User{D705C16A-9076-42A6-A5C7-E4C2012FA2C4}C:\program files\aim6\aim6.exe" = protocol=17 | dir=in | app=c:\program files\aim6\aim6.exe | "UDP Query User{EDEE21DB-1C51-4204-9882-2DF0B4EBAEB3}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | "UDP Query User{EE65166D-3E9C-4AC5-9220-2B052EF14DA2}C:\program files\pfportchecker\pfportchecker.exe" = protocol=17 | dir=in | app=c:\program files\pfportchecker\pfportchecker.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{0046FA01-C5B9-4985-BACB-398DC480FC05}" = Adobe Photoshop CS3 "{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam "{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3 "{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center "{0709B06B-82BC-6073-0E43-DE107DF1389C}" = Catalyst Control Center Localization Spanish "{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting "{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data "{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE "{0B1AAC97-8563-41D9-AE47-58E6A222F0E1}" = Search Settings 1.2.2 "{10B39DCD-0325-49FE-BFBC-8EC011CB7CA8}" = ACID Pro 7.0 "{11D03BF4-A66F-325E-7762-4F64586C673F}" = Catalyst Control Center Graphics Full New "{13766F76-6C8C-4E57-A9F3-3212D1C6E0D1}" = Dell DataSafe Online "{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works "{15EB6A85-A28D-2ED8-C344-DEBC592F2E12}" = Catalyst Control Center Localization German "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer "{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin "{1D46A3A0-B37D-423A-91C2-101A49E2FF80}" = Ventrilo Server "{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer "{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java 6 Update 20 "{28C3CD30-2DF4-FEFA-3F4E-D6C1C3257FCE}" = ccc-core-static "{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3 "{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour "{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager "{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java 6 Update 7 "{328A9510-1BFF-4359-98CC-B47B329D57A7}" = M3 SAKURA V1.49 Global (GAME PATCH V4.8f) "{32C2CBBB-4540-E526-206D-B7BC7932D82F}" = CCC Help Danish "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{425819E1-D68E-8CE1-85D5-CDBA64E82DDE}" = CCC Help Japanese "{4392E2AF-1643-29DA-E873-C94D547467D7}" = Catalyst Control Center Localization Swedish "{44FDDB51-0E97-DD4A-9FB2-8D394DBEE47F}" = CCC Help Dutch "{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR "{48C86A94-A6C0-D2D0-1649-ECB00D2DF4DE}" = Catalyst Control Center Localization Norwegian "{48CC1AD8-2013-82B3-284F-E0253195664F}" = Catalyst Control Center Localization French "{496C34BF-9DE5-9628-48CC-052DD6A8453E}" = Catalyst Control Center Core Implementation "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4A4D109A-D9C4-E460-4F9A-0252F581D600}" = CCC Help Swedish "{4CA09BF7-1CFC-44B8-80EA-7B4D15D12DC5}" = Catalyst Control Center - Branding "{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings "{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3 "{57847CB0-95DA-D785-B170-1F00FC79B860}" = Catalyst Control Center Localization Chinese Traditional "{5A72A2C4-9D4A-0718-DA28-95B73C2270DA}" = Catalyst Control Center Localization Danish "{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector "{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator "{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3 "{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}" = Cisco PEAP Module "{682FED0E-738E-0048-F448-B3EE427978CC}" = Catalyst Control Center Localization Japanese "{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All "{6B00208E-2844-7480-5F50-6515A5907F0B}" = CCC Help Norwegian "{6B7B6D4D-8F9B-4CB3-8CA4-BCA9CC4C1A22}" = EDocs "{6D3963B0-E13B-4FC3-B0FF-506A304BB043}" = Cisco EAP-FAST Module "{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3 "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio "{76E12A66-1AEC-3816-E75A-330998F2D40C}" = CCC Help Korean "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com "{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client "{79FBDD2E-DD2B-141A-DCF0-B8C125B5A008}" = Catalyst Control Center Graphics Previews Vista "{7C63DFEB-6176-C3F1-AA83-F997E32B44EA}" = Catalyst Control Center Localization Portuguese "{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide "{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3 "{83770D14-21B9-44B3-8689-F7B523F94560}" = Cisco LEAP Module "{84557D91-D8C7-D7A4-1393-3AB3A16106C7}" = CCC Help Chinese Traditional "{8627CFC0-D8DE-43AF-B538-6AD015EAE67F}" = Electronic Listening Guides Full Screen "{868EC22E-7E82-4760-9265-3F2E705BF24B}" = League of Legends "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3 "{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support "{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system "{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3 "{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage "{910F4A29-1134-49E0-AD8B-56E4A3152BD1}" = The Sims Link to post Share on other sites More sharing options...
kahdah Posted December 25, 2010 ID:365629 Share Posted December 25, 2010 Ok.Download TDSSKiller and save it to your Desktop.Extract its contents to your desktop.Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.If an infected file is detected, the default action will be Cure, click on Continue.If a suspicious file is detected, the default action will be Skip, click on Continue.It may ask you to reboot the computer to complete the process. Click on Reboot Now.If no reboot is required, click on Report. A log file should appear. Please copy and paste the contents of that file here.If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here. Link to post Share on other sites More sharing options...
muckdork Posted December 25, 2010 Author ID:365662 Share Posted December 25, 2010 Nothing was detected. Also, Malwarebytes Ant-Malware is able to run on start up but I still am unable to run a scan or update it.2010/12/25 17:20:34.0972 TDSS rootkit removing tool 2.4.12.0 Dec 16 2010 09:46:462010/12/25 17:20:34.0972 ================================================================================2010/12/25 17:20:34.0972 SystemInfo:2010/12/25 17:20:34.0973 2010/12/25 17:20:34.0973 OS Version: 6.0.6002 ServicePack: 2.02010/12/25 17:20:34.0973 Product type: Workstation2010/12/25 17:20:34.0973 ComputerName: NEAL-PC2010/12/25 17:20:34.0973 UserName: Neal2010/12/25 17:20:34.0973 Windows directory: C:\Windows2010/12/25 17:20:34.0973 System windows directory: C:\Windows2010/12/25 17:20:34.0973 Processor architecture: Intel x862010/12/25 17:20:34.0973 Number of processors: 22010/12/25 17:20:34.0973 Page size: 0x10002010/12/25 17:20:34.0973 Boot type: Normal boot2010/12/25 17:20:34.0973 ================================================================================2010/12/25 17:20:35.0412 Initialize success2010/12/25 17:20:39.0186 ================================================================================2010/12/25 17:20:39.0186 Scan started2010/12/25 17:20:39.0186 Mode: Manual; 2010/12/25 17:20:39.0186 ================================================================================2010/12/25 17:20:42.0194 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys2010/12/25 17:20:42.0486 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys2010/12/25 17:20:42.0693 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys2010/12/25 17:20:42.0905 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys2010/12/25 17:20:43.0075 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys2010/12/25 17:20:43.0213 AFD (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys2010/12/25 17:20:43.0331 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys2010/12/25 17:20:43.0399 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys2010/12/25 17:20:43.0431 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys2010/12/25 17:20:43.0510 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys2010/12/25 17:20:43.0557 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys2010/12/25 17:20:43.0798 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys2010/12/25 17:20:43.0879 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys2010/12/25 17:20:43.0965 ApfiltrService (b83f9da84f7079451c1c6a4a2f140920) C:\Windows\system32\DRIVERS\Apfiltr.sys2010/12/25 17:20:44.0130 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys2010/12/25 17:20:44.0196 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys2010/12/25 17:20:44.0335 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys2010/12/25 17:20:44.0406 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys2010/12/25 17:20:44.0726 atikmdag (47dcf5d78c395159d72c65c25129fc44) C:\Windows\system32\DRIVERS\atikmdag.sys2010/12/25 17:20:44.0928 BCM42RLY (55070d71bbb424a56d5125c61fcc2897) C:\Windows\system32\drivers\BCM42RLY.sys2010/12/25 17:20:45.0028 BCM43XX (fa6707a346cd122407f3b0bad1c47639) C:\Windows\system32\DRIVERS\bcmwl6.sys2010/12/25 17:20:45.0180 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys2010/12/25 17:20:45.0240 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys2010/12/25 17:20:45.0374 