Jump to content
Due to inclement weather in Southwest Florida, our Clearwater support team is offline. Our other offices are available to assist you, however their responses may be delayed. We appreciate your patience and understanding during this time. ×

A combination of many things


muckdork
 Share

Recommended Posts

Hello, I was hoping you could help me.

I've been having a couple of problems for months now and now I'm trying to systematically go about removing as much malware I can. I'm running Windows Vista

I've downloaded Malwarebytes and registered the product but a few things happen. I can install perfectly fine and when it asks me to update and scan it does so. Except when it scans, it freezes for a second, and then it gets a (Not Responding) next to the title bar then it closes. When I try to run it again I get a "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item."

I've read around and it was suggested to rename mbam.exe into something else but even I can't do that. When I try to rename it tells me "I need permission to perform this action."

I've tried to follow the instructions here. The defogger works but it doesn't prompt me to restart the computer. I can download DDS but when I try to run it, a black screen pops up with some text but closes the instant it opens. It says I need to disable any script blockers but I don't have any other av programs on my computer.

I've downloaded and run the GMER Rootkit Scanner on two instances. The first one ended in a blue screen of death. I tried it again, it worked for awhile, but then it closes unexpectedly.

I tried following what was in this thread. It ran once, closed unexpectedly, and when I tried opening it again it said I did not have permission.

Other things: The problem started when I no longer could run iexplore and firefox, I can only use Safari and Google Chrome. For awhile I had a google redirect bug, but I believe I fixed that. Windows Security Center doesn't work. Right now the service is off and when I try to turn it on it keeps telling me that it can't be started. I had so many av programs and whatnots that I have uninstalled, but am unsure if it is completely uninstalled. I've had AVG, Spyware Doctor, and RegCure run and tell me I have viruses. On Spyware Doctor, everytime I try to remove or quarantine the 26-40 bugs (it would cycle between these numbers depending on the day) I would get a Blue Screen of Death. I would love to give you logs but DDS isn't working for me. I've been using torrents, but have just recently stopped. Apparently, I have everything going against me and probably have deserved it. I do hope to get the problem fixed so if it does happen again, I'll know what to do. Thanks for your time.

Link to post
Share on other sites

Hello muckdork

Welcome to Malwarebytes.

=====================

  • Download OTL to your desktop.
  • Double click on OTL to run it.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Under the Standard Registry box change it to All.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

====================

Download This file. Note its name and save it to your root folder, such as C:\.

  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
  • Click on this link to see a list of programs that should be disabled.
  • Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
  • Allow the driver to load if asked.
  • You may be prompted to scan immediately if it detects rootkit activity.
  • If you are prompted to scan your system click "Yes" to begin the scan.
  • If not prompted, click the "Rootkit/Malware" tab.
  • On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
  • Select all drives that are connected to your system to be scanned.
  • Click the Scan button to begin. (Please be patient as it can take some time to complete)
  • When the scan is finished, click Save to save the scan results to your Desktop.
  • Save the file as Results.log and copy/paste the contents in your next reply.
  • Exit the program and re-enable all active protection when done.

Link to post
Share on other sites

OTL worked, here are the resulting logs.

OTL.txt:

OTL logfile created on: 12/24/2010 5:09:19 PM - Run 1

OTL by OldTimer - Version 3.2.18.0 Folder = C:\Users\Neal\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18999)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 58.00% Memory free

6.00 Gb Paging File | 5.00 Gb Available in Paging File | 77.00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 287.95 Gb Total Space | 31.44 Gb Free Space | 10.92% Space Free | Partition Type: NTFS

Drive D: | 10.00 Gb Total Space | 4.62 Gb Free Space | 46.18% Space Free | Partition Type: NTFS

Computer Name: NEAL-PC | User Name: Neal | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Neal\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

PRC - C:\Users\Neal\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)

PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)

PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

PRC - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)

PRC - C:\Program Files\Search Settings\SearchSettings.exe (Spigot, Inc.)

PRC - C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe ()

PRC - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)

PRC - C:\ProgramData\SingleClick Systems\Remote Access File Sync Service\dsl_fs_sync.exe (SingleClick Systems)

PRC - C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

PRC - C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)

PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)

PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)

PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)

PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)

PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)

PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_2ba5baa4\stacsv.exe (IDT, Inc.)

PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_2ba5baa4\AEstSrv.exe (Andrea Electronics Corporation)

PRC - C:\Program Files\Dell Video Chat\DellVideoChat.exe (Dell Inc. and SightSpeed Inc.)

PRC - C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)

PRC - C:\Windows\System32\wermgr.exe (Microsoft Corporation)

PRC - C:\ProgramData\SingleClick Systems\apache\bin\httpd.exe (Apache Software Foundation)

PRC - C:\ProgramData\SingleClick Systems\MySQL\bin\mysqld.exe ()

PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\Neal\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (Lavasoft Ad-Aware Service) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe File not found

SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)

SRV - (WAS) -- C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)

SRV - (W3SVC) -- C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)

SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)

SRV - (TomTomHOMEService) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)

SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)

SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)

SRV - (AppHostSvc) -- C:\Windows\System32\inetsrv\apphostsvc.dll (Microsoft Corporation)

SRV - (GoToAssist) -- C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)

SRV - (GoogleDesktopManager-092308-165331) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)

SRV - (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)

SRV - (hnmsvc) -- c:\ProgramData\SingleClick Systems\Advanced Networking Service\hnm_svc.exe (Dell Inc.)

SRV - (dsl-fs-sync) -- C:\ProgramData\SingleClick Systems\Remote Access File Sync Service\dsl_fs_sync.exe (SingleClick Systems)

SRV - (DockLoginService) -- C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)

SRV - (STacSV) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_2ba5baa4\stacsv.exe (IDT, Inc.)

SRV - (AESTFilters) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_2ba5baa4\AEstSrv.exe (Andrea Electronics Corporation)

SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV - (Apache2.2) -- C:\ProgramData\SingleClick Systems\apache\bin\httpd.exe (Apache Software Foundation)

SRV - (dsl-db) -- C:\ProgramData\SingleClick Systems\MySQL\bin\mysqld.exe ()

SRV - (Viewpoint Manager Service) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)

========== Driver Services (SafeList) ==========

DRV - (rootrepeal) -- C:\Windows\System32\drivers\rootrepeal.sys File not found

DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found

DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found

DRV - (Lavasoft Kernexplorer) -- C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys File not found

DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found

DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)

DRV - (SCDEmu) -- C:\Windows\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)

DRV - (BCM42RLY) -- C:\Windows\System32\drivers\bcm42rly.sys (Broadcom Corporation)

DRV - (BCM43XX) -- C:\Windows\System32\drivers\BCMWL6.SYS (Broadcom Corporation)

DRV - (OA001Ufd) -- C:\Windows\System32\drivers\OA001Ufd.sys (Creative Technology Ltd.)

DRV - (OA001Vid) -- C:\Windows\System32\drivers\OA001Vid.sys (Creative Technology Ltd.)

DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)

DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)

DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)

DRV - (k57nd60x) Broadcom NetLink -- C:\Windows\System32\drivers\k57nd60x.sys (Broadcom Corporation)

DRV - (itecir) -- C:\Windows\System32\drivers\itecir.sys (ITE Tech. Inc. )

DRV - (STHDA) -- C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)

DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC)

DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC)

DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)

DRV - (Packet) -- C:\Windows\System32\drivers\packet.sys (SingleClick Systems)

DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)

DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)

DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)

DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)

DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)

DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)

DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)

DRV - (e1express) Intel® -- C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)

DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)

DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)

DRV - (E1G60) Intel® -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)

DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)

DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)

DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)

DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)

DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)

DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)

DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)

DRV - (xnacc) -- C:\Windows\System32\drivers\xnacc.sys (Microsoft Corporation)

DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)

DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)

DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)

DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)

DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)

DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)

DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)

DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)

DRV - (XBCD) -- C:\Windows\System32\drivers\xbcd.sys (Redcl0ud)

DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)

DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)

DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)

DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)

DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)

DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)

DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)

DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)

DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)

DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)

DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)

DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)

DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)

DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)

DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)

DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)

DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)

DRV - (BrUsbSer) -- C:\Windows\System32\drivers\BrUsbSer.sys (Brother Industries Ltd.)

DRV - (BrSerIf) -- C:\Windows\System32\drivers\BrSerIf.sys (Brother Industries Ltd.)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&cl...amp;ibd=4081218

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data over 100 bytes]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [binary data over 100 bytes]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/dell?hl=en&cl...amp;ibd=4081218

IE - HKLM\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&cl...amp;ibd=4081218

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm...tf8&oe=utf8

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/dell?hl=en&cl...amp;ibd=4081218

IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)

IE - HKCU\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb128\SearchSettings.dll (Spigot, Inc.)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:56566

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2010/11/20 16:32:07 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord\firefox\ext [2010/11/20 16:32:26 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\Extensions\\FFToolbar@bitdefender.com: C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\ [2010/11/13 08:40:06 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.4\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/24 09:50:17 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.4\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/12 17:46:11 | 000,000,000 | ---D | M]

[2010/01/29 19:34:04 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\Mozilla\Extensions

[2010/01/29 19:34:04 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com

[2010/06/25 22:50:53 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

[2010/06/25 22:50:53 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[2010/06/14 07:16:50 | 000,023,512 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll

[2010/06/14 07:16:51 | 000,138,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll

[2010/06/14 07:16:52 | 000,064,984 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll

[2010/12/12 17:46:10 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll

[2010/12/12 17:46:10 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll

[2010/12/12 17:46:10 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll

[2010/12/12 17:46:10 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll

[2010/12/12 17:46:11 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll

[2010/12/12 17:46:11 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll

[2010/12/12 17:46:11 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll

[2010/06/11 17:14:06 | 000,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml

[2010/06/11 17:14:06 | 000,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml

[2010/06/11 17:14:06 | 000,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml

[2010/06/11 17:14:06 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml

[2010/06/11 17:14:06 | 000,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml

[2010/06/11 17:14:06 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml

O1 HOSTS File: ([2006/09/18 16:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: ::1 localhost

O2 - BHO: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll File not found

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)

O2 - BHO: (no name) - {99E00A4C-D35E-11DD-BA95-9B6A56D89593} - No CLSID value found.

O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)

O2 - BHO: (AIM Toolbar Loader) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)

O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)

O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)

O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (SearchSettings Class) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb128\SearchSettings.dll (Spigot, Inc.)

O3 - HKLM\..\Toolbar: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll File not found

O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (AIM Toolbar) - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKCU\..\Toolbar\WebBrowser: (AIM Toolbar) - {61539ECD-CC67-4437-A03C-9AACCBD14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)

O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)

O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)

O4 - HKLM..\Run: [broadcom Wireless Manager UI] C:\Windows\System32\WLTRAY.EXE (Dell Inc.)

O4 - HKLM..\Run: [Dell DataSafe Online] C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe ()

O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)

O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)

O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)

O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)

O4 - HKLM..\Run: [searchSettings] C:\Program Files\Search Settings\SearchSettings.exe (Spigot, Inc.)

O4 - HKLM..\Run: [startCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [sunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)

O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKCU..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe File not found

O4 - HKCU..\Run: [ehTray.exe] C:\Windows\ehome\ehtray.exe (Microsoft Corporation)

O4 - HKCU..\Run: [Google Update] C:\Users\Neal\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)

O4 - HKCU..\Run: [sightSpeed] C:\Program Files\Dell Video Chat\DellVideoChat.exe (Dell Inc. and SightSpeed Inc.)

