Jump to content

Infected with Antivirus Plus


Recommended Posts

My pc recently got infected with Antivirus Plus. I found some instructions for using Malwarebytes Pro to remove it, but that didn't work as a Malwarebytes scan didn't find anything. I am still getting annoying popups asking me to purchase Antivirus Plus, the whole PC is running really slowly and strange things are coming up in Firefox when visiting pages.

Logs attached as per your instructions.

Any help would be much appreciated.

ark.zip

Attach.zip

DDS.txt

mbam-log-2011-07-06 (19-16-37).txt

Link to post
Share on other sites

Hello BarbW and welcome to Malwarebytes! :welcome:

I am D-FRED-BROWN and I will be helping you. :)

Please print or save this topic: it will make it easier for you to follow the instructions and complete all of the necessary steps.

**For future reference, please post the logs rather than attaching them- it makes it easier for me to read them this way ;)

-------------

Please download to your Desktop:

  • TDSSKiller.zip from here and extract it (right click on it => "Extract here").

>>> TDSSKiller: Double-click on TDSSKiller.exe to run the application.

  • Click on the Start Scan button and wait for the scan and disinfection process to be over.
  • If an infected file is detected, the default action will be Cure, click on Continue tdsskiller2.png
  • If a suspicious file is detected, the default action will be Skip, click on Continue tdsskiller3.png
  • If you are asked to reboot the computer to complete the process, click on the Reboot Now button. A report will be automatically saved at the root of the System drive ((usually C:\) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt" (for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt). Please copy and paste the contents of that file here.
  • If no reboot is required, click on Report. A log file will appear. Please copy and paste the contents of that file in your next reply.

In your next reply, please include the following (you may need to use two posts to get it all in):

  • TDSSKiller_log.txt
how the PC is running now?
-------------
Please download ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
***IMPORTANT: save ComboFix to your Desktop***
* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Please go here to see a list of programs that should be disabled.
**Note: Do not mouseclick ComboFix's window while it's running. That may cause it to stall**
Please include the C:\ComboFix.txt in your next reply for further review.
Also, please let me know if any problems still remain.
-------------
Please download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-------------

In your next reply, please include:

  • C:\ComboFix.txt
  • TDSSKiller log
  • Security Check checkup.txt

How is your computer running now?

Link to post
Share on other sites

Hi D-FRED-BROWN,

Thanks for your response. I just wanted to mention, that since posting Vista came up with a message saying it had blocked some programs, though I couldn't tell what they were. After this the Antivirus Plus popups stopped and the PC is running as it should. I don't know if this means vista has taken care of anything. I have followed you instructions and the log files follow. Tdskiller didn't find anything, but I have run this before, following some instructions I found elsewhere on the internet, but I'll post the log anyway.

TDSkiller

2011/07/11 17:08:41.0613 5732 TDSS rootkit removing tool 2.5.9.0 Jul 1 2011 18:45:21

2011/07/11 17:08:42.0392 5732 ================================================================================

2011/07/11 17:08:42.0392 5732 SystemInfo:

2011/07/11 17:08:42.0392 5732

2011/07/11 17:08:42.0392 5732 OS Version: 6.0.6002 ServicePack: 2.0

2011/07/11 17:08:42.0392 5732 Product type: Workstation

2011/07/11 17:08:42.0392 5732 ComputerName: DELL

2011/07/11 17:08:42.0392 5732 UserName: Gary

2011/07/11 17:08:42.0392 5732 Windows directory: C:\Windows

2011/07/11 17:08:42.0392 5732 System windows directory: C:\Windows

2011/07/11 17:08:42.0393 5732 Processor architecture: Intel x86

2011/07/11 17:08:42.0393 5732 Number of processors: 2

2011/07/11 17:08:42.0393 5732 Page size: 0x1000

2011/07/11 17:08:42.0393 5732 Boot type: Normal boot

2011/07/11 17:08:42.0393 5732 ================================================================================

2011/07/11 17:08:45.0042 5732 Initialize success

2011/07/11 17:08:52.0837 5220 ================================================================================

2011/07/11 17:08:52.0837 5220 Scan started

2011/07/11 17:08:52.0837 5220 Mode: Manual;

2011/07/11 17:08:52.0837 5220 ================================================================================

2011/07/11 17:08:54.0138 5220 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys

2011/07/11 17:08:54.0421 5220 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys

2011/07/11 17:08:54.0728 5220 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys

2011/07/11 17:08:55.0040 5220 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys

2011/07/11 17:08:55.0215 5220 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys

2011/07/11 17:08:55.0326 5220 AFD (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys

2011/07/11 17:08:55.0477 5220 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys

2011/07/11 17:08:55.0531 5220 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

2011/07/11 17:08:55.0622 5220 aliide (3a99cb23a2d326fd532618705d6e3048) C:\Windows\system32\drivers\aliide.sys

2011/07/11 17:08:55.0823 5220 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys

2011/07/11 17:08:56.0042 5220 amdide (4333c133dbd71c7d7fe4fb1b83f9ee3e) C:\Windows\system32\drivers\amdide.sys

2011/07/11 17:08:56.0231 5220 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys

2011/07/11 17:08:56.0293 5220 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\DRIVERS\amdk8.sys

2011/07/11 17:08:56.0587 5220 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys

2011/07/11 17:08:56.0805 5220 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys

2011/07/11 17:08:57.0033 5220 ASPI (e54e27976e2c5a6465d44c10b1d87ac0) C:\Windows\System32\DRIVERS\ASPI32.sys

2011/07/11 17:08:57.0183 5220 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys

2011/07/11 17:08:57.0254 5220 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys

2011/07/11 17:08:57.0628 5220 atikmdag (7db96c2801a78513bdc133c25d07929e) C:\Windows\system32\DRIVERS\atikmdag.sys

2011/07/11 17:08:57.0986 5220 AtiPcie (a356e45e8432432c06981ea63a1e0fe8) C:\Windows\system32\DRIVERS\AtiPcie.sys

2011/07/11 17:08:58.0164 5220 bckd (7cfd6d37aba7006148abbf4f629b2d2a) C:\Windows\system32\drivers\bckd.sys

2011/07/11 17:08:58.0365 5220 BCM43XV (abd543e555bc0453bf52664936df4dcd) C:\Windows\system32\DRIVERS\bcmwl6.sys

2011/07/11 17:08:58.0439 5220 BCM43XX (abd543e555bc0453bf52664936df4dcd) C:\Windows\system32\DRIVERS\bcmwl6.sys

2011/07/11 17:08:58.0651 5220 bcm4sbxp (cd4646067cc7dcba1907fa0acf7e3966) C:\Windows\system32\DRIVERS\bcm4sbxp.sys

2011/07/11 17:08:58.0887 5220 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys

2011/07/11 17:08:59.0231 5220 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys

2011/07/11 17:08:59.0324 5220 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

2011/07/11 17:08:59.0385 5220 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

2011/07/11 17:08:59.0577 5220 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys

2011/07/11 17:08:59.0764 5220 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

2011/07/11 17:08:59.0970 5220 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

2011/07/11 17:09:00.0155 5220 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys

2011/07/11 17:09:00.0260 5220 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys

2011/07/11 17:09:00.0342 5220 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys

2011/07/11 17:09:00.0460 5220 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys

2011/07/11 17:09:00.0542 5220 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys

2011/07/11 17:09:00.0610 5220 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys

2011/07/11 17:09:00.0822 5220 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys

2011/07/11 17:09:01.0003 5220 cmdide (dfb94a6fc3a26972b0461ab5f1d8272b) C:\Windows\system32\drivers\cmdide.sys

2011/07/11 17:09:01.0183 5220 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys

2011/07/11 17:09:01.0397 5220 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys

2011/07/11 17:09:01.0618 5220 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys

2011/07/11 17:09:01.0866 5220 DfsC (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys

2011/07/11 17:09:02.0112 5220 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys

2011/07/11 17:09:02.0337 5220 Dot4 (4f59c172c094e1a1d46463a8dc061cbd) C:\Windows\system32\DRIVERS\Dot4.sys

2011/07/11 17:09:02.0545 5220 Dot4Print (80bf3ba09f6f2523c8f6b7cc6dbf7bd5) C:\Windows\system32\DRIVERS\Dot4Prt.sys

2011/07/11 17:09:02.0655 5220 dot4usb (c55004ca6b419b6695970dfe849b122f) C:\Windows\system32\DRIVERS\dot4usb.sys

2011/07/11 17:09:02.0752 5220 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys

2011/07/11 17:09:02.0820 5220 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys

2011/07/11 17:09:03.0096 5220 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys

2011/07/11 17:09:03.0435 5220 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys

2011/07/11 17:09:03.0751 5220 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys

2011/07/11 17:09:04.0322 5220 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys

2011/07/11 17:09:04.0561 5220 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys

2011/07/11 17:09:04.0616 5220 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys

2011/07/11 17:09:04.0692 5220 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys

2011/07/11 17:09:04.0878 5220 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys

2011/07/11 17:09:05.0075 5220 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys

2011/07/11 17:09:05.0208 5220 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys

2011/07/11 17:09:05.0360 5220 fssfltr (d909075fa72c090f27aa926c32cb4612) C:\Windows\system32\DRIVERS\fssfltr.sys

2011/07/11 17:09:05.0465 5220 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys

2011/07/11 17:09:05.0535 5220 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys

2011/07/11 17:09:05.0608 5220 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys

2011/07/11 17:09:05.0693 5220 HdAudAddService (3f90e001369a07243763bd5a523d8722) C:\Windows\system32\drivers\HdAudio.sys

2011/07/11 17:09:05.0936 5220 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys

2011/07/11 17:09:06.0119 5220 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

2011/07/11 17:09:06.0257 5220 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys

2011/07/11 17:09:06.0321 5220 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys

2011/07/11 17:09:06.0392 5220 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys

2011/07/11 17:09:06.0628 5220 HSF_DPV (53229dcf431d76434816cd29251168a0) C:\Windows\system32\DRIVERS\HSX_DPV.sys

2011/07/11 17:09:06.0825 5220 HSXHWAZL (31f949d452201f2f0af0c88d7db512cd) C:\Windows\system32\DRIVERS\HSXHWAZL.sys

2011/07/11 17:09:07.0033 5220 HTTP (0eeeca26c8d4bde2a4664db058a81937) C:\Windows\system32\drivers\HTTP.sys

2011/07/11 17:09:07.0389 5220 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys

2011/07/11 17:09:07.0576 5220 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys

2011/07/11 17:09:07.0753 5220 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys

2011/07/11 17:09:07.0966 5220 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

2011/07/11 17:09:08.0163 5220 intelide (1c60617d54bc9f035671a44b75d9f7cc) C:\Windows\system32\drivers\intelide.sys

2011/07/11 17:09:08.0249 5220 intelppm (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys

2011/07/11 17:09:08.0308 5220 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys

2011/07/11 17:09:08.0509 5220 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys

2011/07/11 17:09:08.0565 5220 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys

2011/07/11 17:09:08.0628 5220 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys

2011/07/11 17:09:08.0813 5220 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys

2011/07/11 17:09:09.0034 5220 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys

2011/07/11 17:09:09.0185 5220 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

2011/07/11 17:09:09.0265 5220 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

2011/07/11 17:09:09.0324 5220 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys

2011/07/11 17:09:09.0446 5220 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys

2011/07/11 17:09:09.0524 5220 kl1 (ce3958f58547454884e97bda78cd7040) C:\Windows\system32\DRIVERS\kl1.sys

2011/07/11 17:09:09.0602 5220 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys

2011/07/11 17:09:09.0851 5220 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys

2011/07/11 17:09:10.0065 5220 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys

2011/07/11 17:09:10.0199 5220 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys

2011/07/11 17:09:10.0271 5220 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys

2011/07/11 17:09:10.0328 5220 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys

2011/07/11 17:09:10.0530 5220 MBAMProtector (3d2c13377763eeac0ca6fb46f57217ed) C:\Windows\system32\drivers\mbam.sys

2011/07/11 17:09:10.0737 5220 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys

2011/07/11 17:09:10.0913 5220 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys

2011/07/11 17:09:11.0130 5220 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys

2011/07/11 17:09:11.0330 5220 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys

2011/07/11 17:09:11.0447 5220 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys

2011/07/11 17:09:11.0507 5220 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys

2011/07/11 17:09:11.0563 5220 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys

2011/07/11 17:09:11.0787 5220 mozyFilter (19cb6b226733843817d607c46fdb310c) C:\Windows\system32\DRIVERS\mozy.sys

2011/07/11 17:09:12.0035 5220 MpFilter (7e34bfa1a7b60bba1da03d677f16cd63) C:\Windows\system32\DRIVERS\MpFilter.sys

2011/07/11 17:09:12.0204 5220 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys

2011/07/11 17:09:12.0346 5220 MpKsl0f2b2235 (5f53edfead46fa7adb78eee9ecce8fdf) c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{60D1805F-E8E4-43DF-A3DA-3C2446E6FA00}\MpKsl0f2b2235.sys

2011/07/11 17:09:12.0617 5220 MpNWMon (f32e2d6a1640a469a9ed4f1929a4a861) C:\Windows\system32\DRIVERS\MpNWMon.sys

2011/07/11 17:09:12.0825 5220 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys

2011/07/11 17:09:13.0009 5220 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

2011/07/11 17:09:13.0180 5220 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys

2011/07/11 17:09:13.0386 5220 mrxsmb (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys

2011/07/11 17:09:13.0562 5220 mrxsmb10 (d4a3c7c580c4ccb5c06f2ada933ad507) C:\Windows\system32\DRIVERS\mrxsmb10.sys

2011/07/11 17:09:13.0613 5220 mrxsmb20 (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

2011/07/11 17:09:13.0671 5220 msahci (f0ec3a4e0693a34b148723b4da31668c) C:\Windows\system32\drivers\msahci.sys

2011/07/11 17:09:13.0750 5220 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys

2011/07/11 17:09:13.0952 5220 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys

2011/07/11 17:09:14.0154 5220 MSHUSBVideo (5119ffc2a6b51089cdb0efdc75808c97) C:\Windows\system32\Drivers\nx6000.sys

2011/07/11 17:09:14.0385 5220 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys

2011/07/11 17:09:14.0571 5220 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys

2011/07/11 17:09:14.0787 5220 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys

2011/07/11 17:09:14.0957 5220 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys

2011/07/11 17:09:15.0140 5220 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys

2011/07/11 17:09:15.0327 5220 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys

2011/07/11 17:09:15.0469 5220 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys

2011/07/11 17:09:15.0537 5220 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys

2011/07/11 17:09:15.0836 5220 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys

2011/07/11 17:09:16.0078 5220 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys

2011/07/11 17:09:16.0247 5220 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys

2011/07/11 17:09:16.0291 5220 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys

2011/07/11 17:09:16.0348 5220 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys

2011/07/11 17:09:16.0422 5220 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys

2011/07/11 17:09:16.0595 5220 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys

2011/07/11 17:09:16.0807 5220 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys

2011/07/11 17:09:17.0083 5220 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

2011/07/11 17:09:17.0255 5220 NisDrv (17e2c08c5ecfbe94a7c67b1c275ee9d9) C:\Windows\system32\DRIVERS\NisDrvWFP.sys

2011/07/11 17:09:17.0344 5220 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys

2011/07/11 17:09:17.0526 5220 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys

2011/07/11 17:09:17.0765 5220 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys

2011/07/11 17:09:17.0960 5220 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

2011/07/11 17:09:18.0163 5220 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys

2011/07/11 17:09:18.0376 5220 nvraid (6f785db62a6d8f3fafd3e5695277e849) C:\Windows\system32\drivers\nvraid.sys

2011/07/11 17:09:18.0504 5220 nvstor (4a5fcab82d9bf6af8a023a66802fe9e9) C:\Windows\system32\drivers\nvstor.sys

2011/07/11 17:09:18.0564 5220 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys

2011/07/11 17:09:18.0711 5220 ohci1394 (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys

2011/07/11 17:09:18.0952 5220 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys

2011/07/11 17:09:19.0122 5220 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys

2011/07/11 17:09:19.0311 5220 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys

2011/07/11 17:09:19.0506 5220 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys

2011/07/11 17:09:19.0575 5220 pciide (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys

2011/07/11 17:09:19.0633 5220 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys

2011/07/11 17:09:19.0882 5220 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

2011/07/11 17:09:20.0226 5220 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys

2011/07/11 17:09:20.0406 5220 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys

2011/07/11 17:09:20.0633 5220 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys

2011/07/11 17:09:20.0879 5220 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys

2011/07/11 17:09:21.0072 5220 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

2011/07/11 17:09:21.0256 5220 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys

2011/07/11 17:09:21.0585 5220 R300 (7db96c2801a78513bdc133c25d07929e) C:\Windows\system32\DRIVERS\atikmdag.sys

2011/07/11 17:09:21.0792 5220 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys

2011/07/11 17:09:22.0006 5220 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys

2011/07/11 17:09:22.0254 5220 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys

2011/07/11 17:09:22.0428 5220 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys

2011/07/11 17:09:22.0587 5220 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys

2011/07/11 17:09:22.0643 5220 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys

2011/07/11 17:09:22.0728 5220 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys

2011/07/11 17:09:22.0926 5220 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys

2011/07/11 17:09:23.0134 5220 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys

2011/07/11 17:09:23.0337 5220 rimmptsk (d85e3fa9f5b1f29bb4ed185c450d1470) C:\Windows\system32\DRIVERS\rimmptsk.sys

2011/07/11 17:09:23.0474 5220 rimsptsk (db8eb01c58c9fada00c70b1775278ae0) C:\Windows\system32\drivers\rimsptsk.sys

2011/07/11 17:09:23.0525 5220 rismxdp (6c1f93c0760c9f79a1869d07233df39d) C:\Windows\system32\drivers\rixdptsk.sys

2011/07/11 17:09:23.0587 5220 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys

2011/07/11 17:09:23.0693 5220 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\program files\SUPERAntiSpyware\SASDIFSV.SYS

2011/07/11 17:09:23.0758 5220 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS

2011/07/11 17:09:23.0939 5220 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

2011/07/11 17:09:24.0173 5220 sdbus (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys

2011/07/11 17:09:24.0376 5220 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

2011/07/11 17:09:24.0578 5220 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys

2011/07/11 17:09:24.0786 5220 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys

2011/07/11 17:09:24.0961 5220 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys

2011/07/11 17:09:25.0180 5220 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys

2011/07/11 17:09:25.0361 5220 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys

2011/07/11 17:09:25.0495 5220 sffp_sd (9f66a46c55d6f1ccabc79bb7afccc545) C:\Windows\system32\DRIVERS\sffp_sd.sys

2011/07/11 17:09:25.0541 5220 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys

2011/07/11 17:09:25.0602 5220 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys

2011/07/11 17:09:25.0646 5220 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys

2011/07/11 17:09:25.0843 5220 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys

2011/07/11 17:09:26.0048 5220 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys

2011/07/11 17:09:26.0253 5220 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys

2011/07/11 17:09:26.0448 5220 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys

2011/07/11 17:09:26.0577 5220 srv2 (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys

2011/07/11 17:09:26.0632 5220 srvnet (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys

2011/07/11 17:09:26.0748 5220 STHDA (6a2a5e809c2c0178326d92b19ee4aad3) C:\Windows\system32\drivers\stwrt.sys

2011/07/11 17:09:26.0949 5220 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys

2011/07/11 17:09:27.0156 5220 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

2011/07/11 17:09:27.0347 5220 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

2011/07/11 17:09:27.0476 5220 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

2011/07/11 17:09:27.0576 5220 SynTP (1f5192248a364d4ab68db063d18a2139) C:\Windows\system32\DRIVERS\SynTP.sys

2011/07/11 17:09:27.0712 5220 Tcpip (6a10afce0b38371064be41c1fbfd3c6b) C:\Windows\system32\drivers\tcpip.sys

2011/07/11 17:09:27.0947 5220 Tcpip6 (6a10afce0b38371064be41c1fbfd3c6b) C:\Windows\system32\DRIVERS\tcpip.sys

2011/07/11 17:09:28.0132 5220 tcpipreg (9bf343f4c878d6ad6922b2c5a4fefe0d) C:\Windows\system32\drivers\tcpipreg.sys

2011/07/11 17:09:28.0292 5220 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys

2011/07/11 17:09:28.0333 5220 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys

2011/07/11 17:09:28.0387 5220 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys

2011/07/11 17:09:28.0516 5220 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys

2011/07/11 17:09:28.0615 5220 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys

2011/07/11 17:09:28.0660 5220 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys

2011/07/11 17:09:28.0702 5220 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys

2011/07/11 17:09:28.0902 5220 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys

2011/07/11 17:09:29.0105 5220 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys

2011/07/11 17:09:29.0321 5220 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys

2011/07/11 17:09:29.0450 5220 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys

2011/07/11 17:09:29.0509 5220 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

2011/07/11 17:09:29.0557 5220 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

2011/07/11 17:09:29.0619 5220 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys

2011/07/11 17:09:30.0013 5220 usbaudio (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys

2011/07/11 17:09:30.0199 5220 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys

2011/07/11 17:09:30.0421 5220 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

2011/07/11 17:09:30.0641 5220 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys

2011/07/11 17:09:30.0836 5220 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys

2011/07/11 17:09:31.0020 5220 usbohci (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys

2011/07/11 17:09:31.0192 5220 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys

2011/07/11 17:09:31.0388 5220 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys

2011/07/11 17:09:31.0571 5220 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS

2011/07/11 17:09:31.0757 5220 usbuhci (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys

2011/07/11 17:09:31.0966 5220 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys

2011/07/11 17:09:32.0202 5220 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys

2011/07/11 17:09:32.0399 5220 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys

2011/07/11 17:09:32.0588 5220 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys

2011/07/11 17:09:32.0788 5220 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys

2011/07/11 17:09:32.0965 5220 viaide (58c8d5ac5c3eef40e7e704a5ced7987d) C:\Windows\system32\drivers\viaide.sys

2011/07/11 17:09:33.0141 5220 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys

2011/07/11 17:09:33.0333 5220 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys

2011/07/11 17:09:33.0463 5220 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys

2011/07/11 17:09:33.0530 5220 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys

2011/07/11 17:09:33.0602 5220 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

2011/07/11 17:09:33.0658 5220 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

2011/07/11 17:09:33.0688 5220 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

2011/07/11 17:09:33.0951 5220 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys

2011/07/11 17:09:34.0147 5220 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys

2011/07/11 17:09:34.0388 5220 winachsf (6d2350bb6e77e800fc4be4e5b7a2e89a) C:\Windows\system32\DRIVERS\HSX_CNXT.sys

2011/07/11 17:09:34.0685 5220 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys

2011/07/11 17:09:34.0926 5220 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys

2011/07/11 17:09:35.0087 5220 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys

2011/07/11 17:09:35.0157 5220 XAudio (5a7ff9a18ff6d7e0527fe3abf9204ef8) C:\Windows\system32\DRIVERS\xaudio.sys

2011/07/11 17:09:35.0246 5220 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0

2011/07/11 17:09:35.0289 5220 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR3

2011/07/11 17:09:35.0419 5220 Boot (0x1200) (26d676eb2feab456b1a6d599a053a53d) \Device\Harddisk0\DR0\Partition0

2011/07/11 17:09:35.0464 5220 Boot (0x1200) (48560e0ee128b161c08a1c1cef29e326) \Device\Harddisk0\DR0\Partition1

2011/07/11 17:09:35.0497 5220 Boot (0x1200) (9756d9e664577e4b7b5f616758b9160b) \Device\Harddisk1\DR3\Partition0

2011/07/11 17:09:35.0511 5220 ================================================================================

2011/07/11 17:09:35.0511 5220 Scan finished

2011/07/11 17:09:35.0511 5220 ================================================================================

2011/07/11 17:09:35.0556 3352 Detected object count: 0

2011/07/11 17:09:35.0556 3352 Actual detected object count: 0

Combofix

ComboFix 11-07-11.02 - Gary 07/11/2011 17:19:27.1.2 - x86

Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.61.1033.18.2685.1079 [GMT 2:00]

Running from: c:\users\Gary\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((( Files Created from 2011-06-11 to 2011-07-11 )))))))))))))))))))))))))))))))

.

.

2011-07-11 15:30 . 2011-07-11 15:30 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-07-11 12:25 . 2011-07-11 12:26 28752 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{60D1805F-E8E4-43DF-A3DA-3C2446E6FA00}\MpKsl0f2b2235.sys

2011-07-11 12:25 . 2011-06-07 15:55 7074640 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{60D1805F-E8E4-43DF-A3DA-3C2446E6FA00}\mpengine.dll

2011-07-06 16:49 . 2011-07-06 16:49 711728 ----a-w- c:\windows\isRS-000.tmp

2011-07-06 16:47 . 2011-05-29 07:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-07-06 16:47 . 2011-07-07 12:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-07-06 16:47 . 2011-05-29 07:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-07-05 14:16 . 2011-07-05 14:17 -------- d-----w- c:\programdata\rukohay

2011-07-05 13:55 . 2011-07-05 13:56 -------- d-----w- c:\programdata\paporor

2011-07-05 13:54 . 2011-07-06 01:22 -------- d-----w- c:\programdata\bozagud

2011-07-02 20:54 . 2011-07-02 20:54 -------- d-----w- c:\program files\GNU

2011-07-02 20:54 . 2011-07-02 20:54 -------- d-----w- c:\program files\CoreAAC

2011-07-02 20:51 . 2011-07-02 20:52 -------- d-----w- c:\users\Administrator

2011-07-02 20:51 . 2011-07-05 13:46 -------- d-----w- c:\program files\GRETECH

2011-07-02 20:41 . 2011-07-02 20:41 -------- d-----w- c:\program files\Webteh

2011-07-02 16:28 . 2011-07-02 16:59 -------- d-----w- c:\program files\VLC

2011-07-02 16:07 . 2011-07-02 16:07 -------- d-----w- c:\users\Gary\AppData\Local\DDMSettings

2011-07-02 10:28 . 2011-07-02 10:28 -------- d-sh--w- c:\windows\system32\AI_RecycleBin

2011-07-02 10:28 . 2011-07-02 10:28 -------- d-----w- c:\programdata\W3i

2011-07-02 10:28 . 2011-07-02 10:28 -------- d-----w- c:\program files\W3i

2011-06-30 16:44 . 2011-07-02 16:29 -------- d-----w- c:\program files\Xvid

2011-06-30 09:42 . 2011-04-29 15:59 276992 ----a-w- c:\windows\system32\schannel.dll

2011-06-28 13:59 . 2011-06-28 13:59 -------- d-----w- c:\programdata\HP Product Assistant

2011-06-20 15:55 . 2011-04-14 16:26 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll

2011-06-16 15:41 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-06-16 15:41 . 2011-04-25 15:29 141104 ----a-w- c:\program files\Internet Explorer\sqmapi.dll

2011-06-16 15:41 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\system32\jscript9.dll

2011-06-16 15:37 . 2011-04-14 14:59 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys

2011-06-16 15:37 . 2011-04-21 13:58 273408 ----a-w- c:\windows\system32\drivers\afd.sys

2011-06-16 15:37 . 2011-04-29 13:25 146432 ----a-w- c:\windows\system32\drivers\srv2.sys

2011-06-16 15:37 . 2011-04-29 13:25 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys

2011-06-16 15:37 . 2010-12-20 16:35 563712 ----a-w- c:\windows\system32\oleaut32.dll

2011-06-16 15:36 . 2011-05-02 12:02 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat

2011-06-16 15:36 . 2011-05-02 17:16 739328 ----a-w- c:\windows\system32\inetcomm.dll

2011-06-16 15:35 . 2011-04-29 13:24 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys

2011-06-16 15:35 . 2011-04-29 13:24 79872 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys

2011-06-16 15:35 . 2011-04-29 13:24 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-06-15 07:33 . 2011-07-02 16:40 -------- d-----w- c:\users\Gary\AppData\Roaming\vlc

2011-06-15 07:32 . 2011-07-02 16:33 -------- d-----w- c:\program files\VideoLAN

2011-06-15 07:29 . 2011-06-15 07:31 19657194 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\vlc-1.1.4-win32.exe

2011-06-14 18:03 . 2011-06-14 18:03 -------- d-----w- c:\program files\hjsplit

2011-06-14 12:22 . 2011-06-14 12:22 -------- d-----w- c:\users\Gary\AppData\Roaming\ATI

2011-06-14 12:22 . 2011-06-14 12:22 -------- d-----w- c:\users\Gary\AppData\Local\ATI