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys2010/12/25 17:20:45.0435 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys2010/12/25 17:20:45.0469 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys2010/12/25 17:20:45.0587 Bridge (b1564976d98e91fc764d5dc28a0297da) C:\Windows\system32\DRIVERS\bridge.sys2010/12/25 17:20:45.0617 BridgeMP (b1564976d98e91fc764d5dc28a0297da) C:\Windows\system32\DRIVERS\bridge.sys2010/12/25 17:20:45.0676 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys2010/12/25 17:20:45.0806 BrSerIf (56f59a4011f503149ae4de826982ca4f) C:\Windows\system32\Drivers\BrSerIf.sys2010/12/25 17:20:45.0845 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys2010/12/25 17:20:45.0871 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys2010/12/25 17:20:45.0926 BrUsbSer (a24c7b39602218f8dbdb2b6704325fc7) C:\Windows\system32\Drivers\BrUsbSer.sys2010/12/25 17:20:46.0033 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys2010/12/25 17:20:46.0066 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys2010/12/25 17:20:46.0129 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys2010/12/25 17:20:46.0186 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys2010/12/25 17:20:46.0293 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys2010/12/25 17:20:46.0429 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys2010/12/25 17:20:46.0480 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys2010/12/25 17:20:46.0506 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys2010/12/25 17:20:46.0578 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys2010/12/25 17:20:46.0616 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys2010/12/25 17:20:46.0714 DfsC (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys2010/12/25 17:20:46.0851 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys2010/12/25 17:20:46.0963 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys2010/12/25 17:20:47.0096 DXGKrnl (5c7e2097b91d689ded7a6ff90f0f3a25) C:\Windows\System32\drivers\dxgkrnl.sys2010/12/25 17:20:47.0261 e1express (908ed85b7806e8af3af5e9b74f7809d4) C:\Windows\system32\DRIVERS\e1e6032.sys2010/12/25 17:20:47.0320 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys2010/12/25 17:20:47.0479 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys2010/12/25 17:20:47.0558 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys2010/12/25 17:20:47.0660 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys2010/12/25 17:20:47.0751 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys2010/12/25 17:20:47.0853 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys2010/12/25 17:20:47.0884 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys2010/12/25 17:20:47.0923 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys2010/12/25 17:20:47.0954 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys2010/12/25 17:20:48.0090 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys2010/12/25 17:20:48.0156 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys2010/12/25 17:20:48.0296 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys2010/12/25 17:20:48.0325 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys2010/12/25 17:20:48.0382 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys2010/12/25 17:20:48.0534 HdAudAddService (3f90e001369a07243763bd5a523d8722) C:\Windows\system32\drivers\HdAudio.sys2010/12/25 17:20:48.0599 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys2010/12/25 17:20:48.0700 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys2010/12/25 17:20:48.0727 HidIr (d8df3722d5e961baa1292aa2f12827e2) C:\Windows\system32\DRIVERS\hidir.sys2010/12/25 17:20:48.0792 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys2010/12/25 17:20:48.0910 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys2010/12/25 17:20:48.0975 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys2010/12/25 17:20:49.0064 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys2010/12/25 17:20:49.0124 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys2010/12/25 17:20:49.0153 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys2010/12/25 17:20:49.0244 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys2010/12/25 17:20:49.0320 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys2010/12/25 17:20:49.0411 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys2010/12/25 17:20:49.0442 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys2010/12/25 17:20:49.0491 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys2010/12/25 17:20:49.0516 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys2010/12/25 17:20:49.0641 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys2010/12/25 17:20:49.0670 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys2010/12/25 17:20:49.0727 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys2010/12/25 17:20:49.0754 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys2010/12/25 17:20:49.0844 itecir (8bcd857c7932ad005d5f9c89329da2e1) C:\Windows\system32\DRIVERS\itecir.sys2010/12/25 17:20:49.0885 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys2010/12/25 17:20:49.0933 k57nd60x (2fbf424e4e8d5f320d2f69d9a726de30) C:\Windows\system32\DRIVERS\k57nd60x.sys2010/12/25 17:20:50.0015 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys2010/12/25 17:20:50.0084 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys2010/12/25 17:20:50.0157 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys2010/12/25 17:20:50.0360 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys2010/12/25 17:20:50.0404 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys2010/12/25 17:20:50.0432 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys2010/12/25 17:20:50.0505 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys2010/12/25 17:20:50.0593 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys2010/12/25 17:20:50.0683 MBAMProtector (836e0e09ca9869be7eb39ef2cf3602c7) C:\Windows\system32\drivers\mbam.sys2010/12/25 17:20:50.0787 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys2010/12/25 17:20:50.0890 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys2010/12/25 17:20:50.0985 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys2010/12/25 17:20:51.0039 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys2010/12/25 17:20:51.0091 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys2010/12/25 17:20:51.0198 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys2010/12/25 17:20:51.0232 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys2010/12/25 17:20:51.0316 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys2010/12/25 17:20:51.0399 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys2010/12/25 17:20:51.0499 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys2010/12/25 17:20:51.0568 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys2010/12/25 17:20:51.0627 mrxsmb (454341e652bdf5e01b0f2140232b073e) C:\Windows\system32\DRIVERS\mrxsmb.sys2010/12/25 17:20:51.0720 mrxsmb10 (2a4901aff069944fa945ed5bbf4dcde3) C:\Windows\system32\DRIVERS\mrxsmb10.sys2010/12/25 17:20:51.0767 mrxsmb20 (28b3f1ab44bdd4432c041581412f17d9) C:\Windows\system32\DRIVERS\mrxsmb20.sys2010/12/25 17:20:51.0839 msahci (5457dcfa7c0da43522f4d9d4049c1472) C:\Windows\system32\drivers\msahci.sys2010/12/25 17:20:51.0936 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys2010/12/25 17:20:52.0063 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys2010/12/25 17:20:52.0114 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys2010/12/25 17:20:52.0339 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys2010/12/25 17:20:52.0597 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys2010/12/25 17:20:52.0657 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys2010/12/25 17:20:52.0719 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys2010/12/25 17:20:52.0797 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys2010/12/25 17:20:52.0843 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys2010/12/25 17:20:52.0898 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys2010/12/25 17:20:52.0982 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys2010/12/25 17:20:53.0168 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys2010/12/25 17:20:53.0232 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys2010/12/25 17:20:53.0292 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys2010/12/25 17:20:53.0359 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys2010/12/25 17:20:53.0389 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys2010/12/25 17:20:53.0463 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys2010/12/25 17:20:53.0538 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys2010/12/25 17:20:53.0585 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys2010/12/25 17:20:53.0670 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys2010/12/25 17:20:53.0725 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys2010/12/25 17:20:53.0805 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys2010/12/25 17:20:53.0906 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys2010/12/25 17:20:53.0934 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys2010/12/25 