O4 - HKCU..\Run: [steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)

O4 - HKCU..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe File not found

O4 - HKCU..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)

O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)

O4 - Startup: C:\Users\Neal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BindDirectlyToPropertySetStorage = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0

O9 - Extra Button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll ()

O9 - Extra 'Tools' menuitem : Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll ()

O9 - Extra Button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPLive.exe ()

O9 - Extra 'Tools' menuitem : PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPLive.exe ()

O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\nlaapi.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 65.32.5.111 65.32.5.112

O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)

O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)

O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)

O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\Windows\System32\shell32.dll (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\Windows\System32\sysdm.cpl (Microsoft Corporation)

O20 - HKCU Winlogon: Shell - (EXPLORER.EXE) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)

O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\Windows\System32\browseui.dll (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\Seagull_1920x1200.jpg

O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\Seagull_1920x1200.jpg

O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)

O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)

O31 - SafeBoot: AlternateShell - cmd.exe

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{013b04e9-d2d9-11dd-9ff6-00217090355d}\Shell - "" = AutoRun

O33 - MountPoints2\{013b04e9-d2d9-11dd-9ff6-00217090355d}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found

O33 - MountPoints2\F\Shell - "" = AutoRun

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/12/24 17:08:24 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\Neal\Desktop\OTL.exe

[2010/12/24 10:26:38 | 007,734,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Neal\Desktop\mbam-setup.exe

[2010/12/24 02:22:21 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2010/12/24 02:22:18 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2010/12/24 02:22:18 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2010/12/23 22:09:29 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com

[2010/12/23 22:09:28 | 000,000,000 | ---D | C] -- C:\Users\Neal\AppData\Roaming\SUPERAntiSpyware.com

[2010/12/19 18:59:33 | 000,000,000 | ---D | C] -- C:\New Folder

[2010/12/15 17:34:35 | 000,352,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll

[2010/12/15 17:34:34 | 000,345,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll

[2010/12/15 17:34:34 | 000,270,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll

[2010/12/15 17:34:29 | 002,038,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys

[2010/12/15 17:34:19 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe

[2010/12/15 17:34:16 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll

[2010/12/15 17:34:16 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll

[2010/12/15 17:34:16 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll

[2010/12/15 17:34:09 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll

[2010/12/15 17:34:08 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe

[2010/12/15 17:34:07 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl

[2010/12/15 17:34:07 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll

[2010/12/15 17:34:07 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll

[2010/12/15 17:34:07 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec

[2010/12/15 17:34:07 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll

[2010/12/15 17:34:07 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe

[2010/12/15 17:34:06 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb

[2010/12/15 17:34:06 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll

[2010/12/15 17:34:06 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe

[2010/12/15 17:34:06 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll

[2010/12/15 17:34:06 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll

[2010/12/15 17:34:06 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll

[2010/12/15 17:34:06 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll

[2010/12/15 17:34:06 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll

[2010/12/15 17:34:06 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll

[2010/12/15 17:33:43 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll

[2010/12/12 18:22:17 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype

[2010/12/12 17:53:28 | 000,000,000 | ---D | C] -- C:\Program Files\iPod

[2010/12/12 17:53:20 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes

[2010/12/12 17:45:18 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime

[2010/12/12 17:41:44 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update

[2010/12/08 15:27:07 | 000,000,000 | ---D | C] -- C:\Qoobox

[2010/12/08 15:12:24 | 000,000,000 | ---D | C] -- C:\Users\Neal\AppData\Roaming\Malwarebytes

[2010/12/08 15:12:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2010/11/28 18:28:23 | 000,000,000 | R--D | C] -- C:\32788R22FWJFW

[2010/11/28 18:27:29 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW.0.tmp

[2010/11/27 20:38:03 | 000,000,000 | ---D | C] -- C:\Users\Neal\Desktop\Final Fantasy Guitar Collections

[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2049/12/31 15:00:00 | 000,011,300 | ---- | M] () -- C:\Users\Neal\Desktop\line-up September 2009 revised 09-04-09.pdf

[2049/12/31 15:00:00 | 000,010,628 | ---- | M] () -- C:\Users\Neal\Desktop\line-up September 2009 revised 09-04-09 CHOIR.pdf

[2010/12/24 17:10:33 | 000,296,448 | ---- | M] () -- C:\2216yc0d.exe

[2010/12/24 17:08:30 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Neal\Desktop\OTL.exe

[2010/12/24 17:05:59 | 000,961,204 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2010/12/24 17:05:59 | 000,227,840 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2010/12/24 17:04:04 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job

[2010/12/24 17:01:18 | 000,002,463 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Dell Remote Access.lnk

[2010/12/24 16:58:48 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2010/12/24 16:58:48 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2010/12/24 16:58:28 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2010/12/24 16:58:28 | 000,000,000 | ---- | M] () -- C:\Windows\win32k.sys

[2010/12/24 16:58:13 | 3215,867,904 | -HS- | M] () -- C:\hiberfil.sys

[2010/12/24 13:13:05 | 000,007,620 | ---- | M] () -- C:\Users\Neal\AppData\Local\d3d9caps.dat

[2010/12/24 12:27:33 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1197788753-1558133579-3234769001-1000UA.job

[2010/12/24 11:00:36 | 000,296,448 | ---- | M] () -- C:\Users\Neal\Desktop\f95nbw5h.exe

[2010/12/24 11:00:07 | 000,624,128 | ---- | M] () -- C:\Users\Neal\Desktop\dds.scr

[2010/12/24 10:59:10 | 000,000,000 | ---- | M] () -- C:\Users\Neal\defogger_reenable

[2010/12/24 10:46:06 | 000,000,932 | ---- | M] () -- C:\Users\Neal\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk

[2010/12/24 10:46:06 | 000,000,908 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/12/24 10:27:39 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Neal\Desktop\mbam-setup.exe

[2010/12/24 10:17:10 | 000,000,000 | ---- | M] () -- C:\Users\Neal\Desktop\settings.dat

[2010/12/24 02:20:44 | 000,780,283 | ---- | M] () -- C:\Users\Neal\Desktop\rkill.exe

[2010/12/24 00:55:29 | 000,061,225 | ---- | M] () -- C:\Users\Neal\AppData\Roaming\E1EA.F89

[2010/12/23 21:28:24 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1197788753-1558133579-3234769001-1000Core.job

[2010/12/22 22:16:29 | 000,675,646 | ---- | M] () -- C:\Users\Neal\Desktop\60450.htm

[2010/12/22 22:16:09 | 000,080,502 | ---- | M] () -- C:\Users\Neal\Desktop\60451.htm

[2010/12/22 22:14:42 | 000,546,699 | ---- | M] () -- C:\Users\Neal\Desktop\60437.htm

[2010/12/21 22:29:04 | 005,877,964 | ---- | M] () -- C:\Users\Neal\Desktop\lotro_quickstart_lowres.pdf

[2010/12/21 22:28:57 | 005,654,641 | ---- | M] () -- C:\Users\Neal\Desktop\lotro_mines_of_moria_manual.pdf

[2010/12/21 11:50:01 | 000,108,544 | ---- | M] () -- C:\Users\Neal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010/12/21 03:16:34 | 000,063,379 | ---- | M] () -- C:\Users\Neal\Desktop\sobad.jpg

[2010/12/21 02:51:42 | 000,102,444 | ---- | M] () -- C:\Users\Neal\Desktop\2007-05-22-302moon.gif

[2010/12/21 02:14:56 | 000,035,543 | ---- | M] () -- C:\Users\Neal\Desktop\ahh.jpg

[2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2010/12/20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2010/12/19 19:00:06 | 000,000,564 | ---- | M] () -- C:\Users\Public\Desktop\DSM Movie Encoder.lnk

[2010/12/16 03:30:55 | 001,631,768 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2010/12/12 18:22:18 | 000,001,878 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2010/12/12 17:56:00 | 000,001,666 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk

[2010/12/11 08:48:24 | 000,001,049 | ---- | M] () -- C:\Users\Public\Desktop\EA Download Manager.lnk

[2010/12/01 23:42:39 | 000,047,972 | ---- | M] () -- C:\Users\Neal\Desktop\pOV0C4YoPcxka63.jpg

[2010/12/01 22:33:48 | 000,013,002 | ---- | M] () -- C:\Users\Neal\Desktop\doug-23808.jpg

[2010/12/01 07:58:52 | 000,122,380 | -H-- | M] () -- C:\Windows\System32\mlfcache.dat

[2010/11/26 13:01:42 | 021,655,516 | ---- | M] () -- C:\Users\Neal\Desktop\FE QUANTUM blue .pptx

[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/12/24 16:58:13 | 3215,867,904 | -HS- | C] () -- C:\hiberfil.sys

[2010/12/24 11:00:33 | 000,296,448 | ---- | C] () -- C:\Users\Neal\Desktop\f95nbw5h.exe

[2010/12/24 11:00:03 | 000,624,128 | ---- | C] () -- C:\Users\Neal\Desktop\dds.scr

[2010/12/24 10:59:10 | 000,000,000 | ---- | C] () -- C:\Users\Neal\defogger_reenable

[2010/12/24 10:46:06 | 000,000,932 | ---- | C] () -- C:\Users\Neal\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk

[2010/12/24 10:17:10 | 000,000,000 | ---- | C] () -- C:\Users\Neal\Desktop\settings.dat

[2010/12/24 10:17:07 | 000,472,064 | ---- | C] () -- C:\Users\Neal\Desktop\RootRepeal.exe

[2010/12/24 02:22:21 | 000,000,908 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/12/24 02:20:36 | 000,780,283 | ---- | C] () -- C:\Users\Neal\Desktop\rkill.exe

[2010/12/23 15:04:16 | 000,559,916 | ---- | C] () -- C:\Users\Neal\Desktop\Userguide_en.pdf

[2010/12/22 22:16:28 | 000,675,646 | ---- | C] () -- C:\Users\Neal\Desktop\60450.htm

[2010/12/22 22:16:10 | 000,080,502 | ---- | C] () -- C:\Users\Neal\Desktop\60451.htm

[2010/12/22 22:14:43 | 000,546,699 | ---- | C] () -- C:\Users\Neal\Desktop\60437.htm

[2010/12/21 22:28:22 | 005,877,964 | ---- | C] () -- C:\Users\Neal\Desktop\lotro_quickstart_lowres.pdf

[2010/12/21 22:28:17 | 005,654,641 | ---- | C] () -- C:\Users\Neal\Desktop\lotro_mines_of_moria_manual.pdf

[2010/12/21 03:16:42 | 000,063,379 | ---- | C] () -- C:\Users\Neal\Desktop\sobad.jpg

[2010/12/21 02:51:46 | 000,102,444 | ---- | C] () -- C:\Users\Neal\Desktop\2007-05-22-302moon.gif

[2010/12/21 02:14:56 | 000,035,543 | ---- | C] () -- C:\Users\Neal\Desktop\ahh.jpg

[2010/12/19 21:15:01 | 134,217,728 | ---- | C] () -- C:\Users\Neal\Desktop\9 Hours 9 Persons 9 Doors.nds

[2010/12/19 19:00:06 | 000,000,564 | ---- | C] () -- C:\Users\Public\Desktop\DSM Movie Encoder.lnk

[2010/12/12 18:22:18 | 000,001,878 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk

[2010/12/12 17:56:00 | 000,001,666 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk

[2010/12/11 08:48:24 | 000,001,049 | ---- | C] () -- C:\Users\Public\Desktop\EA Download Manager.lnk

[2010/12/03 14:40:05 | 000,061,225 | ---- | C] () -- C:\Users\Neal\AppData\Roaming\E1EA.F89

[2010/12/01 23:42:42 | 000,047,972 | ---- | C] () -- C:\Users\Neal\Desktop\pOV0C4YoPcxka63.jpg

[2010/12/01 22:33:55 | 000,013,002 | ---- | C] () -- C:\Users\Neal\Desktop\doug-23808.jpg

[2010/12/01 07:58:52 | 000,122,380 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat

[2010/11/26 16:50:26 | 021,655,516 | ---- | C] () -- C:\Users\Neal\Desktop\FE QUANTUM blue .pptx

[2010/10/23 02:00:20 | 000,000,552 | ---- | C] () -- C:\Users\Neal\AppData\Local\d3d8caps.dat

[2010/08/20 19:41:08 | 000,000,262 | ---- | C] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini

[2010/08/18 10:32:50 | 000,000,025 | ---- | C] () -- C:\Users\Neal\AppData\Roaming\bdfvconp.ini

[2010/07/24 21:50:04 | 000,000,419 | ---- | C] () -- C:\Windows\BRWMARK.INI

[2010/07/24 21:50:04 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI

[2010/07/24 21:41:31 | 000,000,804 | ---- | C] () -- C:\Windows\Brpfx04a.ini

[2010/07/24 21:41:31 | 000,000,094 | ---- | C] () -- C:\Windows\brpcfx.ini

[2010/07/24 21:28:58 | 000,106,496 | ---- | C] () -- C:\Windows\System32\BrMuSNMP.dll

[2010/02/19 22:20:13 | 000,006,336 | ---- | C] () -- C:\Windows\System32\ABTsc18.ini

[2010/02/19 22:19:30 | 000,000,059 | ---- | C] () -- C:\Windows\System32\CBWsc18.ini

[2009/12/12 17:17:16 | 000,000,600 | ---- | C] () -- C:\Users\Neal\AppData\Roaming\winscp.rnd

[2009/10/25 13:49:01 | 000,000,000 | ---- | C] () -- C:\Windows\win32k.sys

[2009/09/18 21:53:59 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2009/08/03 14:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll

[2009/01/27 20:28:40 | 000,168,448 | ---- | C] () -- C:\Windows\System32\unrar.dll

[2009/01/06 22:05:28 | 000,007,620 | ---- | C] () -- C:\Users\Neal\AppData\Local\d3d9caps.dat

[2008/12/25 18:18:04 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI

[2008/12/24 11:11:31 | 000,108,544 | ---- | C] () -- C:\Users\Neal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2008/12/18 15:07:37 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll

[2008/12/18 13:33:38 | 000,055,808 | ---- | C] () -- C:\Windows\System32\bcmwlrmt.dll

[2008/10/03 18:07:10 | 003,754,896 | ---- | C] () -- C:\Windows\System32\erdmpg-6.dll

[2008/09/28 12:33:01 | 000,253,952 | ---- | C] () -- C:\Windows\System32\Manipulate.dll

[2008/08/28 06:20:38 | 000,065,536 | ---- | C] () -- C:\Windows\System32\comLyricGetter.dll

[2008/08/28 06:17:22 | 000,097,280 | ---- | C] () -- C:\Windows\System32\Uncommon.dll

[2008/08/28 06:17:20 | 000,061,440 | ---- | C] () -- C:\Windows\System32\NormalizeDSP.dll

[2006/11/06 14:30:38 | 000,262,144 | ---- | C] () -- C:\Windows\System32\lame_enc.dll