2011-06-14 12:22 . 2011-06-14 12:22 -------- d-----w- c:\programdata\ATI

2011-06-14 12:17 . 2011-06-14 12:17 0 ----a-w- c:\windows\ativpsrm.bin

2011-06-14 10:17 . 2011-06-14 10:22 -------- d-----w- c:\users\Gary\AppData\Local\Deployment

2011-06-14 10:17 . 2011-06-14 10:17 -------- d-----w- c:\users\Gary\AppData\Local\Apps

2011-06-14 08:45 . 2011-06-14 08:45 -------- d-----w- c:\users\Gary\AppData\Local\ElevatedDiagnostics

2011-06-14 08:43 . 2011-06-14 08:43 -------- d-----w- c:\program files\Microsoft ATS

2011-06-14 08:42 . 2011-06-14 08:42 554264 ----a-w- c:\program files\Mats_Run.power.exe

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-06-25 09:15 . 2011-05-20 10:42 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-06-10 21:41 . 2011-06-10 21:41 86544 ----a-w- c:\windows\system32\drivers\bckd.sys

2011-06-09 11:24 . 2011-06-09 11:24 1110476 ----a-w- c:\program files\7z920.exe

2011-06-07 15:55 . 2010-12-24 11:48 7074640 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-06-06 19:14 . 2011-06-06 19:11 20388104 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\DivXWebPlayerBetaInstaller.exe

2011-06-04 17:53 . 2011-06-04 17:53 2652884 ----a-w- c:\program files\ac3filter_1_62b.exe

2011-06-02 18:16 . 2011-06-02 18:16 1448993 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\wrar401.exe

2011-06-02 17:53 . 2011-06-02 17:53 94208 ----a-w- c:\windows\system32\dpl100.dll

2011-05-31 14:05 . 2011-05-31 14:05 327752 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\ChannelFilmsInstaller.exe

2011-05-27 08:41 . 2011-05-27 08:41 6140360 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\megakey.exe

2011-05-20 10:40 . 2011-05-20 10:39 3081376 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\install_flash_player(1).exe

2011-05-11 20:53 . 2011-05-11 20:53 2010888 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\iLividSetupV1.exe

2011-05-10 07:36 . 2011-05-10 07:35 7354435 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\FotoSketcher.exe

2011-05-08 16:36 . 2011-05-08 16:35 915296 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\DivXInstaller.exe

2011-05-07 13:28 . 2011-05-07 13:27 2832544 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\install_flash_player.exe

2011-05-05 06:09 . 2011-05-05 06:08 4157856 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\GarminMapUpdater_v2.6.8.exe

2011-04-28 18:29 . 2011-04-28 18:27 12855600 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\yahoo_firefox_4.0-rc2_setup_au.exe

2011-04-27 07:04 . 2011-04-27 07:02 30459048 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\asc4-setup-cnet.exe

2011-04-24 08:21 . 2010-06-24 09:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2011-04-16 08:13 . 2011-04-16 08:10 38147376 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\QuickTimeInstaller.exe

2011-04-13 08:53 . 2011-04-13 08:53 299288 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\GmailInstaller.exe

2011-04-14 16:26 . 2011-06-20 15:55 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312]

.

[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{77F4E711-789B-447F-9614-96759B2F83C6}]

2011-05-27 08:43 64000 ----a-w- c:\users\Gary\AppData\Local\Megamedia\Megakey\MegaIeHelper.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2011-05-17 11:29 1490312 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]

@="{747E722C-CB46-4a9d-BDFE-192AAD5099B1}"

[HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4a9d-BDFE-192AAD5099B1}]

2010-09-28 08:58 3412792 ----a-w- c:\program files\MozyHome\mozyshell.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]

@="{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}"

[HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}]

2010-09-28 08:58 3412792 ----a-w- c:\program files\MozyHome\mozyshell.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]

"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]

"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 61440]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-05-29 1047656]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]

.

c:\users\Gary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote Table Of Contents.onetoc2 [2011-6-7 3656]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer6"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]

backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup

backupExtension=.CommonStartup

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Google Updater.lnk]

backup=c:\windows\pss\Google Updater.lnk.CommonStartup

backupExtension=.CommonStartup

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Google Updater.lnk

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup

backupExtension=.CommonStartup

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^MozyHome Status.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\MozyHome Status.lnk

backup=c:\windows\pss\MozyHome Status.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PHOTOfunSTUDIO -viewer-.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\PHOTOfunSTUDIO -viewer-.lnk

backup=c:\windows\pss\PHOTOfunSTUDIO -viewer-.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickSet.lnk]

backup=c:\windows\pss\QuickSet.lnk.CommonStartup

backupExtension=.CommonStartup

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickSet.lnk

.

[HKLM\~\startupfolder\C:^Users^Barb^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Easy Notification.lnk]

path=c:\users\Barb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Easy Notification.lnk

backup=c:\windows\pss\Easy Notification.lnk.Startup

backupExtension=.Startup

.

[HKLM\~\startupfolder\C:^Users^Barb^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ePrompter.lnk]

path=c:\users\Barb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ePrompter.lnk

backup=c:\windows\pss\ePrompter.lnk.Startup

backupExtension=.Startup

.

[HKLM\~\startupfolder\C:^Users^Barb^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]

path=c:\users\Barb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk

backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup

backupExtension=.Startup

.

[HKLM\~\startupfolder\C:^Users^Barb^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]

backup=c:\windows\pss\OpenOffice.org 3.0.lnk.Startup

backupExtension=.Startup

path=c:\users\Barb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk

.

[HKLM\~\startupfolder\C:^Users^Barb^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^SAM.lnk]

path=c:\users\Barb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SAM.lnk

backup=c:\windows\pss\SAM.lnk.Startup

backupExtension=.Startup

.

[HKLM\~\startupfolder\C:^Users^Gary^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]

path=c:\users\Gary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk

backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup

backupExtension=.Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-10-03 03:08 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApnUpdater]

2011-05-17 11:29 395144 ----a-w- c:\program files\Ask.com\Updater\Updater.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]

2007-12-08 12:34 3444736 ----a-w- c:\windows\System32\WLTRAY.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]

2011-03-21 18:56 1230704 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

2011-04-12 08:10 136176 ----atw- c:\users\Gary\AppData\Local\Google\Update\GoogleUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]

2008-10-25 09:44 31072 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

2007-10-14 19:17 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstallIQUpdater]

2011-06-22 11:34 2408448 ----a-w- c:\program files\W3i\InstallIQUpdater\InstallIQUpdater.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

2006-10-03 03:35 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

2006-10-03 03:37 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Megakey]

2011-05-27 08:43 2593280 ----a-w- c:\users\Gary\AppData\Local\Megamedia\Megakey\Megakey.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MegakeyUpdater]

2011-05-27 08:43 64000 ----a-w- c:\users\Gary\AppData\Local\Megamedia\Megakey\MegakeyUpdater.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

2010-11-10 00:54 4240760 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]

2009-06-23 01:37 745472 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PcSync2.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]

2009-06-25 05:12 1414144 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]

2006-10-20 09:23 118784 ----a-w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]

2006-11-02 12:34 1196032 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]

2007-09-13 12:44 405504 ----a-w- c:\program files\Sigmatel\C-Major Audio\WDM\sttray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

2011-04-18 15:30 15146376 ----a-r- c:\program files\Skype\Phone\Skype.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-04-16 02:30 148888 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]

2011-06-11 11:03 2424192 ----a-w- c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]

2006-11-20 17:51 815104 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]

2006-11-02 12:33 1004136 ----a-w- c:\program files\Windows Defender\MSASCui.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]

2006-11-02 12:34 201728 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\yojomel]

2011-04-05 14:16 923648 --sha-w- c:\programdata\rukohay\rukohay.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{0228e555-4f9c-4e35-a3ec-b109a192b4c2}]

2005-07-15 21:48 479232 ----a-w- c:\program files\Google\Gmail Notifier\gnotify.exe

.