17:20:53.0961 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys2010/12/25 17:20:53.0990 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys2010/12/25 17:20:54.0069 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys2010/12/25 17:20:54.0187 OA001Ufd (a015dd2ba6009c8bdd00a6c431302d06) C:\Windows\system32\DRIVERS\OA001Ufd.sys2010/12/25 17:20:54.0293 OA001Vid (438ffcb55b8ce39b0bc71afc0a059835) C:\Windows\system32\DRIVERS\OA001Vid.sys2010/12/25 17:20:54.0420 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys2010/12/25 17:20:54.0509 Packet (9d80e0be979c3edaf2863f23b88f4de6) C:\Windows\system32\DRIVERS\packet.sys2010/12/25 17:20:54.0549 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys2010/12/25 17:20:54.0652 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys2010/12/25 17:20:54.0686 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys2010/12/25 17:20:54.0743 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys2010/12/25 17:20:54.0827 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys2010/12/25 17:20:54.0860 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys2010/12/25 17:20:54.0902 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys2010/12/25 17:20:55.0077 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys2010/12/25 17:20:55.0105 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys2010/12/25 17:20:55.0173 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys2010/12/25 17:20:55.0320 PxHelp20 (03e0fe281823ba64b3782f5b38950e73) C:\Windows\system32\Drivers\PxHelp20.sys2010/12/25 17:20:55.0403 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys2010/12/25 17:20:55.0507 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys2010/12/25 17:20:55.0543 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys2010/12/25 17:20:55.0663 R300 (47dcf5d78c395159d72c65c25129fc44) C:\Windows\system32\DRIVERS\atikmdag.sys2010/12/25 17:20:55.0775 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys2010/12/25 17:20:55.0806 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys2010/12/25 17:20:55.0874 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys2010/12/25 17:20:55.0977 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys2010/12/25 17:20:56.0034 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys2010/12/25 17:20:56.0073 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys2010/12/25 17:20:56.0162 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys2010/12/25 17:20:56.0197 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys2010/12/25 17:20:56.0309 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys2010/12/25 17:20:56.0388 rimmptsk (c2ef513bbe069f0d4ee0938a76f975d3) C:\Windows\system32\DRIVERS\rimmptsk.sys2010/12/25 17:20:56.0406 rimsptsk (c398bca91216755b098679a8da8a2300) C:\Windows\system32\DRIVERS\rimsptsk.sys2010/12/25 17:20:56.0501 rismxdp (2a2554cb24506e0a0508fc395c4a1b42) C:\Windows\system32\DRIVERS\rixdptsk.sys2010/12/25 17:20:56.0592 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys2010/12/25 17:20:56.0624 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys2010/12/25 17:20:56.0727 SCDEmu (23aa53256ce05b975398b78a33474265) C:\Windows\system32\drivers\SCDEmu.sys2010/12/25 17:20:56.0794 sdbus (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys2010/12/25 17:20:56.0834 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys2010/12/25 17:20:56.0935 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys2010/12/25 17:20:56.0968 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys2010/12/25 17:20:57.0003 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys2010/12/25 17:20:57.0042 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys2010/12/25 17:20:57.0205 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys2010/12/25 17:20:57.0359 sffp_sd (9f66a46c55d6f1ccabc79bb7afccc545) C:\Windows\system32\DRIVERS\sffp_sd.sys2010/12/25 17:20:57.0439 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys2010/12/25 17:20:57.0509 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys2010/12/25 17:20:57.0557 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys2010/12/25 17:20:57.0672 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys2010/12/25 17:20:57.0757 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys2010/12/25 17:20:57.0801 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys2010/12/25 17:20:57.0901 srv (ff3cbc13db84d81f56931bc922cc37c4) C:\Windows\system32\DRIVERS\srv.sys2010/12/25 17:20:58.0004 srv2 (d15959d9f69f0d39a0153e9c244f20dd) C:\Windows\system32\DRIVERS\srv2.sys2010/12/25 17:20:58.0025 srvnet (faa0d553a49e85008c6bb3781987c574) C:\Windows\system32\DRIVERS\srvnet.sys2010/12/25 17:20:58.0126 STHDA (d4ae2486c4290054b8d6f1adc4bad7fd) C:\Windows\system32\DRIVERS\stwrt.sys2010/12/25 17:20:58.0251 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys2010/12/25 17:20:58.0283 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys2010/12/25 17:20:58.0316 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys2010/12/25 17:20:58.0341 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys2010/12/25 17:20:58.0479 Tcpip (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\drivers\tcpip.sys2010/12/25 17:20:58.0623 Tcpip6 (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\DRIVERS\tcpip.sys2010/12/25 17:20:58.0725 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys2010/12/25 17:20:58.0758 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys2010/12/25 17:20:58.0787 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys2010/12/25 17:20:58.0842 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys2010/12/25 17:20:58.0942 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys2010/12/25 17:20:59.0016 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys2010/12/25 17:20:59.0138 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys2010/12/25 17:20:59.0203 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys2010/12/25 17:20:59.0238 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys2010/12/25 17:20:59.0350 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys2010/12/25 17:20:59.0413 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys2010/12/25 17:20:59.0449 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys2010/12/25 17:20:59.0537 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys2010/12/25 17:20:59.0567 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys2010/12/25 17:20:59.0597 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys2010/12/25 17:20:59.0655 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\Windows\system32\Drivers\usbaapl.sys2010/12/25 17:20:59.0766 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys2010/12/25 17:20:59.0808 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys2010/12/25 17:20:59.0868 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys2010/12/25 17:20:59.0975 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys2010/12/25 17:21:00.0017 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys2010/12/25 17:21:00.0079 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys2010/12/25 17:21:00.0186 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS2010/12/25 17:21:00.0226 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys2010/12/25 17:21:00.0266 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys2010/12/25 17:21:00.0285 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys2010/12/25 17:21:00.0317 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys2010/12/25 17:21:00.0401 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys2010/12/25 17:21:00.0426 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys2010/12/25 17:21:00.0489 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys2010/12/25 17:21:00.0607 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys2010/12/25 17:21:00.0720 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys2010/12/25 17:21:00.0766 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys2010/12/25 17:21:00.0808 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys2010/12/25 17:21:00.0888 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys2010/12/25 17:21:00.0901 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys2010/12/25 17:21:00.0948 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys2010/12/25 17:21:00.0989 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys2010/12/25 17:21:01.0148 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys2010/12/25 17:21:01.0242 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys2010/12/25 17:21:01.0275 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys2010/12/25 17:21:01.0404 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys2010/12/25 17:21:01.0475 XBCD (b21bfa8d2de35a551275e279b4baf97b) C:\Windows\system32\drivers\xbcd.sys2010/12/25 17:21:01.0554 xnacc (9eea6d029fef5f3016d089b1a603837d) C:\Windows\system32\DRIVERS\xnacc.sys2010/12/25 17:21:01.0646 ================================================================================2010/12/25 17:21:01.0646 Scan finished2010/12/25 17:21:01.0646 ================================================================================ Link to post Share on other sites More sharing options...