[2006/11/02 07:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006/11/02 03:43:04 | 000,061,952 | ---- | C] () -- C:\Windows\System32\cngaudit.dll

[2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2003/11/16 04:48:02 | 000,909,312 | ---- | C] () -- C:\Windows\System32\vorbisenc.dll

[2003/11/16 04:48:00 | 001,060,864 | ---- | C] () -- C:\Windows\System32\vorbis.dll

[2003/11/15 11:54:18 | 000,036,864 | ---- | C] () -- C:\Windows\System32\ogg.dll

[2002/10/06 17:42:58 | 000,237,568 | ---- | C] () -- C:\Windows\System32\OggDS.dll

========== LOP Check ==========

[2009/03/03 23:06:54 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\acccore

[2010/11/20 16:32:40 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\BitDefender

[2010/11/20 16:32:23 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\CoreCodec

[2010/02/26 21:09:08 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\Facebook

[2009/10/13 23:45:21 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\FreeFLVConverter

[2009/06/03 22:05:28 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\GetRightToGo

[2010/08/15 19:58:39 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\LolClient

[2009/06/06 10:46:46 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\NetMedia Providers

[2010/06/27 20:29:23 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\ooVoo Details

[2010/07/24 21:46:22 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\PC-FAX TX

[2010/09/26 12:41:46 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\PPLive

[2009/06/06 10:46:46 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\Publish Providers

[2010/04/21 09:38:01 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\Red Kawa

[2010/11/20 16:15:07 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\runic games

[2009/06/06 10:46:45 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\Sony

[2010/09/26 12:36:18 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\StreamTorrent

[2010/08/27 21:42:09 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\SystemRequirementsLab

[2010/11/20 16:32:32 | 000,000,000 | ---D | M] -- C:\Users\Neal\AppData\Roaming\TomTom

[2010/12/24 10:39:56 | 000,032,596 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 64 bytes -> C:\Users\Neal\Desktop\Zach Galifianakis - Live at the Purple Onion.mp4:TOC.WMV

@Alternate Data Stream - 64 bytes -> C:\Users\Neal\Desktop\Stripped.mp4:TOC.WMV

@Alternate Data Stream - 64 bytes -> C:\Users\Neal\Desktop\Better Shooting II pt.2.mp4:TOC.WMV

@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:5D432CE3

@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2

@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:BC359956

< End of report >

Extras.Txt:

OTL Extras logfile created on: 12/24/2010 5:09:19 PM - Run 1

OTL by OldTimer - Version 3.2.18.0 Folder = C:\Users\Neal\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18999)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 58.00% Memory free

6.00 Gb Paging File | 5.00 Gb Available in Paging File | 77.00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 287.95 Gb Total Space | 31.44 Gb Free Space | 10.92% Space Free | Partition Type: NTFS

Drive D: | 10.00 Gb Total Space | 4.62 Gb Free Space | 46.18% Space Free | Partition Type: NTFS

Computer Name: NEAL-PC | User Name: Neal | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{09014A00-7114-4BD9-B813-C98643F43C53}" = rport=445 | protocol=6 | dir=out | app=system |

"{0C7A9217-04C3-4C66-89BC-67B22B42F29D}" = lport=40094 | protocol=6 | dir=in | name=streaming web cam |

"{0D5A23E6-DEA6-476A-8D0D-B1F04F611EFE}" = lport=40092 | protocol=6 | dir=in | name=streaming web cam |

"{0ED1B6C5-9DFB-4975-886D-4ADE5CD8EA78}" = lport=8377 | protocol=17 | dir=in | name=league of legends launcher |

"{116B341D-D40B-4755-9549-845E94EC9385}" = lport=8380 | protocol=6 | dir=in | name=league of legends launcher |

"{1319A345-CD3C-465C-BA8C-AAC7F5565B05}" = lport=8370 | protocol=17 | dir=in | name=league of legends launcher |

"{13F8579D-9A98-4B49-BABD-F800FE378B2B}" = rport=139 | protocol=6 | dir=out | app=system |

"{15AE15CC-058B-4754-BCB2-AFEC3481B5A4}" = lport=8373 | protocol=6 | dir=in | name=league of legends launcher |

"{177C2E83-ADB9-44D4-8C8B-47084B5C48A5}" = lport=8380 | protocol=17 | dir=in | name=league of legends launcher |

"{1B37B762-A774-4156-BF2D-AAF3886FE91E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{1B6F2C19-7AF6-4930-AFA3-66816BAD9D51}" = lport=445 | protocol=6 | dir=in | app=system |

"{1DF3B2F6-FB61-48D7-B313-F92BC34E43C9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{2232D3C7-04C2-4F0E-A10B-E8EAAD39D658}" = lport=8381 | protocol=17 | dir=in | name=league of legends launcher |

"{277BA5B1-AD4B-429F-81E0-FA30760BDDBF}" = lport=139 | protocol=6 | dir=in | app=system |

"{3AC16044-EC9E-49D2-8DB7-4F7EC274DC9C}" = lport=8381 | protocol=6 | dir=in | name=league of legends launcher |

"{3F3F1D28-91D7-4391-B830-D3B35C1E27D7}" = lport=8379 | protocol=6 | dir=in | name=league of legends launcher |

"{3FF80CEE-4DCF-4AA6-9967-0A2B7A513062}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |

"{4AD27320-A1C0-4E67-959F-8A37CB569ADF}" = lport=8375 | protocol=17 | dir=in | name=league of legends launcher |

"{5885537D-49D8-4280-B49C-09AC43B080D6}" = lport=8378 | protocol=17 | dir=in | name=league of legends launcher |

"{5C4118B8-AA63-4E74-B7F7-ED8A993FAAF3}" = lport=137 | protocol=17 | dir=in | app=system |

"{6670E4C1-80A8-45AD-8E57-44FA489552EE}" = lport=8379 | protocol=6 | dir=in | name=league of legends launcher |

"{67FF498E-434A-4238-BFA2-75F800021801}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |

"{6B9BA43B-21D7-45A9-82A7-C1CA3BAA6D47}" = lport=8381 | protocol=6 | dir=in | name=league of legends launcher |

"{6D2C0653-65C3-4CB3-8FAF-48A7019217F6}" = lport=40080 | protocol=6 | dir=in | name=remote access media server |

"{74C14F16-C5C7-4B5C-A1D7-21FBAC14CD2F}" = lport=8380 | protocol=17 | dir=in | name=league of legends launcher |

"{7711851A-107E-4208-AEA6-B4C1FDC7AA4B}" = lport=8374 | protocol=17 | dir=in | name=league of legends launcher |

"{7A921711-5274-48AB-BC62-A99F4F4F391C}" = lport=8377 | protocol=6 | dir=in | name=league of legends launcher |

"{83345128-FAFE-45DD-A235-54AC8FA13D4F}" = lport=40091 | protocol=6 | dir=in | name=streaming web cam |

"{8433EB48-E590-479D-995E-91EED83F999E}" = lport=8371 | protocol=17 | dir=in | name=league of legends launcher |

"{88A8C80B-38CD-4D40-B333-CF1316218820}" = lport=8376 | protocol=17 | dir=in | name=league of legends launcher |

"{8DD8AC52-748C-41AC-8DEA-30753546206C}" = lport=8370 | protocol=6 | dir=in | name=league of legends launcher |

"{90399FAE-6CDE-4B94-80EC-559307F77E46}" = lport=8379 | protocol=17 | dir=in | name=league of legends launcher |

"{98C68311-D2AE-435B-A5FC-E593A676A210}" = rport=138 | protocol=17 | dir=out | app=system |

"{994DED2B-093C-4A9B-8664-72BA8E2AF9CF}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |

"{A11E83D9-0CFD-4586-9D80-3D45F90AF39F}" = rport=137 | protocol=17 | dir=out | app=system |

"{A27357A9-EC90-49D5-B48D-8DA1BEFAF87A}" = lport=8372 | protocol=17 | dir=in | name=league of legends launcher |

"{A2F5B5F0-F053-49EB-A44D-3617F68CAD84}" = lport=8374 | protocol=6 | dir=in | name=league of legends launcher |

"{A3BFCDFE-AB4F-4D96-AD86-1709BB0BBA92}" = lport=8379 | protocol=17 | dir=in | name=league of legends launcher |

"{AC83B66A-8826-4263-BA95-52975809E845}" = lport=40093 | protocol=6 | dir=in | name=streaming web cam |

"{B3928F15-3837-419D-A253-DCFD6E004294}" = lport=40090 | protocol=6 | dir=in | name=streaming web cam |

"{B75838AF-A4C7-43D9-8DAB-8058085959EB}" = lport=8372 | protocol=6 | dir=in | name=league of legends launcher |

"{B8CB5262-D9B1-4477-856B-A7600D151C98}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |

"{C571AADF-259E-44B1-8BBA-0C72ECE6142A}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |

"{C5F4DA68-4094-4997-A951-EFE01D712FDA}" = lport=8381 | protocol=17 | dir=in | name=league of legends launcher |

"{DBB06764-4182-4690-B76F-220931FECC5E}" = lport=8371 | protocol=6 | dir=in | name=league of legends launcher |

"{DD64CC3A-1159-46A6-99A4-30D6228EF2D1}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |

"{E2878657-7137-4642-BA05-3CED325A945E}" = lport=138 | protocol=17 | dir=in | app=system |

"{E9549219-9A4F-49C2-810A-96CF146600C9}" = lport=8375 | protocol=6 | dir=in | name=league of legends launcher |

"{EB170369-C557-444E-9EE7-CB79EB914E3F}" = lport=8376 | protocol=6 | dir=in | name=league of legends launcher |

"{F5D47D21-C919-4AAF-8E11-5C167DE5BC15}" = lport=8378 | protocol=6 | dir=in | name=league of legends launcher |

"{FA893DDC-428F-42B6-A151-20A71A1D735E}" = lport=8373 | protocol=17 | dir=in | name=league of legends launcher |

"{FB3CF927-3C04-49EE-9361-43CDE5285603}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |

"{FB8EDC34-13B5-4F92-8A7A-EA3F249AB4A0}" = lport=8380 | protocol=6 | dir=in | name=league of legends launcher |

"{FE6D38E8-A09F-45BF-95BA-77AE1343A905}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{010760BB-AAF0-4E51-941A-F912889ED9C4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |

"{03BE2D90-15C9-498A-A82C-90100A863B01}" = protocol=6 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |

"{0BE15196-05DD-4BC4-A8CD-B0E1D948A2AF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |

"{0DD76420-3D42-4357-9B5E-AB0C3EDB5DB7}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |

"{0DF630F8-FE90-4512-9EE9-DC79E40F0842}" = protocol=17 | dir=in | app=c:\program files\dell remote access\ezi_ra.exe |

"{1ADEB428-BB7D-410E-9CD1-95C8C1C49827}" = protocol=17 | dir=in | app=c:\programdata\singleclick systems\vlc\vlc.exe |

"{1BD4023F-DFF0-4EC4-8EE1-633BDB197D9B}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |

"{2021F08D-9249-40E4-AB92-1B777F97EFDF}" = protocol=17 | dir=in | app=c:\program files\dell video chat\dellvideochat.exe |

"{2215A69C-9FC1-4EDA-B9C0-CA75E8469BD9}" = protocol=17 | dir=in | app=c:\riot games\league of legends\air\lolclient.exe |

"{26282311-2421-48E3-80FD-2F47BEEC6783}" = protocol=17 | dir=in | app=c:\programdata\singleclick systems\mysql\bin\mysqld.exe |

"{2902F8E5-9A40-416A-8489-FA0FD2C9F88C}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |

"{2D1FB7DB-4D20-494F-93E5-5DD6638B37C6}" = protocol=17 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |

"{31478294-3143-477E-86FE-54FDAFC3E186}" = protocol=6 | dir=in | app=c:\programdata\singleclick systems\apache\bin\httpd.exe |

"{408DDCC1-E3A7-4721-8363-312EAC56D6FE}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\sid meier's civilization v\civilizationv.exe |

"{472DC336-F13A-48F9-97B6-F792C13AAB1B}" = protocol=17 | dir=in | app=c:\programdata\singleclick systems\advanced networking service\hnm_svc.exe |

"{4B066477-0174-4248-841F-4FDDE35047E0}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\recettear\recettear.exe |

"{4BACDCAB-BB05-4D42-91E7-D677D969D478}" = protocol=17 | dir=in | app=c:\riot games\league of legends\air\lolclient.exe |

"{5116F280-0983-4CF2-B61F-25261A6B4087}" = protocol=17 | dir=in | app=c:\programdata\singleclick systems\mysql\bin\mysql.exe |

"{5A080C91-B094-437E-82FB-4B4CC89B5EB7}" = protocol=6 | dir=in | app=c:\program files\aim\aim.exe |

"{5B8C1CD2-BFFF-4677-83D8-45BC02B7335D}" = protocol=6 | dir=in | app=c:\program files\aim6\aim6.exe |

"{5FD95502-7BE3-4EAA-834E-EC7E7B39918F}" = protocol=17 | dir=in | app=c:\programdata\singleclick systems\apache\bin\httpd.exe |

"{60C2282D-94EB-4AA8-A3F5-004F4503FFB0}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\recettear\recettear.exe |