R1 fsacciis;fsacciis;c:\windows\system32\drivers\fsacciis.sys [x]

R1 MpKsl721c7d55;MpKsl721c7d55;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1B3EFF03-70A6-4B6A-B1DF-5BB9DFC6909A}\MpKsl721c7d55.sys [x]

R1 MpKsle8d8f78d;MpKsle8d8f78d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18CB7924-4BDF-4DB3-A50E-2114F022C0D8}\MpKsle8d8f78d.sys [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 wappstackApache;wappstackApache;c:\progra~1\BITNAM~2\apache2\bin\httpd.exe [2010-10-17 20549]

R2 wappstackPostgreSQL;wappstackPostgreSQL;C:/PROGRA~1/BITNAM~2/POSTGR~1/bin/pg_ctl.exe runservice -N wappstackPostgreSQL -D C:/PROGRA~1/BITNAM~2/POSTGR~1/data [x]

R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 84832]

R3 bsusbser;Basecom USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\bsusbser.sys [x]

R3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys [x]

R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [x]

R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [2010-05-20 30576]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]

S1 bckd;bckd;c:\windows\system32\drivers\bckd.sys [2011-06-10 86544]

S1 MpKsl0f2b2235;MpKsl0f2b2235;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{60D1805F-E8E4-43DF-A3DA-3C2446E6FA00}\MpKsl0f2b2235.sys [2011-07-11 28752]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]

S2 bckwfs;Blue Coat K9 Web Protection;c:\program files\Blue Coat K9 Web Protection\k9filter.exe [2011-06-10 1575184]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]

S2 postgresqlPostgreSQL;postgresqlPostgreSQL;C:/PROGRA~1/BITNAM~2/POSTGR~1/bin/pg_ctl.exe runservice -N postgresqlPostgreSQL -D C:/PROGRA~1/BITNAM~2/POSTGR~1/data [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-05-29 22712]

S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]

.

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - 15250999

*NewlyCreated* - FXLDAPOD

*NewlyCreated* - MPKSL0F2B2235

*NewlyCreated* - MPKSLE808F833

*Deregistered* - 15250999

*Deregistered* - eeCtrl

*Deregistered* - fxldapod

*Deregistered* - klbg

*Deregistered* - KLIF

*Deregistered* - MpKsle808f833

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Contents of the 'Scheduled Tasks' folder

.

2011-07-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2958332866-2026460733-2266450084-1005Core.job

- c:\users\Gary\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-12 08:10]

.

2011-07-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2958332866-2026460733-2266450084-1005UA.job

- c:\users\Gary\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-12 08:10]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.usatoday.com/

uInternet Settings,ProxyServer = http=127.0.0.1:63111

IE: Capture Web Page - c:\users\Gary\AppData\Local\Megamedia\Megakey\CaptureWebPage.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

IE: Fetch to Megaupload - c:\users\Gary\AppData\Local\Megamedia\Megakey\MegaUpload.htm

LSP: c:\programdata\Megamedia\Megakey\msadm.dll

Trusted Zone: garmin.com

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\wd6t9fi5.default\

FF - prefs.js: browser.search.selectedEngine - Ask.com

FF - prefs.js: browser.startup.homepage - hxxp://www.usatoday.com/

FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=FKR&o=100000013&locale=en_FR&apn_uid=a070c667-a2ef-4ea0-baf4-8473914551ba&apn_ptnrs=2T&apn_sauid=53DAF7D5-5107-4ED7-AD15-13701CBBC70E&apn_dtid=YYYYYYYYFR&q=

FF - prefs.js: network.proxy.type - 0

.

- - - - ORPHANS REMOVED - - - -

.

URLSearchHooks-{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - (no file)

Toolbar-Locked - (no file)

HKLM-Run-hpqSRMon - (no file)

MSConfigStartUp-Ad-Watch - c:\program files\Lavasoft\Ad-Aware\AAWTray.exe

MSConfigStartUp-Adobe ARM - c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

MSConfigStartUp-Adobe Photo Downloader - c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

MSConfigStartUp-AdobeCS4ServiceManager - c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe

MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe

MSConfigStartUp-Chrysanth Email Notifier - c:\program files\Chrysanth\NETime\Email Notifier\CSMailManager.exe

MSConfigStartUp-conhost - c:\users\Gary\AppData\Roaming\Microsoft\conhost.exe

MSConfigStartUp-DellSupport - c:\program files\DellSupport\DSAgnt.exe

MSConfigStartUp-Escritorio movistar - c:\program files\Movistar\Escritorio movistar\EMMSN.exe

MSConfigStartUp-FileBack PC - c:\progra~1\FILEBA~1\FileBack.exe

MSConfigStartUp-Free Download Manager - c:\program files\Free Download Manager\fdm.exe

MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe

MSConfigStartUp-osCheck - c:\program files\Norton Internet Security\osCheck.exe

MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\QTTask.exe

MSConfigStartUp-Uniblue SpeedUpMyPC - c:\program files\Uniblue\SpeedUpMyPC\SpeedUpMyPC.exe

AddRemove-E8A6D621B6D3FC5D43C68C549D959DE76EEF5D84 - c:\progra~1\DIFX\270581355A767BF1\dpinst.exe

AddRemove-F779F5541ABD99C95C03B0FD5E3C058B22DA0FF7 - c:\progra~1\DIFX\270581355A767BF1\dpinst.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-07-11 17:30

Windows 6.0.6002 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\postgresqlPostgreSQL]

"ImagePath"="C:/PROGRA~1/BITNAM~2/POSTGR~1/bin/pg_ctl.exe runservice -N \"postgresqlPostgreSQL\" -D \"C:/PROGRA~1/BITNAM~2/POSTGR~1/data\""

--

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wappstackPostgreSQL]

"ImagePath"="C:/PROGRA~1/BITNAM~2/POSTGR~1/bin/pg_ctl.exe runservice -N \"wappstackPostgreSQL\" -D \"C:/PROGRA~1/BITNAM~2/POSTGR~1/data\""

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\postgresqlPostgreSQL]

"ImagePath"="C:/PROGRA~1/BITNAM~2/POSTGR~1/bin/pg_ctl.exe runservice -N \"postgresqlPostgreSQL\" -D \"C:/PROGRA~1/BITNAM~2/POSTGR~1/data\""

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wappstackPostgreSQL]

"ImagePath"="C:/PROGRA~1/BITNAM~2/POSTGR~1/bin/pg_ctl.exe runservice -N \"wappstackPostgreSQL\" -D \"C:/PROGRA~1/BITNAM~2/POSTGR~1/data\""

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]

@DACL=(02 0000)

"Installed"="1"

@=""

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]

@DACL=(02 0000)

"NoChange"="1"

"Installed"="1"

@=""

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]

@DACL=(02 0000)

"Installed"="1"

@=""

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*]