kahdah Posted December 25, 2010 ID:365665 Share Posted December 25, 2010 Ok.Please visit this webpage for download links, and instructions for running ComboFix: http://www.bleepingcomputer.com/combofix/how-to-use-combofix* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Please include the C:\ComboFix.txt in your next reply for further review. Link to post Share on other sites More sharing options...
muckdork Posted December 25, 2010 Author ID:365675 Share Posted December 25, 2010 I can download ComboFix but when I try to run it, it stops right before the load bar completes and just closes. Link to post Share on other sites More sharing options...
kahdah Posted December 26, 2010 ID:365681 Share Posted December 26, 2010 Ok I need to see a bit more see if this will run please.Please download Rootkit Unhooker and save it on your desktop.http://www.kernelmode.info/ARKs/RkU3.8.388.590.rarIf your unzipping program doesn't unzip RAR files, then you can download and install 7-Zip to accomplish that.http://www.7-zip.org/Just right click the RAR file you downloaded to your desktop, and choose the 7-Zip -> "Extract here" option from the context menu. Temporarily disable your antivirus and antimalware real-time protection before performing a scan by following the directions that apply HERE Double-click RkU3.8.388.590.exe to run the program Click the Report tab, then click Scan Check Drivers, and Stealth Code Uncheck the rest, then click OK When prompted to Select Disks for Scan, make sure C:\ is checked and click OK Wait till the scanner has finished then go File > Save Report Save the report somewhere you can find it. Click Close Re-enable your security programs Copy the entire contents of the report and paste it in your next reply.Note - You may get this warning it is ok, just ignore it."Rootkit Unhooker has detected a parasite inside itself!It is recommended to remove parasite, okay?" Link to post Share on other sites More sharing options...
muckdork Posted December 26, 2010 Author ID:365712 Share Posted December 26, 2010 Here are the results:RkU Version: 3.8.388.590, Type LE (SR2)==============================================OS Name: Windows VistaVersion 6.0.6002 (Service Pack 2)Number of processors #2==============================================>Drivers==============================================0x91403000 C:\Windows\system32\DRIVERS\atikmdag.sys 5861376 bytes (ATI Technologies Inc., ATI Radeon Kernel Mode Driver)0x85412000 C:\Windows\system32\ntkrnlpa.exe 3903488 bytes (Microsoft Corporation, NT Kernel & System)0x85412000 PnpManager 3903488 bytes0x85412000 RAW 3903488 bytes0x85412000 WMIxWDM 3903488 bytes0x982C0000 Win32k 2109440 bytes0x982C0000 C:\Windows\System32\win32k.sys 2109440 bytes (Microsoft Corporation, Multi-User Win32 Driver)0x92000000 C:\Windows\system32\DRIVERS\bcmwl6.sys 1220608 bytes (Broadcom Corporation, Broadcom 802.11 Network Adapter wireless driver)0x8D60A000 C:\Windows\System32\Drivers\Ntfs.sys 1114112 bytes (Microsoft Corporation, NT File System Driver)0x8D47F000 C:\Windows\system32\drivers\ndis.sys 1093632 bytes (Microsoft Corporation, NDIS 6.0 wrapper driver)0x92A0A000 C:\Windows\System32\drivers\tcpip.sys 958464 bytes (Microsoft Corporation, TCP/IP Driver)0x806E0000 C:\Windows\system32\CI.dll 917504 bytes (Microsoft Corporation, Code Integrity Module)0xA62C2000 C:\Windows\system32\drivers\peauth.sys 909312 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver)0xA5007000 C:\Windows\system32\drivers\spsys.sys 720896 bytes (Microsoft Corporation, security processor)0x91C0F000 C:\Windows\System32\drivers\dxgkrnl.sys 659456 bytes (Microsoft Corporation, DirectX Graphics Kernel)0x91CBC000 C:\Windows\system32\DRIVERS\HDAudBus.sys 577536 bytes (Microsoft Corporation, High Definition Audio Bus Driver)0x85A0E000 C:\Windows\system32\drivers\Wdf01000.sys 507904 bytes (Microsoft Corporation, WDF Dynamic)0x8D40E000 C:\Windows\System32\Drivers\ksecdd.sys 462848 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)0x80616000 C:\Windows\system32\mcupdate_GenuineIntel.dll 458752 bytes (Microsoft Corporation, Intel Microcode Update Library)0xA50FE000 C:\Windows\system32\drivers\HTTP.sys 446464 bytes (Microsoft Corporation, HTTP Protocol Stack)0x928DE000 C:\Windows\system32\DRIVERS\stwrt.sys 401408 bytes (IDT, Inc., IDT PC Audio)0x9199A000 C:\Windows\system32\DRIVERS\itecir.sys 360448 bytes (ITE Tech. Inc. , ITE Consumer IR Driver for eHome)0x91DA1000 C:\Windows\system32\DRIVERS\rixdptsk.sys 335872 bytes (REDC, RICOH XD SM Driver)0xA6234000 C:\Windows\System32\DRIVERS\srv.sys 319488 bytes (Microsoft Corporation, Server driver)0x98510000 C:\Windows\System32\ATMFD.DLL 315392 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)0x85B40000 C:\Windows\System32\drivers\volmgrx.sys 303104 bytes (Microsoft Corporation, Volume Manager Extension Driver)0x92B39000 C:\Windows\system32\drivers\afd.sys 294912 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)0x85A97000 C:\Windows\system32\drivers\acpi.sys 286720 bytes (Microsoft Corporation, ACPI Driver for NT)0x92C8E000 C:\Windows\system32\DRIVERS\OA001Vid.sys 278528 bytes (Creative Technology Ltd., Video Capture Device Driver)0x8069F000 C:\Windows\system32\CLFS.SYS 266240 bytes (Microsoft Corporation, Common Log File System Driver)0x922AF000 C:\Windows\system32\DRIVERS\storport.sys 266240 bytes (Microsoft Corporation, Microsoft Storage Port Driver)0x9284D000 C:\Windows\system32\drivers\HdAudio.sys 258048 bytes (Microsoft Corporation, High Definition Audio Function Driver)0x91D54000 C:\Windows\system32\DRIVERS\USBPORT.SYS 253952 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)0x92C0F000 C:\Windows\system32\DRIVERS\rdbss.sys 245760 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)0x8D5B5000 C:\Windows\system32\drivers\NETIO.SYS 241664 bytes (Microsoft Corporation, Network I/O Subsystem)0x92D8C000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 233472 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr)0x8D71A000 C:\Windows\system32\drivers\volsnap.sys 233472 bytes (Microsoft Corporation, Volume Shadow Copy Driver)0x9212A000 C:\Windows\system32\DRIVERS\k57nd60x.sys 217088 bytes (Broadcom Corporation, Broadcom NetLink Gigabit Ethernet NDIS6.x Unified Driver.)0x92807000 C:\Windows\system32\DRIVERS\usbhub.sys 217088 bytes (Microsoft Corporation, Default Hub Driver for USB)0x857CB000 ACPI_HAL 208896 bytes0x857CB000 C:\Windows\system32\hal.dll 208896 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)0x807C0000 C:\Windows\system32\drivers\fltmgr.sys 204800 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)0x92B81000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver)0xA63CC000 C:\Windows\system32\DRIVERS\PCGenFAM.sys 200704 bytes (Soluto LTD., Soluto PCGenome Core Driver)0x92280000 C:\Windows\system32\DRIVERS\msiscsi.sys 192512 bytes (Microsoft Corporation, Microsoft iSCSI Initiator Driver)0x9220E000 C:\Windows\system32\DRIVERS\Apfiltr.sys 184320 bytes (Alps Electric Co., Ltd., Alps Touch Pad Driver)0x9288C000 C:\Windows\system32\drivers\portcls.sys 184320 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))0x8D58A000 C:\Windows\system32\drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider)0x923A5000 C:\Windows\system32\DRIVERS\ks.sys 172032 bytes (Microsoft Corporation, Kernel CSA Library)0xA50B7000 C:\Windows\system32\DRIVERS\nwifi.sys 172032 bytes (Microsoft Corporation, NativeWiFi Miniport Driver)0xA629A000 C:\Windows\System32\Drivers\fastfat.SYS 163840 bytes (Microsoft Corporation, Fast FAT File System Driver)0xA620C000 C:\Windows\System32\DRIVERS\srv2.sys 163840 bytes (Microsoft Corporation, Smb 2.0 Server driver)0x8D76A000 C:\Windows\System32\drivers\ecache.sys 159744 bytes (Microsoft Corporation, Special Memory Device Cache)0x85AEE000 C:\Windows\system32\drivers\pci.sys 159744 