"{64B9DD96-45EB-4FB0-AA9E-C553333AF428}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\recettear\custom.exe |

"{66A1D6F8-9BD1-46E3-9380-03C7DEAE7E6D}" = dir=in | app=c:\program files\skype\phone\skype.exe |

"{67EAA138-A5DD-4F9F-B005-50B80510CDA6}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe |

"{6B3E04FF-C307-488A-BA64-24BB2BD1CACF}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |

"{6D7D9E94-3553-437D-9042-7EBA335BB9ED}" = protocol=17 | dir=in | app=c:\riot games\league of legends\game\league of legends.exe |

"{70334035-3A8C-4373-B557-6EA1662C92DB}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |

"{70711CD6-FA0B-4272-8D72-811363171174}" = protocol=6 | dir=in | app=c:\programdata\singleclick systems\mysql\bin\mysqld.exe |

"{70D6B6AA-1025-452F-A2A3-4A85C518CDD5}" = protocol=6 | dir=in | app=c:\riot games\league of legends\air\lolclient.exe |

"{85464979-1358-4A2E-9D1C-E11BB98F32F8}" = protocol=17 | dir=in | app=c:\program files\dell video chat\dellvideochat.exe |

"{8997E436-98F9-4F2E-8706-D9A48813E0AE}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\sid meier's civilization v\launcher.exe |

"{8EFAF45C-F035-489C-B45C-F93FB220B676}" = dir=in | app=c:\program files\dell\mediadirect\kernel\dms\clmsservice.exe |

"{8FD9A775-3D38-42E3-9654-EB049C981453}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\recettear\recettear.exe |

"{904D850C-B677-45BD-81A9-6ACEF5477284}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\recettear\custom.exe |

"{9076EF15-1165-4EDF-9966-5EB650846774}" = protocol=17 | dir=in | app=c:\program files\pplive\pplive.exe |

"{928E4FBA-D55B-4FB7-907D-6EEA05C1D0AC}" = protocol=17 | dir=in | app=c:\riot games\league of legends\game\league of legends.exe |

"{96AAFBE3-A726-4A88-82B4-C00CD6A7B401}" = protocol=6 | dir=in | app=c:\program files\dell remote access\ezi_ra.exe |

"{9FCE3338-78AE-46C7-9D7D-ACA7771CF3F7}" = protocol=6 | dir=in | app=c:\programdata\singleclick systems\advanced networking service\hnm_svc.exe |

"{A04642FA-5152-4AF5-A07F-C5AD7F5A7B49}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\recettear\recettear.exe |

"{A0AB331D-95C0-437D-91C6-B63DA197F472}" = protocol=17 | dir=in | app=c:\program files\aim\aim.exe |

"{A6EB970D-EC65-45D8-8D57-EF529DDB2B8C}" = protocol=6 | dir=in | app=c:\riot games\league of legends\game\league of legends.exe |

"{A907D920-EA49-434C-BEC6-A84A2A4E7FA3}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\sid meier's civilization v\civilizationv.exe |

"{AA1DCBDF-13C8-4589-8165-0ECF27F83684}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |

"{ABD32CAB-575C-48CA-ABEA-840FAD2544B8}" = protocol=6 | dir=in | app=c:\programdata\singleclick systems\vlc\vlc.exe |

"{AC49452B-5602-4DA5-A35F-DE5A76DE00F0}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\recettear\custom.exe |

"{B27B9320-7DAC-4A68-A0AF-47006E98EA0D}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe |

"{B2DFE86A-F85E-4C13-B691-B2EC23425218}" = protocol=6 | dir=in | app=c:\programdata\singleclick systems\apache\php.exe |

"{B52F6908-BAE7-4FF3-8831-7280E6CA109F}" = protocol=6 | dir=in | app=c:\riot games\league of legends\game\league of legends.exe |

"{B6274050-6764-452E-B222-510F4C7B5C06}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\sid meier's civilization v\launcher.exe |

"{BBBF507A-F504-40F7-AD6B-05DE799D8606}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |

"{BCDE7343-17FC-4F17-A16C-ECEA626ADCA2}" = protocol=6 | dir=in | app=c:\riot games\league of legends\air\lolclient.exe |

"{C02DD0C5-B34D-4402-9348-BD50C57F4092}" = dir=in | app=c:\program files\dell\mediadirect\kernel\dmp\clbrowserengine.exe |

"{C0FF291C-6C0E-40BB-A6E3-5A6B3FA0F708}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |

"{C283A118-6630-4C6E-8CCF-871A907CFE1A}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |

"{C884EB3A-24B0-4DC5-9072-4386096A6F11}" = protocol=17 | dir=in | app=c:\program files\aim6\aim6.exe |

"{C98071D2-B7FE-45C3-A1C2-F7043479D673}" = protocol=17 | dir=in | app=c:\programdata\singleclick systems\apache\php.exe |

"{CC765253-39B8-4350-930C-92EB1803F0A9}" = protocol=6 | dir=in | app=c:\program files\pplive\pplive.exe |

"{CEF7F246-B0FD-4168-A04E-CEF004E86536}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\recettear\custom.exe |

"{D68CF06C-694F-42FD-8C68-CBFE0C5A978A}" = dir=in | app=c:\program files\skype\phone\skype.exe |

"{D86302BB-6862-4EA2-B12F-463284EC2DE4}" = dir=in | app=c:\program files\dell\mediadirect\pcmservice.exe |

"{DFF65903-9AB5-4226-BDEE-4CB7AA725E9D}" = protocol=6 | dir=in | app=c:\programdata\singleclick systems\mysql\bin\mysql.exe |

"{E708ABE4-BAD7-4A10-95AB-7EA7A00B0752}" = protocol=6 | dir=in | app=c:\program files\dell video chat\dellvideochat.exe |

"{E840F755-AD76-4896-B25B-DB1F4CF1EFD8}" = protocol=6 | dir=in | app=c:\programdata\singleclick systems\remote access file sync service\dsl_fs_sync.exe |

"{E9D5A486-CB9F-41B4-B406-03CCA3EE6051}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |

"{F1BA6132-47E9-4BA4-8EB3-3C2A833F74F3}" = protocol=17 | dir=in | app=c:\programdata\singleclick systems\remote access file sync service\dsl_fs_sync.exe |

"{F346C5E6-E7AD-47D9-A9E3-45B9C7FEE2A3}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |

"{F4DA4329-9254-405D-A3A8-359A2C631245}" = dir=in | app=c:\program files\dell\mediadirect\mediadirect.exe |

"{FBFE3C26-B015-4F16-890C-9290D0B45F29}" = protocol=6 | dir=in | app=c:\program files\dell video chat\dellvideochat.exe |

"TCP Query User{0AF6EA89-074E-4D39-A7D1-0ADD996AD46A}C:\program files\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |

"TCP Query User{12BA2527-B50E-4033-A735-150B7833942E}C:\program files\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |

"TCP Query User{1548856F-E274-42FE-BB9A-42B8113DF405}C:\program files\pfportchecker\pfportchecker.exe" = protocol=6 | dir=in | app=c:\program files\pfportchecker\pfportchecker.exe |

"TCP Query User{18B3DB23-10E3-40F3-83AB-78D45FAEDF78}C:\program files\aim6\aim6.exe" = protocol=6 | dir=in | app=c:\program files\aim6\aim6.exe |

"TCP Query User{445EBC3F-BAF3-436C-8EBC-9D60EB5DC2AC}C:\program files\streamtorrent 1.0\streamtorrent.exe" = protocol=6 | dir=in | app=c:\program files\streamtorrent 1.0\streamtorrent.exe |

"TCP Query User{5EDA798D-9294-4E7E-B7DA-6EC34E147D41}C:\program files\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |

"TCP Query User{9F98540F-2EB1-40B4-9037-1D8F8B1E1666}C:\program files\oovoo\oovoo.exe" = protocol=6 | dir=in | app=c:\program files\oovoo\oovoo.exe |

"TCP Query User{B62B4769-4CED-4808-8768-51038040725F}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |

"TCP Query User{CD78ED16-F054-4E94-A974-6A2F016F128C}C:\windows\rundll22.exe" = protocol=6 | dir=in | app=c:\windows\rundll22.exe |

"TCP Query User{D44C1558-414F-4E95-94BC-F4ACEF276376}C:\program files\aim\aim.exe" = protocol=6 | dir=in | app=c:\program files\aim\aim.exe |

"TCP Query User{E700DFF9-9A35-456D-B8C7-21D716F86FF5}C:\windows\rundll22.exe" = protocol=6 | dir=in | app=c:\windows\rundll22.exe |

"UDP Query User{0074A60D-1872-4DAF-8DD1-20F711D835A6}C:\program files\oovoo\oovoo.exe" = protocol=17 | dir=in | app=c:\program files\oovoo\oovoo.exe |

"UDP Query User{0B407C5A-77D3-4D0E-92A6-2AEAE8536FD5}C:\program files\aim\aim.exe" = protocol=17 | dir=in | app=c:\program files\aim\aim.exe |

"UDP Query User{550B0AE2-25EA-4E8F-8B77-9EF93B3A9D6C}C:\windows\rundll22.exe" = protocol=17 | dir=in | app=c:\windows\rundll22.exe |

"UDP Query User{8E07909C-99A5-4660-8171-FFC7C80EA3D2}C:\program files\streamtorrent 1.0\streamtorrent.exe" = protocol=17 | dir=in | app=c:\program files\streamtorrent 1.0\streamtorrent.exe |

"UDP Query User{ACD15955-248C-4444-BF3E-D6C2A612FCF4}C:\program files\itunes\itunes.exe" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |

"UDP Query User{B17106A5-AD64-4D50-818E-4AEE2B0BB520}C:\program files\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |

"UDP Query User{B8994187-B028-4244-A5C2-CD2700D04E5F}C:\program files\itunes\itunes.exe" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |

"UDP Query User{C6345C61-A363-400E-B4B5-D888600864B3}C:\windows\rundll22.exe" = protocol=17 | dir=in | app=c:\windows\rundll22.exe |

"UDP Query User{D705C16A-9076-42A6-A5C7-E4C2012FA2C4}C:\program files\aim6\aim6.exe" = protocol=17 | dir=in | app=c:\program files\aim6\aim6.exe |

"UDP Query User{EDEE21DB-1C51-4204-9882-2DF0B4EBAEB3}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |

"UDP Query User{EE65166D-3E9C-4AC5-9220-2B052EF14DA2}C:\program files\pfportchecker\pfportchecker.exe" = protocol=17 | dir=in | app=c:\program files\pfportchecker\pfportchecker.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{0046FA01-C5B9-4985-BACB-398DC480FC05}" = Adobe Photoshop CS3

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3

"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center

"{0709B06B-82BC-6073-0E43-DE107DF1389C}" = Catalyst Control Center Localization Spanish

"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting

"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data

"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE

"{0B1AAC97-8563-41D9-AE47-58E6A222F0E1}" = Search Settings 1.2.2

"{10B39DCD-0325-49FE-BFBC-8EC011CB7CA8}" = ACID Pro 7.0

"{11D03BF4-A66F-325E-7762-4F64586C673F}" = Catalyst Control Center Graphics Full New

"{13766F76-6C8C-4E57-A9F3-3212D1C6E0D1}" = Dell DataSafe Online

"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works

"{15EB6A85-A28D-2ED8-C344-DEBC592F2E12}" = Catalyst Control Center Localization German

"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer

"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin

"{1D46A3A0-B37D-423A-91C2-101A49E2FF80}" = Ventrilo Server

"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools

"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer

"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java 6 Update 20

"{28C3CD30-2DF4-FEFA-3F4E-D6C1C3257FCE}" = ccc-core-static

"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3

"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour

"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager

"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support

"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java 6 Update 7

"{328A9510-1BFF-4359-98CC-B47B329D57A7}" = M3 SAKURA V1.49 Global (GAME PATCH V4.8f)

"{32C2CBBB-4540-E526-206D-B7BC7932D82F}" = CCC Help Danish

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{425819E1-D68E-8CE1-85D5-CDBA64E82DDE}" = CCC Help Japanese

"{4392E2AF-1643-29DA-E873-C94D547467D7}" = Catalyst Control Center Localization Swedish

"{44FDDB51-0E97-DD4A-9FB2-8D394DBEE47F}" = CCC Help Dutch

"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR

"{48C86A94-A6C0-D2D0-1649-ECB00D2DF4DE}" = Catalyst Control Center Localization Norwegian

"{48CC1AD8-2013-82B3-284F-E0253195664F}" = Catalyst Control Center Localization French

"{496C34BF-9DE5-9628-48CC-052DD6A8453E}" = Catalyst Control Center Core Implementation

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4A4D109A-D9C4-E460-4F9A-0252F581D600}" = CCC Help Swedish

"{4CA09BF7-1CFC-44B8-80EA-7B4D15D12DC5}" = Catalyst Control Center - Branding

"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings

"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3

"{57847CB0-95DA-D785-B170-1F00FC79B860}" = Catalyst Control Center Localization Chinese Traditional

"{5A72A2C4-9D4A-0718-DA28-95B73C2270DA}" = Catalyst Control Center Localization Danish

"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector

"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator

"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3

"{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}" = Cisco PEAP Module

"{682FED0E-738E-0048-F448-B3EE427978CC}" = Catalyst Control Center Localization Japanese

"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All

"{6B00208E-2844-7480-5F50-6515A5907F0B}" = CCC Help Norwegian

"{6B7B6D4D-8F9B-4CB3-8CA4-BCA9CC4C1A22}" = EDocs

"{6D3963B0-E13B-4FC3-B0FF-506A304BB043}" = Cisco EAP-FAST Module

"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio

"{76E12A66-1AEC-3816-E75A-330998F2D40C}" = CCC Help Korean

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com

"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client

"{79FBDD2E-DD2B-141A-DCF0-B8C125B5A008}" = Catalyst Control Center Graphics Previews Vista

"{7C63DFEB-6176-C3F1-AA83-F997E32B44EA}" = Catalyst Control Center Localization Portuguese

"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide

"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3

"{83770D14-21B9-44B3-8689-F7B523F94560}" = Cisco LEAP Module

"{84557D91-D8C7-D7A4-1393-3AB3A16106C7}" = CCC Help Chinese Traditional

"{8627CFC0-D8DE-43AF-B538-6AD015EAE67F}" = Electronic Listening Guides Full Screen

"{868EC22E-7E82-4760-9265-3F2E705BF24B}" = League of Legends

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3

"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support

"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules

"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system

"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3

"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage

"{910F4A29-1134-49E0-AD8B-56E4A3152BD1}" = The Sims

Link to post
Share on other sites

Ok.