"OODEFRAG11.00.00.01WORKSTATION"="85B6D6D58E1FF206F1F52E2C13842E354D08F87C8717B8085A3536B5CA331B796572F0F9B60DF0A4DF991B85646C25FBC8AAB7293C7A0C8DE128DCD6D8A1C64C3EFBFCBC31FEF60115E97F6B9ED9C1AEEC1BB615AB3AA79E12B293D4330127EDE4F3B40BD218323269F946C7ABB4EE2CB77C2B43F09FD207AEA7F86BCA9981B00102C7F902C404B48AE14AA68726CBB8FB78BD58C0360973CDE0A5F5A678CC4910CD583FB93181E77BBB5A36C11F2A7CE1388B9B5D4DF876DD3A2478E0FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D1407A2D97226D213B555A6171C11EC38DE3D061509460847F9E8B891084BE430F9F88B770284BD256ACF5100B7F6343D936241C391C3E034A48247D7DE5EAFE4BC445EAA2A1E4017832981BA9F8A611CD727AB1E778E953A877063D2FCE8A5681B1D5A6525F9CE5D30141C66A7DBF4ECE0D0CBAB3B46682DC370F5684ECC3C7CF015E88EE3E330C7A315A9856D3925AA5BF9EC2E415F21561D532A361F43EBD7BB5537BDBCF5AD18B4CAF84D6D43AB4596D51E16D39E0EF37CFE710AA05731239C15B740EA2114075F629CA68CF1C8218626B20B9C21FA35F0EAFEE8E7690D7D5BA39D168B2C35BCC01F6A30138CBC17C34440662E53BE40A826CB896F2C04F9DE646373222EE8DA1C597CBA2B32D072899CA4B7FA782FAE79D1925793291F1DB64C45C094158574D97BB14BE3534DF3B82E7D41DDA7280CDDA2D4F1953AE9E09465C59B2DA06B8E8385AA1DB13803CDD38F2EF910CC0A5A71E2572D1C1076B34FCF29D39AE5F9A5C70ACE1C6A78C2A903E6DD0B35A4B88E73ED2090AF2E58F75FBBF76E6FCC99A97A30C76ACB82642493F077D350C21A91CB367DD6BE6DA803E3F000A2A294B17A923504DDF398C2CA74FEAA67490F1CBF02417DF09877831F1DC852DF0DCBAF722AE5367F66503BA3B873698B6D432C6B43A8F581F44E8A0BF231C4C26ED7075A00A5538C0A9332271A49ECBB6C6DBFD8DF19FDDF6BC462F76E2E6FA2E7F1AC73F7ED95F62B1F0CBEF28A2FA5DA724EC0CCD3F2187A82B28B3C5430068126996E98C77CE47885B5CCC258EEABB007D150A3AD74E98204286030CEA82CA3564C738DD448AE85AC1DA4AFE630E3CBB64B29A090E5C7CA977505BFDBBC039EB5C61DA3C58163CACE340F007E391BEAE03EDF25796F5A7BE2CBFA044C95B0244E8CFA4F637042227871C620FB164D34B6B27EB57AFE7CA1DB67B8BB89218DCA7CA910270823C2CA0C50FB9FCD152E2E41B37FFB3742BD2ECE82A7488A11A48BF0AAD2E5A4EC0F6ABE5053B2F9C9A44659D056C36BAFE278DC5E26AF5FD838C631A12F6BBAE381069CF1E431188B4A4DAE1E687EE17EE0B87840059BAA33BBBD"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000001

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'Explorer.exe'(5228)

c:\program files\MozyHome\mozyshell.dll

c:\program files\MozyHome\LIBEAY32.dll

.

Completion time: 2011-07-11 17:35:25

ComboFix-quarantined-files.txt 2011-07-11 15:35

.

Pre-Run: 5,021,110,272 bytes free

Post-Run: 6,523,977,728 bytes free

.

- - End Of File - - 29BA70C9A01B7C3CADC91F2A363D927E

Security Check

Results of screen317's Security Check version 0.99.17

Windows Vista Service Pack 2 (UAC is enabled)

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Enabled!

Microsoft Security Essentials

WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

Java 6 Update 13

Java SE Runtime Environment 6

Java 6 Update 3

Java 6 Update 5

Java 6 Update 7

Out of date Java installed!

Adobe Flash Player 10.3.181.26

Mozilla Firefox (x86 en-US..)

````````````````````````````````

Process Check:

objlist.exe by Laurent

Windows Defender MSMpEng.exe

Malwarebytes' Anti-Malware mbamservice.exe

Malwarebytes' Anti-Malware mbamgui.exe

Microsoft Security Essentials msseces.exe

``````````End of Log````````````

Link to post
Share on other sites

Thanks for your response. I just wanted to mention, that since posting Vista came up with a message saying it had blocked some programs, though I couldn't tell what they were. After this the Antivirus Plus popups stopped and the PC is running as it should. I don't know if this means vista has taken care of anything. I have followed you instructions and the log files follow. Tdskiller didn't find anything, but I have run this before, following some instructions I found elsewhere on the internet, but I'll post the log anyway.

We still have some more cleanup to do ;):

First, please BackupYour Registry with ERUNT

  • Please go here, scroll down to ERUNT, and download.
  • For version with the Installer:
    Use the setup program to install ERUNT on your computer
  • For the zipped version:
    Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your Registry to the folder of your choice.

Note: To restore your Registry, go to the folder and start ERDNT.exe

-------

Please do the following:

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

KILLALL::

Reglock::

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

Regnull::

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*]

Driver::

15250999

fsacciis

File::

C:\windows\system32\drivers\15250999.sys

c:\windows\system32\drivers\fsacciis.sys

c:\programdata\rukohay\rukohay.dll

Folder::

c:\programdata\rukohay

c:\programdata\paporor

c:\programdata\bozagud

Save this as CFScript.txt, in the same location as ComboFix.exe

CFScriptB-4.gif

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I shall require in your next reply.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

Please include the newly-created C:\ComboFix.txt in your next reply, and let me know how things are running now ;)

Link to post
Share on other sites

I tried running combofix according to your instructions but it stopped at the following point, and even though I left it running overnight, still nothing happened and I had to power the laptop off forcibly to get rid of it.

"This typically doesn't take more than 10 minutes...."

Link to post
Share on other sites

Let's try running ComboFix in Safe Mode:

Please reboot to Safe Mode (tap the F8 key just before Windows starts to load and select the Safe Mode option from the menu).

Once you are in Safe Mode, please locate the CFScript.txt on your Desktop, and drag it onto ComboFix.exe. Please post the log that it creates in your next reply ;)

Link to post
Share on other sites

Log file follows

ComboFix 11-07-12.04 - Gary 07/12/2011 19:40:20.2.2 - x86 MINIMAL

Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.61.1033.18.2685.2180 [GMT 2:00]

Running from: c:\users\Gary\Desktop\ComboFix.exe

Command switches used :: c:\users\Gary\Desktop\CFScript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\programdata\rukohay\rukohay.dll"

"c:\windows\system32\drivers\15250999.sys"

"c:\windows\system32\drivers\fsacciis.sys"

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\bozagud

c:\programdata\paporor

c:\programdata\paporor\berewej.ico

c:\programdata\paporor\paporor.dll

c:\programdata\paporor\paporor.dll.manifest

c:\programdata\rukohay

c:\programdata\rukohay\berewej.ico

c:\programdata\rukohay\rukohay.dll

c:\programdata\rukohay\rukohay.dll.manifest

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_15250999

-------\Service_fsacciis

.

.