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)0x928B9000 C:\Windows\system32\drivers\drmk.sys 151552 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)0x92CD2000 C:\Windows\system32\DRIVERS\OA001Ufd.sys 147456 bytes (Creative Technology Ltd., Video Class Upper Filter Driver)0x92338000 C:\Windows\system32\DRIVERS\ndiswan.sys 143360 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))0x92DDD000 C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 139264 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASKUTIL.SYS)0x8D7A2000 C:\Windows\system32\drivers\CLASSPNP.SYS 135168 bytes (Microsoft Corporation, SCSI Class System Dll)0xA51B6000 C:\Windows\system32\drivers\mrxdav.sys 135168 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)0x92996000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver)0xA51D7000 C:\Windows\system32\DRIVERS\mrxsmb.sys 126976 bytes (Microsoft Corporation, Windows NT SMB Minirdr)0x85BA2000 C:\Windows\system32\drivers\ataport.SYS 122880 bytes (Microsoft Corporation, ATAPI Driver Extension)0xA516B000 C:\Windows\System32\DRIVERS\srvnet.sys 118784 bytes (Microsoft Corporation, Server Network driver)0x922FB000 C:\Windows\system32\DRIVERS\bridge.sys 110592 bytes (Microsoft Corporation, MAC Bridge Driver)0x92AF4000 C:\Windows\System32\drivers\fwpkclnt.sys 110592 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API)0x92D5B000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver)0x9217D000 C:\Windows\system32\DRIVERS\sdbus.sys 106496 bytes (Microsoft Corporation, SecureDigital Bus Driver)0xA5188000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver)0x92246000 C:\Windows\system32\DRIVERS\cdrom.sys 98304 bytes (Microsoft Corporation, SCSI CD-ROM Driver)0x92DC5000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 98304 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector)0x92C55000 C:\Windows\System32\Drivers\dfsc.sys 94208 bytes (Microsoft Corporation, DFS Namespace Client Driver)0x92316000 C:\Windows\system32\DRIVERS\rasl2tp.sys 94208 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)0x92C6C000 C:\Windows\system32\DRIVERS\usbccgp.sys 94208 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)0x92CF6000 C:\Windows\system32\DRIVERS\cdfs.sys 90112 bytes (Microsoft Corporation, CD-ROM File System Driver)0x92BB3000 C:\Windows\system32\DRIVERS\pacer.sys 90112 bytes (Microsoft Corporation, QoS Packet Scheduler)0x92B0F000 C:\Windows\system32\DRIVERS\tdx.sys 90112 bytes (Microsoft Corporation, TDI Translation Driver)0xA51A1000 C:\Windows\System32\drivers\mpsdrv.sys 86016 bytes (Microsoft Corporation, Microsoft Protection Service Driver)0x9237E000 C:\Windows\system32\DRIVERS\rassstp.sys 86016 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager)0x9236A000 C:\Windows\system32\DRIVERS\raspptp.sys 81920 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)0x921A8000 C:\Windows\system32\DRIVERS\rimsptsk.sys 81920 bytes (REDC, RICOH MS Driver)0x92B25000 C:\Windows\system32\DRIVERS\smb.sys 81920 bytes (Microsoft Corporation, SMB Transport driver)0x921BC000 C:\Windows\system32\DRIVERS\i8042prt.sys 77824 bytes (Microsoft Corporation, i8042 Port Driver)0xA50EB000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6)0x92BD7000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)0x8D791000 C:\Windows\system32\drivers\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver)0x9283C000 C:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy)0x80686000 C:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver)0x92197000 C:\Windows\system32\DRIVERS\rimmptsk.sys 69632 bytes (REDC, RICOH SD Driver)0x85BD8000 C:\Windows\system32\drivers\fileinfo.sys 65536 bytes (Microsoft Corporation, FileInfo Filter Driver)0x9294B000 C:\Windows\system32\DRIVERS\HIDCLASS.SYS 65536 bytes (Microsoft Corporation, Hid Class Library)0x92D7C000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver)0x85B8A000 C:\Windows\System32\drivers\mountmgr.sys 65536 bytes (Microsoft Corporation, Mount Point Manager)0x9215F000 C:\Windows\system32\DRIVERS\ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver)0x92393000 C:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Terminal Server Driver)0x92D4C000 C:\Windows\win32k.sys:2 61440 bytes0x92264000 C:\Windows\system32\DRIVERS\intelppm.sys 61440 bytes (Microsoft Corporation, Processor Device Driver)0x92D38000 C:\Windows\system32\DRIVERS\monitor.sys 61440 bytes (Microsoft Corporation, Monitor Driver)0x8D75B000 C:\Windows\System32\Drivers\mup.sys 61440 bytes (Microsoft Corporation, Multiple UNC Provider driver)0x85B15000 C:\Windows\System32\drivers\partmgr.sys 61440 bytes (Microsoft Corporation, Partition Management Driver)0x9235B000 C:\Windows\system32\DRIVERS\raspppoe.sys 61440 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)0x91D92000 C:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)0x85B31000 C:\Windows\system32\drivers\volmgr.sys 61440 bytes (Microsoft Corporation, Volume Manager Driver)0x9216F000 C:\Windows\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver)0x98500000 C:\Windows\System32\cdd.dll 57344 bytes (Microsoft Corporation, Canonical Display Driver)0x923CF000 C:\Windows\system32\DRIVERS\circlass.sys 57344 bytes (Microsoft Corporation, Consumer IR Class Driver for eHome)0x92BC9000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver)0x929D2000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver)0x85BCA000 C:\Windows\system32\drivers\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)0x92BEA000 C:\Windows\System32\Drivers\SCDEmu.SYS 57344 bytes (PowerISO Computing, Inc., PowerISO Virtual Drive)0x92D0C000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver)0x923E7000 C:\Windows\system32\DRIVERS\umbus.sys 53248 bytes (Microsoft Corporation, User-Mode Bus Enumerator)0x85A8A000 C:\Windows\system32\drivers\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR)0xA63AA000 C:\Windows\System32\drivers\tcpipreg.sys 49152 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver)0x9298A000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)0x91CB0000 C:\Windows\System32\drivers\watchdog.sys 49152 bytes (Microsoft Corporation, Watchdog Driver)0x92D19000 C:\Windows\System32\Drivers\dump_dumpata.sys 45056 bytes0x92940000 C:\Windows\system32\DRIVERS\hidir.sys 45056 bytes (Microsoft Corporation, Infrared Miniport Driver for Input Devices)0x921CF000 C:\Windows\system32\DRIVERS\kbdclass.sys 45056 bytes (Microsoft Corporation, Keyboard Class Driver)0x9223B000 C:\Windows\system32\DRIVERS\mouclass.sys 45056 bytes (Microsoft Corporation, Mouse Class Driver)0x929C7000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver)0x9232D000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)0x922F0000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper)0x8D7EE000 C:\Windows\system32\DRIVERS\tunnel.sys 45056 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)0x91D49000 C:\Windows\system32\DRIVERS\usbuhci.sys 45056 bytes (Microsoft Corporation, UHCI USB Miniport Driver)0x85B27000 C:\Windows\system32\DRIVERS\BATTC.SYS 40960 bytes (Microsoft Corporation, Battery Class Driver)0x92D24000 C:\Windows\System32\Drivers\dump_msahci.sys 40960 bytes0x92D2E000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver)0x85BC0000 C:\Windows\system32\drivers\msahci.sys 40960 bytes (Microsoft Corporation, MS AHCI 1.0 Standard Driver)0x923DD000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver)0xA50E1000 C:\Windows\system32\DRIVERS\ndisuio.sys 40960 bytes (Microsoft Corporation, NDIS User mode I/O driver)0x92C4B000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy)0xA63A0000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)0x8D7C3000 C:\Windows\system32\drivers\crcdisk.sys 36864 bytes (Microsoft Corporation, Disk Block Verification Filter Driver)0x92973000 C:\Windows\System32\Drivers\Fs_Rec.SYS 36864 bytes (Microsoft Corporation, File