  • Download TDSSKiller and save it to your Desktop.
  • Extract its contents to your desktop.
  • Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  • If an infected file is detected, the default action will be Cure, click on Continue.
  • If a suspicious file is detected, the default action will be Skip, click on Continue.
  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  • If no reboot is required, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  • If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Link to post
Share on other sites

Nothing was detected. Also, Malwarebytes Ant-Malware is able to run on start up but I still am unable to run a scan or update it.

2010/12/25 17:20:34.0972 TDSS rootkit removing tool 2.4.12.0 Dec 16 2010 09:46:46

2010/12/25 17:20:34.0972 ================================================================================

2010/12/25 17:20:34.0972 SystemInfo:

2010/12/25 17:20:34.0973

2010/12/25 17:20:34.0973 OS Version: 6.0.6002 ServicePack: 2.0

2010/12/25 17:20:34.0973 Product type: Workstation

2010/12/25 17:20:34.0973 ComputerName: NEAL-PC

2010/12/25 17:20:34.0973 UserName: Neal

2010/12/25 17:20:34.0973 Windows directory: C:\Windows

2010/12/25 17:20:34.0973 System windows directory: C:\Windows

2010/12/25 17:20:34.0973 Processor architecture: Intel x86

2010/12/25 17:20:34.0973 Number of processors: 2

2010/12/25 17:20:34.0973 Page size: 0x1000

2010/12/25 17:20:34.0973 Boot type: Normal boot

2010/12/25 17:20:34.0973 ================================================================================

2010/12/25 17:20:35.0412 Initialize success

2010/12/25 17:20:39.0186 ================================================================================

2010/12/25 17:20:39.0186 Scan started

2010/12/25 17:20:39.0186 Mode: Manual;

2010/12/25 17:20:39.0186 ================================================================================

2010/12/25 17:20:42.0194 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys

2010/12/25 17:20:42.0486 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys

2010/12/25 17:20:42.0693 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys

2010/12/25 17:20:42.0905 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys

2010/12/25 17:20:43.0075 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys

2010/12/25 17:20:43.0213 AFD (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys

2010/12/25 17:20:43.0331 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys

2010/12/25 17:20:43.0399 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

2010/12/25 17:20:43.0431 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys

2010/12/25 17:20:43.0510 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys

2010/12/25 17:20:43.0557 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys

2010/12/25 17:20:43.0798 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys

2010/12/25 17:20:43.0879 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys

2010/12/25 17:20:43.0965 ApfiltrService (b83f9da84f7079451c1c6a4a2f140920) C:\Windows\system32\DRIVERS\Apfiltr.sys

2010/12/25 17:20:44.0130 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys

2010/12/25 17:20:44.0196 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys

2010/12/25 17:20:44.0335 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys

2010/12/25 17:20:44.0406 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys

2010/12/25 17:20:44.0726 atikmdag (47dcf5d78c395159d72c65c25129fc44) C:\Windows\system32\DRIVERS\atikmdag.sys

2010/12/25 17:20:44.0928 BCM42RLY (55070d71bbb424a56d5125c61fcc2897) C:\Windows\system32\drivers\BCM42RLY.sys

2010/12/25 17:20:45.0028 BCM43XX (fa6707a346cd122407f3b0bad1c47639) C:\Windows\system32\DRIVERS\bcmwl6.sys

2010/12/25 17:20:45.0180 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys

2010/12/25 17:20:45.0240 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys

2010/12/25 17:20:45.0374 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys

2010/12/25 17:20:45.0435 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

2010/12/25 17:20:45.0469 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

2010/12/25 17:20:45.0587 Bridge (b1564976d98e91fc764d5dc28a0297da) C:\Windows\system32\DRIVERS\bridge.sys

2010/12/25 17:20:45.0617 BridgeMP (b1564976d98e91fc764d5dc28a0297da) C:\Windows\system32\DRIVERS\bridge.sys

2010/12/25 17:20:45.0676 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys

2010/12/25 17:20:45.0806 BrSerIf (56f59a4011f503149ae4de826982ca4f) C:\Windows\system32\Drivers\BrSerIf.sys

2010/12/25 17:20:45.0845 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

2010/12/25 17:20:45.0871 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

2010/12/25 17:20:45.0926 BrUsbSer (a24c7b39602218f8dbdb2b6704325fc7) C:\Windows\system32\Drivers\BrUsbSer.sys

2010/12/25 17:20:46.0033 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys

2010/12/25 17:20:46.0066 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys

2010/12/25 17:20:46.0129 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys

2010/12/25 17:20:46.0186 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys

2010/12/25 17:20:46.0293 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys

2010/12/25 17:20:46.0429 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys

2010/12/25 17:20:46.0480 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys

2010/12/25 17:20:46.0506 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys

2010/12/25 17:20:46.0578 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys

2010/12/25 17:20:46.0616 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys

2010/12/25 17:20:46.0714 DfsC (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys

2010/12/25 17:20:46.0851 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys

2010/12/25 17:20:46.0963 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys

2010/12/25 17:20:47.0096 DXGKrnl (5c7e2097b91d689ded7a6ff90f0f3a25) C:\Windows\System32\drivers\dxgkrnl.sys

2010/12/25 17:20:47.0261 e1express (908ed85b7806e8af3af5e9b74f7809d4) C:\Windows\system32\DRIVERS\e1e6032.sys

2010/12/25 17:20:47.0320 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys

2010/12/25 17:20:47.0479 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys

2010/12/25 17:20:47.0558 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys

2010/12/25 17:20:47.0660 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys

2010/12/25 17:20:47.0751 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys

2010/12/25 17:20:47.0853 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys

2010/12/25 17:20:47.0884 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys

2010/12/25 17:20:47.0923 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys

2010/12/25 17:20:47.0954 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys

2010/12/25 17:20:48.0090 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys

2010/12/25 17:20:48.0156 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys

2010/12/25 17:20:48.0296 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys

2010/12/25 17:20:48.0325 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys

2010/12/25 17:20:48.0382 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys

2010/12/25 17:20:48.0534 HdAudAddService (3f90e001369a07243763bd5a523d8722) C:\Windows\system32\drivers\HdAudio.sys

2010/12/25 17:20:48.0599 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys

2010/12/25 17:20:48.0700 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

2010/12/25 17:20:48.0727 HidIr (d8df3722d5e961baa1292aa2f12827e2) C:\Windows\system32\DRIVERS\hidir.sys

2010/12/25 17:20:48.0792 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys

2010/12/25 17:20:48.0910 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys

2010/12/25 17:20:48.0975 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys

2010/12/25 17:20:49.0064 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys

2010/12/25 17:20:49.0124 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys

2010/12/25 17:20:49.0153 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys

2010/12/25 17:20:49.0244 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

2010/12/25 17:20:49.0320 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys

2010/12/25 17:20:49.0411 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys

2010/12/25 17:20:49.0442 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys

2010/12/25 17:20:49.0491 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys

2010/12/25 17:20:49.0516 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys

2010/12/25 17:20:49.0641 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys

2010/12/25 17:20:49.0670 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys

2010/12/25 17:20:49.0727 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys

2010/12/25 17:20:49.0754 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

2010/12/25 17:20:49.0844 itecir (8bcd857c7932ad005d5f9c89329da2e1) C:\Windows\system32\DRIVERS\itecir.sys

2010/12/25 17:20:49.0885 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

2010/12/25 17:20:49.0933 k57nd60x (2fbf424e4e8d5f320d2f69d9a726de30) C:\Windows\system32\DRIVERS\k57nd60x.sys

2010/12/25 17:20:50.0015 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys

2010/12/25 17:20:50.0084 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys

2010/12/25 17:20:50.0157 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys

2010/12/25 17:20:50.0360 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys

2010/12/25 17:20:50.0404 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys

2010/12/25 17:20:50.0432 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys

2010/12/25 17:20:50.0505 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys

2010/12/25 17:20:50.0593 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys

2010/12/25 17:20:50.0683 MBAMProtector (836e0e09ca9869be7eb39ef2cf3602c7) C:\Windows\system32\drivers\mbam.sys

2010/12/25 17:20:50.0787 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys

2010/12/25 17:20:50.0890 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys

2010/12/25 17:20:50.0985 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys

2010/12/25 17:20:51.0039 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys

2010/12/25 17:20:51.0091 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys

2010/12/25 17:20:51.0198 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys

2010/12/25 17:20:51.0232 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys

2010/12/25 17:20:51.0316 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys

2010/12/25 17:20:51.0399 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys

2010/12/25 17:20:51.0499 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

2010/12/25 17:20:51.0568 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys

2010/12/25 17:20:51.0627 mrxsmb (454341e652bdf5e01b0f2140232b073e) C:\Windows\system32\DRIVERS\mrxsmb.sys

2010/12/25 17:20:51.0720 mrxsmb10 (2a4901aff069944fa945ed5bbf4dcde3) C:\Windows\system32\DRIVERS\mrxsmb10.sys

2010/12/25 17:20:51.0767 mrxsmb20 (28b3f1ab44bdd4432c041581412f17d9) C:\Windows\system32\DRIVERS\mrxsmb20.sys

2010/12/25 17:20:51.0839 msahci (5457dcfa7c0da43522f4d9d4049c1472) C:\Windows\system32\drivers\msahci.sys

2010/12/25 17:20:51.0936 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys

2010/12/25 17:20:52.0063 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys

2010/12/25 17:20:52.0114 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys

2010/12/25 17:20:52.0339 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys

2010/12/25 17:20:52.0597 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys

2010/12/25 17:20:52.0657 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys

2010/12/25 17:20:52.0719 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys

2010/12/25 17:20:52.0797 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys

2010/12/25 17:20:52.0843 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys

2010/12/25 17:20:52.0898 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys

2010/12/25 17:20:52.0982 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys

2010/12/25 17:20:53.0168 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys

2010/12/25 17:20:53.0232 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys

2010/12/25 17:20:53.0292 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys

2010/12/25 17:20:53.0359 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys

2010/12/25 17:20:53.0389 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys

2010/12/25 17:20:53.0463 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys

2010/12/25 17:20:53.0538 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys

2010/12/25 17:20:53.0585 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

2010/12/25 17:20:53.0670 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys

2010/12/25 17:20:53.0725 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys

2010/12/25 17:20:53.0805 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys

2010/12/25 17:20:53.0906 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

2010/12/25 17:20:53.0934 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys

2010/12/25 17:20:53.0961 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys

2010/12/25 17:20:53.0990 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys

2010/12/25 17:20:54.0069 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys

2010/12/25 17:20:54.0187 OA001Ufd (a015dd2ba6009c8bdd00a6c431302d06) C:\Windows\system32\DRIVERS\OA001Ufd.sys

2010/12/25 17:20:54.0293 OA001Vid (438ffcb55b8ce39b0bc71afc0a059835) C:\Windows\system32\DRIVERS\OA001Vid.sys

2010/12/25 17:20:54.0420 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys

2010/12/25 17:20:54.0509 Packet (9d80e0be979c3edaf2863f23b88f4de6) C:\Windows\system32\DRIVERS\packet.sys

2010/12/25 17:20:54.0549 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys

2010/12/25 17:20:54.0652 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys

2010/12/25 17:20:54.0686 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys

2010/12/25 17:20:54.0743 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys

2010/12/25 17:20:54.0827 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys

2010/12/25 17:20:54.0860 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys

2010/12/25 17:20:54.0902 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

2010/12/25 17:20:55.0077 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys

2010/12/25 17:20:55.0105 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys

2010/12/25 17:20:55.0173 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys

2010/12/25 17:20:55.0320 PxHelp20 (03e0fe281823ba64b3782f5b38950e73) C:\Windows\system32\Drivers\PxHelp20.sys

2010/12/25 17:20:55.0403 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys

2010/12/25 17:20:55.0507 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

2010/12/25 17:20:55.0543 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys

2010/12/25 17:20:55.0663 R300 (47dcf5d78c395159d72c65c25129fc44) C:\Windows\system32\DRIVERS\atikmdag.sys

2010/12/25 17:20:55.0775 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys

2010/12/25 17:20:55.0806 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys

2010/12/25 17:20:55.0874 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys

2010/12/25 17:20:55.0977 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys

2010/12/25 17:20:56.0034 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys

2010/12/25 17:20:56.0073 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys

2010/12/25 17:20:56.0162 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys

2010/12/25 17:20:56.0197 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys

2010/12/25 17:20:56.0309 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys

2010/12/25 17:20:56.0388 rimmptsk (c2ef513bbe069f0d4ee0938a76f975d3) C:\Windows\system32\DRIVERS\rimmptsk.sys

2010/12/25 17:20:56.0406 rimsptsk (c398bca91216755b098679a8da8a2300) C:\Windows\system32\DRIVERS\rimsptsk.sys

2010/12/25 17:20:56.0501 rismxdp (2a2554cb24506e0a0508fc395c4a1b42) C:\Windows\system32\DRIVERS\rixdptsk.sys

2010/12/25 17:20:56.0592 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys

2010/12/25 17:20:56.0624 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

2010/12/25 17:20:56.0727 SCDEmu (23aa53256ce05b975398b78a33474265) C:\Windows\system32\drivers\SCDEmu.sys

2010/12/25 17:20:56.0794 sdbus (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys

2010/12/25 17:20:56.0834 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

2010/12/25 17:20:56.0935 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys

2010/12/25 17:20:56.0968 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys

2010/12/25 17:20:57.0003 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys

2010/12/25 17:20:57.0042 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys

2010/12/25 17:20:57.0205 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys

2010/12/25 17:20:57.0359 sffp_sd (9f66a46c55d6f1ccabc79bb7afccc545) C:\Windows\system32\DRIVERS\sffp_sd.sys

2010/12/25 17:20:57.0439 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys

2010/12/25 17:20:57.0509 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys

2010/12/25 17:20:57.0557 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys

2010/12/25 17:20:57.0672 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys

2010/12/25 17:20:57.0757 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys

2010/12/25 17:20:57.0801 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys

2010/12/25 17:20:57.0901 srv (ff3cbc13db84d81f56931bc922cc37c4) C:\Windows\system32\DRIVERS\srv.sys

2010/12/25 17:20:58.0004 srv2 (d15959d9f69f0d39a0153e9c244f20dd) C:\Windows\system32\DRIVERS\srv2.sys

2010/12/25 17:20:58.0025 srvnet (faa0d553a49e85008c6bb3781987c574) C:\Windows\system32\DRIVERS\srvnet.sys

2010/12/25 17:20:58.0126 STHDA (d4ae2486c4290054b8d6f1adc4bad7fd) C:\Windows\system32\DRIVERS\stwrt.sys

2010/12/25 17:20:58.0251 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys

2010/12/25 17:20:58.0283 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

2010/12/25 17:20:58.0316 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

2010/12/25 17:20:58.0341 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

2010/12/25 17:20:58.0479 Tcpip (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\drivers\tcpip.sys

2010/12/25 17:20:58.0623 Tcpip6 (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\DRIVERS\tcpip.sys

2010/12/25 17:20:58.0725 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys

2010/12/25 17:20:58.0758 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys

2010/12/25 17:20:58.0787 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys

2010/12/25 17:20:58.0842 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys

2010/12/25 17:20:58.0942 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys

2010/12/25 17:20:59.0016 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys

2010/12/25 17:20:59.0138 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys

2010/12/25 17:20:59.0203 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys

2010/12/25 17:20:59.0238 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys

2010/12/25 17:20:59.0350 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys

2010/12/25 17:20:59.0413 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys

2010/12/25 17:20:59.0449 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys

2010/12/25 17:20:59.0537 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

2010/12/25 17:20:59.0567 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

2010/12/25 17:20:59.0597 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys

2010/12/25 17:20:59.0655 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\Windows\system32\Drivers\usbaapl.sys

2010/12/25 17:20:59.0766 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys

2010/12/25 17:20:59.0808 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

2010/12/25 17:20:59.0868 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys

2010/12/25 17:20:59.0975 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys

2010/12/25 17:21:00.0017 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys

2010/12/25 17:21:00.0079 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys

2010/12/25 17:21:00.0186 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS

2010/12/25 17:21:00.0226 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys

2010/12/25 17:21:00.0266 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys

2010/12/25 17:21:00.0285 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys

2010/12/25 17:21:00.0317 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys

2010/12/25 17:21:00.0401 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys

2010/12/25 17:21:00.0426 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys

2010/12/25 17:21:00.0489 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys

2010/12/25 17:21:00.0607 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys

2010/12/25 17:21:00.0720 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys

2010/12/25 17:21:00.0766 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys

2010/12/25 17:21:00.0808 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

2010/12/25 17:21:00.0888 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

2010/12/25 17:21:00.0901 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

2010/12/25 17:21:00.0948 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys

2010/12/25 17:21:00.0989 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys

2010/12/25 17:21:01.0148 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys

2010/12/25 17:21:01.0242 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys

2010/12/25 17:21:01.0275 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys

2010/12/25 17:21:01.0404 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys

2010/12/25 17:21:01.0475 XBCD (b21bfa8d2de35a551275e279b4baf97b) C:\Windows\system32\drivers\xbcd.sys

2010/12/25 17:21:01.0554 xnacc (9eea6d029fef5f3016d089b1a603837d) C:\Windows\system32\DRIVERS\xnacc.sys

2010/12/25 17:21:01.0646 ================================================================================

2010/12/25 17:21:01.0646 Scan finished

2010/12/25 17:21:01.0646 ================================================================================

Link to post
Share on other sites

Ok.

Please visit this webpage for download links, and instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

Link to post
Share on other sites

Ok I need to see a bit more see if this will run please.

Please download Rootkit Unhooker and save it on your desktop.

http://www.kernelmode.info/ARKs/RkU3.8.388.590.rar

If your unzipping program doesn't unzip RAR files, then you can download and install 7-Zip to accomplish that.

http://www.7-zip.org/

Just right click the RAR file you downloaded to your desktop, and choose the 7-Zip -> "Extract here" option from the context menu.

  • Temporarily disable your antivirus and antimalware real-time protection before performing a scan by following the directions that apply HERE
  • Double-click RkU3.8.388.590.exe to run the program
  • Click the Report tab, then click Scan
  • Check Drivers, and Stealth Code
  • Uncheck the rest, then click OK
  • When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
  • Wait till the scanner has finished then go File > Save Report
  • Save the report somewhere you can find it. Click Close
  • Re-enable your security programs
  • Copy the entire contents of the report and paste it in your next reply.

Note - You may get this warning it is ok, just ignore it."Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

Link to post
Share on other sites

Here are the results:

RkU Version: 3.8.388.590, Type LE (SR2)

==============================================

OS Name: Windows Vista

Version 6.0.6002 (Service Pack 2)

Number of processors #2

==============================================

>Drivers

==============================================

0x91403000 C:\Windows\system32\DRIVERS\atikmdag.sys 5861376 bytes (ATI Technologies Inc., ATI Radeon Kernel Mode Driver)

0x85412000 C:\Windows\system32\ntkrnlpa.exe 3903488 bytes (Microsoft Corporation, NT Kernel & System)

0x85412000 PnpManager 3903488 bytes

0x85412000 RAW 3903488 bytes

0x85412000 WMIxWDM 3903488 bytes

0x982C0000 Win32k 2109440 bytes

0x982C0000 C:\Windows\System32\win32k.sys 2109440 bytes (Microsoft Corporation, Multi-User Win32 Driver)

0x92000000 C:\Windows\system32\DRIVERS\bcmwl6.sys 1220608 bytes (Broadcom Corporation, Broadcom 802.11 Network Adapter wireless driver)

0x8D60A000 C:\Windows\System32\Drivers\Ntfs.sys 1114112 bytes (Microsoft Corporation, NT File System Driver)

0x8D47F000 C:\Windows\system32\drivers\ndis.sys 1093632 bytes (Microsoft Corporation, NDIS 6.0 wrapper driver)

0x92A0A000 C:\Windows\System32\drivers\tcpip.sys 958464 bytes (Microsoft Corporation, TCP/IP Driver)

0x806E0000 C:\Windows\system32\CI.dll 917504 bytes (Microsoft Corporation, Code Integrity Module)

0xA62C2000 C:\Windows\system32\drivers\peauth.sys 909312 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver)

0xA5007000 C:\Windows\system32\drivers\spsys.sys 720896 bytes (Microsoft Corporation, security processor)

0x91C0F000 C:\Windows\System32\drivers\dxgkrnl.sys 659456 bytes (Microsoft Corporation, DirectX Graphics Kernel)

0x91CBC000 C:\Windows\system32\DRIVERS\HDAudBus.sys 577536 bytes (Microsoft Corporation, High Definition Audio Bus Driver)

0x85A0E000 C:\Windows\system32\drivers\Wdf01000.sys 507904 bytes (Microsoft Corporation, WDF Dynamic)

0x8D40E000 C:\Windows\System32\Drivers\ksecdd.sys 462848 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)

0x80616000 C:\Windows\system32\mcupdate_GenuineIntel.dll 458752 bytes (Microsoft Corporation, Intel Microcode Update Library)

0xA50FE000 C:\Windows\system32\drivers\HTTP.sys 446464 bytes (Microsoft Corporation, HTTP Protocol Stack)

0x928DE000 C:\Windows\system32\DRIVERS\stwrt.sys 401408 bytes (IDT, Inc., IDT PC Audio)

0x9199A000 C:\Windows\system32\DRIVERS\itecir.sys 360448 bytes (ITE Tech. Inc. , ITE Consumer IR Driver for eHome)

0x91DA1000 C:\Windows\system32\DRIVERS\rixdptsk.sys 335872 bytes (REDC, RICOH XD SM Driver)

0xA6234000 C:\Windows\System32\DRIVERS\srv.sys 319488 bytes (Microsoft Corporation, Server driver)

0x98510000 C:\Windows\System32\ATMFD.DLL 315392 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)

0x85B40000 C:\Windows\System32\drivers\volmgrx.sys 303104 bytes (Microsoft Corporation, Volume Manager Extension Driver)

0x92B39000 C:\Windows\system32\drivers\afd.sys 294912 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)

0x85A97000 C:\Windows\system32\drivers\acpi.sys 286720 bytes (Microsoft Corporation, ACPI Driver for NT)

0x92C8E000 C:\Windows\system32\DRIVERS\OA001Vid.sys 278528 bytes (Creative Technology Ltd., Video Capture Device Driver)

0x8069F000 C:\Windows\system32\CLFS.SYS 266240 bytes (Microsoft Corporation, Common Log File System Driver)

0x922AF000 C:\Windows\system32\DRIVERS\storport.sys 266240 bytes (Microsoft Corporation, Microsoft Storage Port Driver)

0x9284D000 C:\Windows\system32\drivers\HdAudio.sys 258048 bytes (Microsoft Corporation, High Definition Audio Function Driver)

0x91D54000 C:\Windows\system32\DRIVERS\USBPORT.SYS 253952 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)

0x92C0F000 C:\Windows\system32\DRIVERS\rdbss.sys 245760 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)

0x8D5B5000 C:\Windows\system32\drivers\NETIO.SYS 241664 bytes (Microsoft Corporation, Network I/O Subsystem)

0x92D8C000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 233472 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr)

0x8D71A000 C:\Windows\system32\drivers\volsnap.sys 233472 bytes (Microsoft Corporation, Volume Shadow Copy Driver)

0x9212A000 C:\Windows\system32\DRIVERS\k57nd60x.sys 217088 bytes (Broadcom Corporation, Broadcom NetLink Gigabit Ethernet NDIS6.x Unified Driver.)