System Recognizer Driver)0x92C85000 C:\Windows\system32\DRIVERS\hidusb.sys 36864 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)0x92962000 C:\Windows\system32\DRIVERS\kbdhid.sys 36864 bytes (Microsoft Corporation, HID Keyboard Filter Driver)0xA6282000 C:\Windows\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)0x85BE8000 C:\Windows\System32\Drivers\PxHelp20.sys 36864 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)0x929E0000 C:\Windows\System32\DRIVERS\rasacd.sys 36864 bytes (Microsoft Corporation, RAS Automatic Connection Driver)0x984E0000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver)0x8D600000 C:\Windows\system32\DRIVERS\tunmp.sys 36864 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)0x92273000 C:\Windows\system32\DRIVERS\wmiacpi.sys 36864 bytes (Microsoft Corporation, Windows Management Interface for ACPI)0x85ADD000 C:\Windows\system32\drivers\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll)0x85B9A000 C:\Windows\system32\drivers\atapi.sys 32768 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver)0x80697000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver)0x9296B000 C:\Windows\system32\DRIVERS\mouhid.sys 32768 bytes (Microsoft Corporation, HID Mouse Filter Driver)0x85AE6000 C:\Windows\system32\drivers\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver)0x929B7000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport)0x929BF000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Miniport)0x8D753000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor)0x92983000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver)0x9295B000 C:\Windows\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)0x8060F000 C:\Windows\system32\kdcom.dll 28672 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)0x9297C000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver)0x9225E000 C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)0x92D76000 C:\Windows\system32\DRIVERS\packet.sys 24576 bytes (SingleClick Systems, SCS NDIS 5.0 Auto IP Protocol Driver)0xA6200000 C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 24576 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASDIFSV.SYS)0x92D47000 C:\Windows\win32k.sys:1 20480 bytes0x9227C000 C:\Windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver)0xA63B6000 C:\Windows\system32\drivers\mbam.sys 16384 bytes (Malwarebytes Corporation, Malwarebytes' Anti-Malware)0x85B24000 C:\Windows\system32\DRIVERS\compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver)0x923A3000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)0x92C83000 C:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)==============================================>Stealth==============================================0x07E60000 Hidden Image-->CLI.Component.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 1003520 bytes0x06030000 Hidden Image-->CLI.Aspect.Radeon3D.Graphics.Wizard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 102400 bytes0x026E0000 Hidden Image-->BCMLogon.dll [ EPROCESS 0x8D3E0020 ] PID: 792, 1060864 bytes0x00500000 Hidden Image-->MOM.Implementation.DLL [ EPROCESS 0x880A47A0 ] PID: 5300, 118784 bytes0x00C00000 Hidden Image-->MOM.Implementation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 118784 bytes0x07590000 Hidden Image-->CLI.Aspect.DisplaysOptions.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 126976 bytes0x06EB0000 Hidden Image-->CLI.Aspect.Welcome.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 143360 bytes0x075C0000 Hidden Image-->CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 159744 bytes0x08280000 Hidden Image-->CLI.Aspect.DisplaysManager.Graphics.Wizard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 1699840 bytes0x06920000 Hidden Image-->CLI.Aspect.InfoCentre.Graphics.Wizard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 217088 bytes0x06EE0000 Hidden Image-->CLI.Aspect.InfoCentre.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 233472 bytes0x051F0000 Hidden Image-->CLI.Caste.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 282624 bytes0x01BA0000 Hidden Image-->SupportSoft.Agent.Sprocket.dll [ EPROCESS 0x881DCCE8 ] PID: 4512, 28672 bytes0x01700000 Hidden Image-->MOM.Foundation.DLL [ EPROCESS 0x880A47A0 ] PID: 5300, 28672 bytes0x01740000 Hidden Image-->LOG.Foundation.Implementation.Private.DLL [ EPROCESS 0x880A47A0 ] PID: 5300, 28672 bytes0x009F0000 Hidden Image-->MOM.Foundation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x00A50000 Hidden Image-->LOG.Foundation.Implementation.Private.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x00CE0000 Hidden Image-->LOCALIZATION.Foundation.Private.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x00D30000 Hidden Image-->CLI.Component.Runtime.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x03F00000 Hidden Image-->AEM.Server.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x04180000 Hidden Image-->AEM.Plugin.Hotkeys.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x04160000 Hidden Image-->AEM.Plugin.DPPE.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x041B0000 Hidden Image-->AEM.Plugin.WinMessages.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x041E0000 Hidden Image-->DEM.Graphics.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x041D0000 Hidden Image-->DEM.Foundation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x04A30000 Hidden Image-->DEM.OS.I0602.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x04BA0000 Hidden Image-->DEM.OS.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x04BB0000 Hidden Image-->DEM.Graphics.I0709.dll [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x04BD0000 Hidden Image-->AEM.Plugin.GD.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x05380000 Hidden Image-->AEM.Actions.CCAA.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x05390000 Hidden Image-->DEM.Graphics.I0804.dll [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x055A0000 Hidden Image-->DEM.Graphics.I0706.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x053F0000 Hidden Image-->CLI.Aspect.HotkeysHandling.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x05400000 Hidden Image-->CLI.Aspect.HotkeysHandling.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x05440000 Hidden Image-->CLI.Caste.Graphics.Runtime.Shared.Private.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x05590000 Hidden Image-->DEM.Graphics.I0805.dll [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x059F0000 Hidden Image-->DEM.Graphics.I0712.dll [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x05DF0000 Hidden Image-->CLI.Component.Runtime.Extension.EEU.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x05DC0000 Hidden Image-->APM.Foundation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x05DE0000 Hidden Image-->AEM.Plugin.EEU.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x05E30000 Hidden Image-->CLI.Component.Client.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x05E40000 Hidden Image-->CLI.Component.Wizard.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x06020000 Hidden Image-->CLI.Caste.Graphics.Wizard.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x06970000 Hidden Image-->atixclib.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x06D50000 Hidden Image-->CLI.Component.Dashboard.Shared.Private.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x06D40000 Hidden Image-->CLI.Component.Dashboard.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x06D90000 Hidden Image-->CLI.Caste.Graphics.Dashboard.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes0x06BF0000 Hidden Image-->CLI.Aspect.DeviceLCD.Graphics.Wizard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 315392 bytes0x07C60000 Hidden Image-->CLI.Aspect.Radeon3D.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 356352 bytes0x03E70000 Hidden Image-->CCC.Implementation.DLL [ EPROCESS 0x880A47A0 ] PID: 5300, 36864 bytes0x03F80000 Hidden Image-->NEWAEM.Foundation.DLL [ EPROCESS 0x880A47A0 ] PID: 5300, 36864 bytes0x009C0000 Hidden Image-->CCC.Implementation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes0x00C30000 Hidden Image-->CLI.Foundation.XManifest.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes0x00D00000 Hidden Image-->AxInterop.WBOCXLib.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes0x03F10000 Hidden Image-->Interop.WBOCXLib.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes0x01DD0000 Hidden Image-->NEWAEM.Foundation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes0x041A0000 Hidden Image-->LOCALIZATION.Foundation.Implementation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes0x04A20000 Hidden Image-->ACE.Graphics.DisplaysManager.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes0x05460000 Hidden Image-->CLI.Aspect.CustomFormats.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes0x05610000 Hidden Image-->CLI.Aspect.DisplaysColour2.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes0x058B0000 Hidden Image-->CLI.Aspect.DeviceLCD.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes0x05850000 Hidden Image-->CLI.Aspect.DisplaysOptions.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes0x05D90000 Hidden Image-->CLI.Aspect.PowerPlayDPPE.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes0x05F70000 Hidden Image-->CLI.Component.Wizard.Shared.Private.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes0x07A00000 Hidden Image-->CLI.Aspect.DeviceCRT.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 389120 bytes0x057A0000 Hidden Image-->WLTRAY.EXE [ EPROCESS 0x9C678D90 ] PID: 1948, 3952640 bytes0x05FB0000 Hidden Image-->CLI.Component.Wizard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 405504 bytes0x06B80000 Hidden Image-->CLI.Aspect.MMVideo.Graphics.Wizard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 413696 bytes0x07A60000 Hidden Image-->CLI.Aspect.DeviceLCD.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 413696 bytes0x07520000 Hidden Image-->CLI.Aspect.DisplaysManager.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 446464 bytes0x01B80000 Hidden Image-->SupportSoft.Agent.Sprocket.SupportMessage.dll [ EPROCESS 0x881DCCE8 ] PID: 4512, 45056 bytes0x00530000 Hidden Image-->LOG.Foundation.DLL [ EPROCESS 0x880A47A0 ] PID: 5300, 45056 bytes0x016D0000 Hidden Image-->LOG.Foundation.Private.DLL [ EPROCESS 0x880A47A0 ] PID: 5300, 45056 bytes0x009E0000 Hidden Image-->LOG.Foundation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 45056 bytes0x00B50000 Hidden Image-->LOG.Foundation.Private.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 45056 bytes0x00D40000 Hidden Image-->ATICCCom.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 45056 bytes0x05570000 Hidden Image-->CLI.Aspect.DeviceProperty.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 45056 bytes0x055B0000 Hidden Image-->CLI.Aspect.DeviceProperty.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 45056 bytes0x05740000 Hidden Image-->CLI.Aspect.DisplaysOptions.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 45056 bytes0x058A0000 Hidden Image-->CLI.Aspect.DeviceLCD.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 45056 bytes0x07BE0000 Hidden Image-->CLI.Aspect.DeviceDFP.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 462848 bytes0x068A0000 Hidden Image-->CLI.Aspect.TransCode.Graphics.Wizard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 495616 bytes0x027F0000 Hidden Image-->msvcm80.dll [ EPROCESS 0x8D3E0020 ] PID: 792, 507904 bytes0x03FA0000 Hidden Image-->msvcm80.dll [ EPROCESS 0x9C678D90 ] PID: 1948, 507904 bytes0x024F0000 Hidden Image-->msvcm80.dll [ EPROCESS 0x88285420 ] PID: 4480, 507904 bytes0x083B0000 Hidden Image-->msvcm80.dll [ EPROCESS 0x88243400 ] PID: 4536, 507904 bytes0x00CF0000 Hidden Image-->CLI.Component.Runtime.Shared.Private.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes0x00D10000 Hidden Image-->CLI.Foundation.Private.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes0x01D80000 Hidden Image-->AEM.Server.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes0x03EF0000 Hidden Image-->AEM.Plugin.Source.Kit.Server.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes0x041C0000 Hidden Image-->DEM.Graphics.I0601.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes0x05450000 Hidden Image-->CLI.Aspect.DeviceCV.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes0x05600000 Hidden Image-->CLI.Aspect.DisplaysColour2.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes0x05870000 Hidden Image-->CLI.Aspect.DeviceCRT.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes0x05D80000 Hidden Image-->CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes0x05E20000 Hidden Image-->CLI.Component.Client.Shared.Private.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes0x05F90000 Hidden Image-->CLI.Caste.Graphics.Wizard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes0x06960000 Hidden Image-->CLI.Aspect.TransCode.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes0x07CC0000 Hidden Image-->CLI.Aspect.DisplaysColour2.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 593920 bytes0x00A40000 Hidden Image-->CLI.Foundation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 61440 bytes0x00C20000 Hidden Image-->CLI.Component.SkinFactory.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 61440 bytes0x00CD0000 Hidden Image-->CLI.Component.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 61440 bytes0x04A10000 Hidden Image-->CLI.Caste.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 61440 bytes0x05880000 Hidden Image-->CLI.Aspect.DeviceCRT.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 61440 bytes0x059E0000 Hidden Image-->CLI.Aspect.DeviceDFP.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 61440 bytes0x05A10000 Hidden Image-->CLI.Aspect.Radeon3D.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 61440 bytes0x05AF0000 Hidden Image-->CLI.Aspect.MMVideo.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 61440 bytes0x016E0000 Hidden Image-->LOG.Foundation.Implementation.DLL [ EPROCESS 0x880A47A0 ] PID: 5300, 69632 bytes0x00B30000 Hidden Image-->LOG.Foundation.Implementation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 69632 bytes0x058C0000 Hidden Image-->CLI.Aspect.DeviceDFP.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 69632 bytes0x05A80000 Hidden Image-->CLI.Aspect.Radeon3D.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 69632 bytes0x05DA0000 Hidden Image-->APM.Server.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 69632 bytes0x0E130000 Hidden Image-->BCMWLCPL.CPL [ EPROCESS 0x88243400 ] PID: 4536, 7045120 bytes0x01B50000 Hidden Image-->bcmwlrmt.dll [ EPROCESS 0x9C678D90 ] PID: 1948, 77824 bytes0x02250000 Hidden Image-->bcmwlrmt.dll [ EPROCESS 0x88285420 ] PID: 4480, 77824 bytes0x01510000 Hidden Image-->sprtmessage.dll [ EPROCESS 0x881DCCE8 ] PID: 4512, 77824 bytes0x05260000 Hidden Image-->ATIDEMOS.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 77824 bytes0x05410000 Hidden Image-->CLI.Aspect.DeviceCV.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 77824 bytes0x055E0000 Hidden Image-->CLI.Aspect.DeviceTV.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 77824 bytes0x08610000 Hidden Image-->CLI.Aspect.MMVideo.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 815104 bytes0x055C0000 Hidden Image-->CLI.Aspect.DeviceTV.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 86016 bytes0x05AB0000 Hidden Image-->CLI.Aspect.MMVideo.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 86016 bytes0x06D70000 Hidden Image-->CLI.Caste.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 86016 bytes Link to post Share on other sites More sharing options...