0x92807000 C:\Windows\system32\DRIVERS\usbhub.sys 217088 bytes (Microsoft Corporation, Default Hub Driver for USB)

0x857CB000 ACPI_HAL 208896 bytes

0x857CB000 C:\Windows\system32\hal.dll 208896 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)

0x807C0000 C:\Windows\system32\drivers\fltmgr.sys 204800 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)

0x92B81000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver)

0xA63CC000 C:\Windows\system32\DRIVERS\PCGenFAM.sys 200704 bytes (Soluto LTD., Soluto PCGenome Core Driver)

0x92280000 C:\Windows\system32\DRIVERS\msiscsi.sys 192512 bytes (Microsoft Corporation, Microsoft iSCSI Initiator Driver)

0x9220E000 C:\Windows\system32\DRIVERS\Apfiltr.sys 184320 bytes (Alps Electric Co., Ltd., Alps Touch Pad Driver)

0x9288C000 C:\Windows\system32\drivers\portcls.sys 184320 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))

0x8D58A000 C:\Windows\system32\drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider)

0x923A5000 C:\Windows\system32\DRIVERS\ks.sys 172032 bytes (Microsoft Corporation, Kernel CSA Library)

0xA50B7000 C:\Windows\system32\DRIVERS\nwifi.sys 172032 bytes (Microsoft Corporation, NativeWiFi Miniport Driver)

0xA629A000 C:\Windows\System32\Drivers\fastfat.SYS 163840 bytes (Microsoft Corporation, Fast FAT File System Driver)

0xA620C000 C:\Windows\System32\DRIVERS\srv2.sys 163840 bytes (Microsoft Corporation, Smb 2.0 Server driver)

0x8D76A000 C:\Windows\System32\drivers\ecache.sys 159744 bytes (Microsoft Corporation, Special Memory Device Cache)

0x85AEE000 C:\Windows\system32\drivers\pci.sys 159744 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)

0x928B9000 C:\Windows\system32\drivers\drmk.sys 151552 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)

0x92CD2000 C:\Windows\system32\DRIVERS\OA001Ufd.sys 147456 bytes (Creative Technology Ltd., Video Class Upper Filter Driver)

0x92338000 C:\Windows\system32\DRIVERS\ndiswan.sys 143360 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))

0x92DDD000 C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 139264 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASKUTIL.SYS)

0x8D7A2000 C:\Windows\system32\drivers\CLASSPNP.SYS 135168 bytes (Microsoft Corporation, SCSI Class System Dll)

0xA51B6000 C:\Windows\system32\drivers\mrxdav.sys 135168 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)

0x92996000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver)

0xA51D7000 C:\Windows\system32\DRIVERS\mrxsmb.sys 126976 bytes (Microsoft Corporation, Windows NT SMB Minirdr)

0x85BA2000 C:\Windows\system32\drivers\ataport.SYS 122880 bytes (Microsoft Corporation, ATAPI Driver Extension)

0xA516B000 C:\Windows\System32\DRIVERS\srvnet.sys 118784 bytes (Microsoft Corporation, Server Network driver)

0x922FB000 C:\Windows\system32\DRIVERS\bridge.sys 110592 bytes (Microsoft Corporation, MAC Bridge Driver)

0x92AF4000 C:\Windows\System32\drivers\fwpkclnt.sys 110592 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API)

0x92D5B000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver)

0x9217D000 C:\Windows\system32\DRIVERS\sdbus.sys 106496 bytes (Microsoft Corporation, SecureDigital Bus Driver)

0xA5188000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver)

0x92246000 C:\Windows\system32\DRIVERS\cdrom.sys 98304 bytes (Microsoft Corporation, SCSI CD-ROM Driver)

0x92DC5000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 98304 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector)

0x92C55000 C:\Windows\System32\Drivers\dfsc.sys 94208 bytes (Microsoft Corporation, DFS Namespace Client Driver)

0x92316000 C:\Windows\system32\DRIVERS\rasl2tp.sys 94208 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)

0x92C6C000 C:\Windows\system32\DRIVERS\usbccgp.sys 94208 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)

0x92CF6000 C:\Windows\system32\DRIVERS\cdfs.sys 90112 bytes (Microsoft Corporation, CD-ROM File System Driver)

0x92BB3000 C:\Windows\system32\DRIVERS\pacer.sys 90112 bytes (Microsoft Corporation, QoS Packet Scheduler)

0x92B0F000 C:\Windows\system32\DRIVERS\tdx.sys 90112 bytes (Microsoft Corporation, TDI Translation Driver)

0xA51A1000 C:\Windows\System32\drivers\mpsdrv.sys 86016 bytes (Microsoft Corporation, Microsoft Protection Service Driver)

0x9237E000 C:\Windows\system32\DRIVERS\rassstp.sys 86016 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager)

0x9236A000 C:\Windows\system32\DRIVERS\raspptp.sys 81920 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)

0x921A8000 C:\Windows\system32\DRIVERS\rimsptsk.sys 81920 bytes (REDC, RICOH MS Driver)

0x92B25000 C:\Windows\system32\DRIVERS\smb.sys 81920 bytes (Microsoft Corporation, SMB Transport driver)

0x921BC000 C:\Windows\system32\DRIVERS\i8042prt.sys 77824 bytes (Microsoft Corporation, i8042 Port Driver)

0xA50EB000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6)

0x92BD7000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)

0x8D791000 C:\Windows\system32\drivers\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver)

0x9283C000 C:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy)

0x80686000 C:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver)

0x92197000 C:\Windows\system32\DRIVERS\rimmptsk.sys 69632 bytes (REDC, RICOH SD Driver)

0x85BD8000 C:\Windows\system32\drivers\fileinfo.sys 65536 bytes (Microsoft Corporation, FileInfo Filter Driver)

0x9294B000 C:\Windows\system32\DRIVERS\HIDCLASS.SYS 65536 bytes (Microsoft Corporation, Hid Class Library)

0x92D7C000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver)

0x85B8A000 C:\Windows\System32\drivers\mountmgr.sys 65536 bytes (Microsoft Corporation, Mount Point Manager)

0x9215F000 C:\Windows\system32\DRIVERS\ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver)

0x92393000 C:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Terminal Server Driver)

0x92D4C000 C:\Windows\win32k.sys:2 61440 bytes

0x92264000 C:\Windows\system32\DRIVERS\intelppm.sys 61440 bytes (Microsoft Corporation, Processor Device Driver)

0x92D38000 C:\Windows\system32\DRIVERS\monitor.sys 61440 bytes (Microsoft Corporation, Monitor Driver)

0x8D75B000 C:\Windows\System32\Drivers\mup.sys 61440 bytes (Microsoft Corporation, Multiple UNC Provider driver)

0x85B15000 C:\Windows\System32\drivers\partmgr.sys 61440 bytes (Microsoft Corporation, Partition Management Driver)

0x9235B000 C:\Windows\system32\DRIVERS\raspppoe.sys 61440 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)

0x91D92000 C:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)

0x85B31000 C:\Windows\system32\drivers\volmgr.sys 61440 bytes (Microsoft Corporation, Volume Manager Driver)

0x9216F000 C:\Windows\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver)

0x98500000 C:\Windows\System32\cdd.dll 57344 bytes (Microsoft Corporation, Canonical Display Driver)

0x923CF000 C:\Windows\system32\DRIVERS\circlass.sys 57344 bytes (Microsoft Corporation, Consumer IR Class Driver for eHome)

0x92BC9000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver)

0x929D2000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver)

0x85BCA000 C:\Windows\system32\drivers\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)

0x92BEA000 C:\Windows\System32\Drivers\SCDEmu.SYS 57344 bytes (PowerISO Computing, Inc., PowerISO Virtual Drive)

0x92D0C000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver)

0x923E7000 C:\Windows\system32\DRIVERS\umbus.sys 53248 bytes (Microsoft Corporation, User-Mode Bus Enumerator)

0x85A8A000 C:\Windows\system32\drivers\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR)

0xA63AA000 C:\Windows\System32\drivers\tcpipreg.sys 49152 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver)

0x9298A000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)

0x91CB0000 C:\Windows\System32\drivers\watchdog.sys 49152 bytes (Microsoft Corporation, Watchdog Driver)

0x92D19000 C:\Windows\System32\Drivers\dump_dumpata.sys 45056 bytes

0x92940000 C:\Windows\system32\DRIVERS\hidir.sys 45056 bytes (Microsoft Corporation, Infrared Miniport Driver for Input Devices)

0x921CF000 C:\Windows\system32\DRIVERS\kbdclass.sys 45056 bytes (Microsoft Corporation, Keyboard Class Driver)

0x9223B000 C:\Windows\system32\DRIVERS\mouclass.sys 45056 bytes (Microsoft Corporation, Mouse Class Driver)

0x929C7000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver)

0x9232D000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)

0x922F0000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper)

0x8D7EE000 C:\Windows\system32\DRIVERS\tunnel.sys 45056 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)

0x91D49000 C:\Windows\system32\DRIVERS\usbuhci.sys 45056 bytes (Microsoft Corporation, UHCI USB Miniport Driver)

0x85B27000 C:\Windows\system32\DRIVERS\BATTC.SYS 40960 bytes (Microsoft Corporation, Battery Class Driver)

0x92D24000 C:\Windows\System32\Drivers\dump_msahci.sys 40960 bytes

0x92D2E000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver)

0x85BC0000 C:\Windows\system32\drivers\msahci.sys 40960 bytes (Microsoft Corporation, MS AHCI 1.0 Standard Driver)

0x923DD000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver)

0xA50E1000 C:\Windows\system32\DRIVERS\ndisuio.sys 40960 bytes (Microsoft Corporation, NDIS User mode I/O driver)

0x92C4B000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy)

0xA63A0000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)

0x8D7C3000 C:\Windows\system32\drivers\crcdisk.sys 36864 bytes (Microsoft Corporation, Disk Block Verification Filter Driver)

0x92973000 C:\Windows\System32\Drivers\Fs_Rec.SYS 36864 bytes (Microsoft Corporation, File System Recognizer Driver)

0x92C85000 C:\Windows\system32\DRIVERS\hidusb.sys 36864 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)

0x92962000 C:\Windows\system32\DRIVERS\kbdhid.sys 36864 bytes (Microsoft Corporation, HID Keyboard Filter Driver)

0xA6282000 C:\Windows\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)

0x85BE8000 C:\Windows\System32\Drivers\PxHelp20.sys 36864 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)

0x929E0000 C:\Windows\System32\DRIVERS\rasacd.sys 36864 bytes (Microsoft Corporation, RAS Automatic Connection Driver)

0x984E0000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver)

0x8D600000 C:\Windows\system32\DRIVERS\tunmp.sys 36864 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)

0x92273000 C:\Windows\system32\DRIVERS\wmiacpi.sys 36864 bytes (Microsoft Corporation, Windows Management Interface for ACPI)

0x85ADD000 C:\Windows\system32\drivers\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll)

0x85B9A000 C:\Windows\system32\drivers\atapi.sys 32768 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver)

0x80697000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver)

0x9296B000 C:\Windows\system32\DRIVERS\mouhid.sys 32768 bytes (Microsoft Corporation, HID Mouse Filter Driver)

0x85AE6000 C:\Windows\system32\drivers\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver)

0x929B7000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport)

0x929BF000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Miniport)

0x8D753000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor)

0x92983000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver)

0x9295B000 C:\Windows\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)

0x8060F000 C:\Windows\system32\kdcom.dll 28672 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)

0x9297C000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver)

0x9225E000 C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)

0x92D76000 C:\Windows\system32\DRIVERS\packet.sys 24576 bytes (SingleClick Systems, SCS NDIS 5.0 Auto IP Protocol Driver)

0xA6200000 C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 24576 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASDIFSV.SYS)

0x92D47000 C:\Windows\win32k.sys:1 20480 bytes

0x9227C000 C:\Windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver)

0xA63B6000 C:\Windows\system32\drivers\mbam.sys 16384 bytes (Malwarebytes Corporation, Malwarebytes' Anti-Malware)

0x85B24000 C:\Windows\system32\DRIVERS\compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver)

0x923A3000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)

0x92C83000 C:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)

==============================================

>Stealth

==============================================

0x07E60000 Hidden Image-->CLI.Component.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 1003520 bytes

0x06030000 Hidden Image-->CLI.Aspect.Radeon3D.Graphics.Wizard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 102400 bytes

0x026E0000 Hidden Image-->BCMLogon.dll [ EPROCESS 0x8D3E0020 ] PID: 792, 1060864 bytes

0x00500000 Hidden Image-->MOM.Implementation.DLL [ EPROCESS 0x880A47A0 ] PID: 5300, 118784 bytes

0x00C00000 Hidden Image-->MOM.Implementation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 118784 bytes

0x07590000 Hidden Image-->CLI.Aspect.DisplaysOptions.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 126976 bytes

0x06EB0000 Hidden Image-->CLI.Aspect.Welcome.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 143360 bytes

0x075C0000 Hidden Image-->CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 159744 bytes

0x08280000 Hidden Image-->CLI.Aspect.DisplaysManager.Graphics.Wizard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 1699840 bytes

0x06920000 Hidden Image-->CLI.Aspect.InfoCentre.Graphics.Wizard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 217088 bytes

0x06EE0000 Hidden Image-->CLI.Aspect.InfoCentre.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 233472 bytes

0x051F0000 Hidden Image-->CLI.Caste.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 282624 bytes

0x01BA0000 Hidden Image-->SupportSoft.Agent.Sprocket.dll [ EPROCESS 0x881DCCE8 ] PID: 4512, 28672 bytes

0x01700000 Hidden Image-->MOM.Foundation.DLL [ EPROCESS 0x880A47A0 ] PID: 5300, 28672 bytes

0x01740000 Hidden Image-->LOG.Foundation.Implementation.Private.DLL [ EPROCESS 0x880A47A0 ] PID: 5300, 28672 bytes