kahdah Posted December 26, 2010 ID:365818 Share Posted December 26, 2010 Is that the entire log it looks to be cut off.Please try to attach it. Link to post Share on other sites More sharing options...
muckdork Posted December 26, 2010 Author ID:365951 Share Posted December 26, 2010 At the en of the scan it has this but it doesn't show up in the report at the end:!!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)Report.txt Link to post Share on other sites More sharing options...
kahdah Posted December 27, 2010 ID:366194 Share Posted December 27, 2010 Please save this file to your desktop.Double click it to run it.Please post or attach the log that appears on your desktop.It should be named this > win32kdiag.txt Link to post Share on other sites More sharing options...
muckdork Posted December 27, 2010 Author ID:366242 Share Posted December 27, 2010 Here it is. Again thank you for the help.Win32kDiag.txt Link to post Share on other sites More sharing options...
muckdork Posted December 27, 2010 Author ID:366246 Share Posted December 27, 2010 Sorry, disregard last attachment, it wasn't finished. This is the complete one.Win32kDiag.txt Link to post Share on other sites More sharing options...
kahdah Posted December 27, 2010 ID:366370 Share Posted December 27, 2010 1. Please download The Avenger2 by Swandog46 to your Desktop.Right click on the Avenger.zip folder and select "Extract All..." Follow the prompts and extract the avenger folder to your desktop2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):Files to move:C:\Windows\System32\logevent.dll | C:\Windows\System32\cngaudit.dllNote: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.3. Now, open the avenger folder and start The Avenger program by clicking on its icon. Right click on the window under Input script here:, and select Paste. You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard. Click on Execute Answer "Yes" twice when prompted.4. The Avenger will automatically do the following:[*]It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.) [*]On reboot, it will briefly open a black command window on your desktop, this is normal.[*]After the restart, it creates a log file that should open with the results of Avenger Link to post Share on other sites More sharing options...
muckdork Posted December 28, 2010 Author ID:366638 Share Posted December 28, 2010 For the first one, the code worked as I could run combofix.Here is the result of that.ComboFix.txt Link to post Share on other sites More sharing options...
kahdah Posted December 28, 2010 ID:366694 Share Posted December 28, 2010 Great.Update Run MalwarebytesPlease update\run Malwarebytes' Anti-Malware.Double Click the Malwarebytes Anti-Malware icon to run the application.Click on the update tab then click on Check for updates.If an update is found, it will download and install the latest version.Once the update has loaded, go to the Scanner tab and select "Perform Quick Scan", then click Scan.The scan may take some time to finish,so please be patient.When the scan is complete, click OK, then Show Results to view the results.Make sure that everything is checked, and click Remove Selected.When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.Copy&Paste the entire report in your next reply.Extra Note:If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatley.=====* Go here to run an online scannner from ESET.Note: You will need to use Internet explorer for this scanTick the box next to YES, I accept the Terms of Use.Click StartWhen asked, allow the activex control to installClick StartCheck next options: Remove found threats and Scan inside archives.Click ScanWait for the scan to finishClick on the option that says Export to text file.Save it to your desktop and post the contents here in your next reply.Once the log is saved click the option to delete quarantined threats and Uninstall application on close. Link to post Share on other sites More sharing options...
muckdork Posted December 28, 2010 Author ID:366805 Share Posted December 28, 2010 I tried to run mbam but it still tells me I don't have permission. I am running ESET as we speak and it's still scanning (for over 2 hours). I'll reply again with log. Link to post Share on other sites More sharing options...
kahdah Posted December 28, 2010 ID:366838 Share Posted December 28, 2010 OK for mbam we just need to reset permissions on the file so it can run.Click Here and download this program.Save it to the desktop.Drag the mbam file in this location C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe onto the inherit program.A box will popup and say ok.Once that is done it will open then proceed with the instructions for running mbam and post it's log please. Link to post Share on other sites More sharing options...
muckdork Posted December 28, 2010 Author ID:366896 Share Posted December 28, 2010 Here are the two logs!eset_report.txtmbam_log_2010_12_28__16_22_04_.txt Link to post Share on other sites More sharing options...
kahdah Posted December 28, 2010 ID:366953 Share Posted December 28, 2010 Looks good how are things running?Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here. "%userprofile%\desktop\win32kdiag.exe" -f -r Open OTL once more and click on Run scan at the top.Post the new log that opens Link to post Share on other sites More sharing options...
muckdork Posted December 28, 2010 Author ID:366959 Share Posted December 28, 2010 Wow! Everything is running smoothly! I can run iexplorer and firefox now, and I can finally turn on Windows Security!OTL.TxtWin32kDiag.txt Link to post Share on other sites More sharing options...
kahdah Posted December 29, 2010 ID:367001 Share Posted December 29, 2010 Great. Please open up Notepad and copy all of the items in the code box below.Change the "Save As Type" to "All Files". Save it as fix.reg on your Desktop.REGEDIT4[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]"ProxyServer"=-Now double-click fix.reg.A window will come up asking if you want to let it merge with the registry.Click yes. After that happens you cand elete that file.=======Cleanup======= Click START then RUN Now type Combofix /uninstall in the runbox and click OK. Note the space between the X and the Uninstall, it needs to be there.======Next======Double click on OTL to run it.Click on the Cleanup button at the top.You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.This will remove itself and other tools we may have used.===============Update Java===============Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:Download the latest version of Java SE Runtime Environment (JRE) and save it to your desktop.Scroll down to where it says "(JRE) then click on itClick the "Download" button to the right.Select your Platform: "Windows".Select your Language: "Multi-language".Read the License Agreement, and then check the box that says: "Accept License Agreement".Click Continue and the page will refresh.Click on the link to download Windows Offline Installation and save the file to your desktop.Close any programs you may have running - especially your web browser.Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.Click the Remove or Change/Remove button.Repeat as many times as necessary to remove each Java versions.Reboot your computer once all Java components are removed.Then from your desktop double-click on jre-6u23-windows-i586.exe to install the newest version.=====After that your all set. ===The following are some articles and a Windows Update link that I like to suggest to people to prevent malware and general PC maintenance===Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.Prevention article Some great guidelines to follow to prevent future infections please read the Prevention artice by Miekiemoes.How did I get infected in the first place? Also this one by Tony Klein.If your computer is slow Things you can do if your computer is slow.PC Safety and Security - What Do I Need? Security suggestions and general hints and tips for PC security.File sharing program dangers Reasons to stay away from File sharing programs for ex: BitTorrent,Limewire,Kazaa,emule,Utorrent etc...===Free antimalware tools used for on demand scanning and cleaning no real time unless purchased===Malwarebytes Antimalwaresuperantispyware===Free antivirus links===This is antivirus and antispyware. Microsoft Security EssentialsThis is free antispyware protection and Antivirus protection. AVG freeThis is just antivirus protection. AntivirThis is antivirus and antispyware protection.Avast Link to post Share on other sites More sharing options...
muckdork Posted December 29, 2010 Author ID:367066 Share Posted December 29, 2010 I can't thank you enough for all the help!!! Link to post Share on other sites More sharing options...
kahdah Posted December 29, 2010 ID:367109 Share Posted December 29, 2010 You are welcome Link to post Share on other sites More sharing options...
Recommended Posts