0x009F0000 Hidden Image-->MOM.Foundation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x00A50000 Hidden Image-->LOG.Foundation.Implementation.Private.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x00CE0000 Hidden Image-->LOCALIZATION.Foundation.Private.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x00D30000 Hidden Image-->CLI.Component.Runtime.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x03F00000 Hidden Image-->AEM.Server.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x04180000 Hidden Image-->AEM.Plugin.Hotkeys.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x04160000 Hidden Image-->AEM.Plugin.DPPE.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x041B0000 Hidden Image-->AEM.Plugin.WinMessages.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x041E0000 Hidden Image-->DEM.Graphics.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x041D0000 Hidden Image-->DEM.Foundation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x04A30000 Hidden Image-->DEM.OS.I0602.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x04BA0000 Hidden Image-->DEM.OS.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x04BB0000 Hidden Image-->DEM.Graphics.I0709.dll [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x04BD0000 Hidden Image-->AEM.Plugin.GD.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x05380000 Hidden Image-->AEM.Actions.CCAA.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x05390000 Hidden Image-->DEM.Graphics.I0804.dll [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x055A0000 Hidden Image-->DEM.Graphics.I0706.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x053F0000 Hidden Image-->CLI.Aspect.HotkeysHandling.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x05400000 Hidden Image-->CLI.Aspect.HotkeysHandling.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x05440000 Hidden Image-->CLI.Caste.Graphics.Runtime.Shared.Private.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x05590000 Hidden Image-->DEM.Graphics.I0805.dll [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x059F0000 Hidden Image-->DEM.Graphics.I0712.dll [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x05DF0000 Hidden Image-->CLI.Component.Runtime.Extension.EEU.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x05DC0000 Hidden Image-->APM.Foundation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x05DE0000 Hidden Image-->AEM.Plugin.EEU.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x05E30000 Hidden Image-->CLI.Component.Client.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x05E40000 Hidden Image-->CLI.Component.Wizard.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x06020000 Hidden Image-->CLI.Caste.Graphics.Wizard.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x06970000 Hidden Image-->atixclib.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x06D50000 Hidden Image-->CLI.Component.Dashboard.Shared.Private.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x06D40000 Hidden Image-->CLI.Component.Dashboard.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x06D90000 Hidden Image-->CLI.Caste.Graphics.Dashboard.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 28672 bytes

0x06BF0000 Hidden Image-->CLI.Aspect.DeviceLCD.Graphics.Wizard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 315392 bytes

0x07C60000 Hidden Image-->CLI.Aspect.Radeon3D.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 356352 bytes

0x03E70000 Hidden Image-->CCC.Implementation.DLL [ EPROCESS 0x880A47A0 ] PID: 5300, 36864 bytes

0x03F80000 Hidden Image-->NEWAEM.Foundation.DLL [ EPROCESS 0x880A47A0 ] PID: 5300, 36864 bytes

0x009C0000 Hidden Image-->CCC.Implementation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes

0x00C30000 Hidden Image-->CLI.Foundation.XManifest.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes

0x00D00000 Hidden Image-->AxInterop.WBOCXLib.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes

0x03F10000 Hidden Image-->Interop.WBOCXLib.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes

0x01DD0000 Hidden Image-->NEWAEM.Foundation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes

0x041A0000 Hidden Image-->LOCALIZATION.Foundation.Implementation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes

0x04A20000 Hidden Image-->ACE.Graphics.DisplaysManager.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes

0x05460000 Hidden Image-->CLI.Aspect.CustomFormats.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes

0x05610000 Hidden Image-->CLI.Aspect.DisplaysColour2.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes

0x058B0000 Hidden Image-->CLI.Aspect.DeviceLCD.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes

0x05850000 Hidden Image-->CLI.Aspect.DisplaysOptions.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes

0x05D90000 Hidden Image-->CLI.Aspect.PowerPlayDPPE.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes

0x05F70000 Hidden Image-->CLI.Component.Wizard.Shared.Private.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 36864 bytes

0x07A00000 Hidden Image-->CLI.Aspect.DeviceCRT.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 389120 bytes

0x057A0000 Hidden Image-->WLTRAY.EXE [ EPROCESS 0x9C678D90 ] PID: 1948, 3952640 bytes

0x05FB0000 Hidden Image-->CLI.Component.Wizard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 405504 bytes

0x06B80000 Hidden Image-->CLI.Aspect.MMVideo.Graphics.Wizard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 413696 bytes

0x07A60000 Hidden Image-->CLI.Aspect.DeviceLCD.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 413696 bytes

0x07520000 Hidden Image-->CLI.Aspect.DisplaysManager.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 446464 bytes

0x01B80000 Hidden Image-->SupportSoft.Agent.Sprocket.SupportMessage.dll [ EPROCESS 0x881DCCE8 ] PID: 4512, 45056 bytes

0x00530000 Hidden Image-->LOG.Foundation.DLL [ EPROCESS 0x880A47A0 ] PID: 5300, 45056 bytes

0x016D0000 Hidden Image-->LOG.Foundation.Private.DLL [ EPROCESS 0x880A47A0 ] PID: 5300, 45056 bytes

0x009E0000 Hidden Image-->LOG.Foundation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 45056 bytes

0x00B50000 Hidden Image-->LOG.Foundation.Private.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 45056 bytes

0x00D40000 Hidden Image-->ATICCCom.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 45056 bytes

0x05570000 Hidden Image-->CLI.Aspect.DeviceProperty.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 45056 bytes

0x055B0000 Hidden Image-->CLI.Aspect.DeviceProperty.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 45056 bytes

0x05740000 Hidden Image-->CLI.Aspect.DisplaysOptions.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 45056 bytes

0x058A0000 Hidden Image-->CLI.Aspect.DeviceLCD.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 45056 bytes

0x07BE0000 Hidden Image-->CLI.Aspect.DeviceDFP.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 462848 bytes

0x068A0000 Hidden Image-->CLI.Aspect.TransCode.Graphics.Wizard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 495616 bytes

0x027F0000 Hidden Image-->msvcm80.dll [ EPROCESS 0x8D3E0020 ] PID: 792, 507904 bytes

0x03FA0000 Hidden Image-->msvcm80.dll [ EPROCESS 0x9C678D90 ] PID: 1948, 507904 bytes

0x024F0000 Hidden Image-->msvcm80.dll [ EPROCESS 0x88285420 ] PID: 4480, 507904 bytes

0x083B0000 Hidden Image-->msvcm80.dll [ EPROCESS 0x88243400 ] PID: 4536, 507904 bytes

0x00CF0000 Hidden Image-->CLI.Component.Runtime.Shared.Private.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes

0x00D10000 Hidden Image-->CLI.Foundation.Private.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes

0x01D80000 Hidden Image-->AEM.Server.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes

0x03EF0000 Hidden Image-->AEM.Plugin.Source.Kit.Server.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes

0x041C0000 Hidden Image-->DEM.Graphics.I0601.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes

0x05450000 Hidden Image-->CLI.Aspect.DeviceCV.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes

0x05600000 Hidden Image-->CLI.Aspect.DisplaysColour2.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes

0x05870000 Hidden Image-->CLI.Aspect.DeviceCRT.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes

0x05D80000 Hidden Image-->CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes

0x05E20000 Hidden Image-->CLI.Component.Client.Shared.Private.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes

0x05F90000 Hidden Image-->CLI.Caste.Graphics.Wizard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes

0x06960000 Hidden Image-->CLI.Aspect.TransCode.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 53248 bytes

0x07CC0000 Hidden Image-->CLI.Aspect.DisplaysColour2.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 593920 bytes

0x00A40000 Hidden Image-->CLI.Foundation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 61440 bytes

0x00C20000 Hidden Image-->CLI.Component.SkinFactory.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 61440 bytes

0x00CD0000 Hidden Image-->CLI.Component.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 61440 bytes

0x04A10000 Hidden Image-->CLI.Caste.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 61440 bytes

0x05880000 Hidden Image-->CLI.Aspect.DeviceCRT.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 61440 bytes

0x059E0000 Hidden Image-->CLI.Aspect.DeviceDFP.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 61440 bytes

0x05A10000 Hidden Image-->CLI.Aspect.Radeon3D.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 61440 bytes

0x05AF0000 Hidden Image-->CLI.Aspect.MMVideo.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 61440 bytes

0x016E0000 Hidden Image-->LOG.Foundation.Implementation.DLL [ EPROCESS 0x880A47A0 ] PID: 5300, 69632 bytes

0x00B30000 Hidden Image-->LOG.Foundation.Implementation.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 69632 bytes

0x058C0000 Hidden Image-->CLI.Aspect.DeviceDFP.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 69632 bytes

0x05A80000 Hidden Image-->CLI.Aspect.Radeon3D.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 69632 bytes

0x05DA0000 Hidden Image-->APM.Server.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 69632 bytes

0x0E130000 Hidden Image-->BCMWLCPL.CPL [ EPROCESS 0x88243400 ] PID: 4536, 7045120 bytes

0x01B50000 Hidden Image-->bcmwlrmt.dll [ EPROCESS 0x9C678D90 ] PID: 1948, 77824 bytes

0x02250000 Hidden Image-->bcmwlrmt.dll [ EPROCESS 0x88285420 ] PID: 4480, 77824 bytes

0x01510000 Hidden Image-->sprtmessage.dll [ EPROCESS 0x881DCCE8 ] PID: 4512, 77824 bytes

0x05260000 Hidden Image-->ATIDEMOS.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 77824 bytes

0x05410000 Hidden Image-->CLI.Aspect.DeviceCV.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 77824 bytes

0x055E0000 Hidden Image-->CLI.Aspect.DeviceTV.Graphics.Shared.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 77824 bytes

0x08610000 Hidden Image-->CLI.Aspect.MMVideo.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 815104 bytes

0x055C0000 Hidden Image-->CLI.Aspect.DeviceTV.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 86016 bytes

0x05AB0000 Hidden Image-->CLI.Aspect.MMVideo.Graphics.Runtime.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 86016 bytes

0x06D70000 Hidden Image-->CLI.Caste.Graphics.Dashboard.DLL [ EPROCESS 0x883DBD90 ] PID: 6032, 86016 bytes

Link to post
Share on other sites

1. Please download The Avenger2 by Swandog46 to your Desktop.

  • Right click on the Avenger.zip folder and select "Extract All..."
  • Follow the prompts and extract the avenger folder to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to move:
C:\Windows\System32\logevent.dll | C:\Windows\System32\cngaudit.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

  • Right click on the window under Input script here:, and select Paste.
  • You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
  • Click on Execute
  • Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

[*]It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.)

[*]On reboot, it will briefly open a black command window on your desktop, this is normal.

[*]After the restart, it creates a log file that should open with the results of Avenger

Link to post
Share on other sites

Great.

Update Run Malwarebytes

Please update\run Malwarebytes' Anti-Malware.

Double Click the Malwarebytes Anti-Malware icon to run the application.

  • Click on the update tab then click on Check for updates.
  • If an update is found, it will download and install the latest version.
  • Once the update has loaded, go to the Scanner tab and select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatley.

=====

* Go here to run an online scannner from ESET.

  • Note: You will need to use Internet explorer for this scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Check next options: Remove found threats and Scan inside archives.
  • Click Scan
  • Wait for the scan to finish
  • Click on the option that says Export to text file.
  • Save it to your desktop and post the contents here in your next reply.
  • Once the log is saved click the option to delete quarantined threats and Uninstall application on close.

Link to post
Share on other sites

OK for mbam we just need to reset permissions on the file so it can run.

Click Here and download this program.

Save it to the desktop.

Drag the mbam file in this location C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe onto the inherit program.

A box will popup and say ok.

Once that is done it will open then proceed with the instructions for running mbam and post it's log please.

Link to post
Share on other sites

Looks good how are things running?

Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here.

"%userprofile%\desktop\win32kdiag.exe" -f -r

Open OTL once more and click on Run scan at the top.

Post the new log that opens

Link to post
Share on other sites

Great. :lol:

Please open up Notepad and copy all of the items in the code box below.

Change the "Save As Type" to "All Files". Save it as fix.reg on your Desktop.

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"=-

Now double-click fix.reg.

A window will come up asking if you want to let it merge with the registry.

Click yes.

After that happens you cand elete that file.

=======Cleanup=======

  • Click START then RUN
  • Now type Combofix /uninstall in the runbox and click OK. Note the space between the X and the Uninstall, it needs to be there.

======Next======

  • Double click on OTL to run it.
  • Click on the Cleanup button at the top.
  • You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.
  • This will remove itself and other tools we may have used.

===============Update Java===============

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

  • Download the latest version of Java SE Runtime Environment (JRE) and save it to your desktop.
  • Scroll down to where it says "(JRE) then click on it
  • Click the "Download" button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u23-windows-i586.exe to install the newest version.

=====

After that your all set.

===The following are some articles and a Windows Update link that I like to suggest to people to prevent malware and general PC maintenance===

Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.

Prevention article Some great guidelines to follow to prevent future infections please read the Prevention artice by Miekiemoes.

How did I get infected in the first place? Also this one by Tony Klein.

If your computer is slow Things you can do if your computer is slow.

PC Safety and Security - What Do I Need? Security suggestions and general hints and tips for PC security.

File sharing program dangers Reasons to stay away from File sharing programs for ex: BitTorrent,Limewire,Kazaa,emule,Utorrent etc...

===Free antimalware tools used for on demand scanning and cleaning no real time unless purchased===

Malwarebytes Antimalware

superantispyware

===Free antivirus links===

This is antivirus and antispyware.

Microsoft Security Essentials

This is free antispyware protection and Antivirus protection.

AVG free

This is just antivirus protection.

Antivir

This is antivirus and antispyware protection.

Avast

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.