((((((((((((((((((((((((( Files Created from 2011-06-12 to 2011-07-12 )))))))))))))))))))))))))))))))

.

.

2011-07-12 17:51 . 2011-07-12 17:54 -------- d-----w- c:\users\Gary\AppData\Local\temp

2011-07-12 17:51 . 2011-07-12 17:51 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-07-12 13:21 . 2011-06-07 15:55 7074640 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AA263DEF-5CDC-47EF-B765-7A2D8E716533}\mpengine.dll

2011-07-06 16:47 . 2011-05-29 07:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-07-06 16:47 . 2011-07-07 12:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-07-06 16:47 . 2011-05-29 07:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-07-02 20:54 . 2011-07-02 20:54 -------- d-----w- c:\program files\GNU

2011-07-02 20:54 . 2011-07-02 20:54 -------- d-----w- c:\program files\CoreAAC

2011-07-02 20:51 . 2011-07-02 20:52 -------- d-----w- c:\users\Administrator

2011-07-02 20:51 . 2011-07-05 13:46 -------- d-----w- c:\program files\GRETECH

2011-07-02 20:41 . 2011-07-02 20:41 -------- d-----w- c:\program files\Webteh

2011-07-02 16:28 . 2011-07-02 16:59 -------- d-----w- c:\program files\VLC

2011-07-02 16:07 . 2011-07-02 16:07 -------- d-----w- c:\users\Gary\AppData\Local\DDMSettings

2011-07-02 10:28 . 2011-07-02 10:28 -------- d-sh--w- c:\windows\system32\AI_RecycleBin

2011-07-02 10:28 . 2011-07-02 10:28 -------- d-----w- c:\programdata\W3i

2011-07-02 10:28 . 2011-07-02 10:28 -------- d-----w- c:\program files\W3i

2011-06-30 16:44 . 2011-07-02 16:29 -------- d-----w- c:\program files\Xvid

2011-06-30 09:42 . 2011-04-29 15:59 276992 ----a-w- c:\windows\system32\schannel.dll

2011-06-28 13:59 . 2011-06-28 13:59 -------- d-----w- c:\programdata\HP Product Assistant

2011-06-20 15:55 . 2011-04-14 16:26 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll

2011-06-16 15:41 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-06-16 15:41 . 2011-04-25 15:29 141104 ----a-w- c:\program files\Internet Explorer\sqmapi.dll

2011-06-16 15:41 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\system32\jscript9.dll

2011-06-16 15:37 . 2011-04-14 14:59 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys

2011-06-16 15:37 . 2011-04-21 13:58 273408 ----a-w- c:\windows\system32\drivers\afd.sys

2011-06-16 15:37 . 2011-04-29 13:25 146432 ----a-w- c:\windows\system32\drivers\srv2.sys

2011-06-16 15:37 . 2011-04-29 13:25 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys

2011-06-16 15:37 . 2010-12-20 16:35 563712 ----a-w- c:\windows\system32\oleaut32.dll

2011-06-16 15:36 . 2011-05-02 12:02 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat

2011-06-16 15:36 . 2011-05-02 17:16 739328 ----a-w- c:\windows\system32\inetcomm.dll

2011-06-16 15:35 . 2011-04-29 13:24 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys

2011-06-16 15:35 . 2011-04-29 13:24 79872 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys

2011-06-16 15:35 . 2011-04-29 13:24 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-06-15 07:33 . 2011-07-02 16:40 -------- d-----w- c:\users\Gary\AppData\Roaming\vlc

2011-06-15 07:32 . 2011-07-02 16:33 -------- d-----w- c:\program files\VideoLAN

2011-06-15 07:29 . 2011-06-15 07:31 19657194 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\vlc-1.1.4-win32.exe

2011-06-14 18:03 . 2011-06-14 18:03 -------- d-----w- c:\program files\hjsplit

2011-06-14 12:22 . 2011-06-14 12:22 -------- d-----w- c:\users\Gary\AppData\Roaming\ATI

2011-06-14 12:22 . 2011-06-14 12:22 -------- d-----w- c:\users\Gary\AppData\Local\ATI

2011-06-14 12:22 . 2011-06-14 12:22 -------- d-----w- c:\programdata\ATI

2011-06-14 12:17 . 2011-06-14 12:17 0 ----a-w- c:\windows\ativpsrm.bin

2011-06-14 10:17 . 2011-06-14 10:22 -------- d-----w- c:\users\Gary\AppData\Local\Deployment

2011-06-14 10:17 . 2011-06-14 10:17 -------- d-----w- c:\users\Gary\AppData\Local\Apps

2011-06-14 08:45 . 2011-06-14 08:45 -------- d-----w- c:\users\Gary\AppData\Local\ElevatedDiagnostics

2011-06-14 08:43 . 2011-06-14 08:43 -------- d-----w- c:\program files\Microsoft ATS

2011-06-14 08:42 . 2011-06-14 08:42 554264 ----a-w- c:\program files\Mats_Run.power.exe

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-06-25 09:15 . 2011-05-20 10:42 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-06-10 21:41 . 2011-06-10 21:41 86544 ----a-w- c:\windows\system32\drivers\bckd.sys

2011-06-09 11:24 . 2011-06-09 11:24 1110476 ----a-w- c:\program files\7z920.exe

2011-06-07 15:55 . 2010-12-24 11:48 7074640 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-06-06 19:14 . 2011-06-06 19:11 20388104 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\DivXWebPlayerBetaInstaller.exe

2011-06-04 17:53 . 2011-06-04 17:53 2652884 ----a-w- c:\program files\ac3filter_1_62b.exe

2011-06-02 18:16 . 2011-06-02 18:16 1448993 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\wrar401.exe

2011-06-02 17:53 . 2011-06-02 17:53 94208 ----a-w- c:\windows\system32\dpl100.dll

2011-05-31 14:05 . 2011-05-31 14:05 327752 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\ChannelFilmsInstaller.exe

2011-05-27 08:41 . 2011-05-27 08:41 6140360 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\megakey.exe

2011-05-20 10:40 . 2011-05-20 10:39 3081376 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\install_flash_player(1).exe

2011-05-11 20:53 . 2011-05-11 20:53 2010888 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\iLividSetupV1.exe

2011-05-10 07:36 . 2011-05-10 07:35 7354435 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\FotoSketcher.exe

2011-05-08 16:36 . 2011-05-08 16:35 915296 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\DivXInstaller.exe

2011-05-07 13:28 . 2011-05-07 13:27 2832544 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\install_flash_player.exe

2011-05-05 06:09 . 2011-05-05 06:08 4157856 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\GarminMapUpdater_v2.6.8.exe

2011-04-28 18:29 . 2011-04-28 18:27 12855600 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\yahoo_firefox_4.0-rc2_setup_au.exe

2011-04-27 07:04 . 2011-04-27 07:02 30459048 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\asc4-setup-cnet.exe

2011-04-24 08:21 . 2010-06-24 09:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2011-04-16 08:13 . 2011-04-16 08:10 38147376 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\QuickTimeInstaller.exe

2011-04-14 16:26 . 2011-06-20 15:55 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312]

.

[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{77F4E711-789B-447F-9614-96759B2F83C6}]

2011-05-27 08:43 64000 ----a-w- c:\users\Gary\AppData\Local\Megamedia\Megakey\MegaIeHelper.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2011-05-17 11:29 1490312 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]

@="{747E722C-CB46-4a9d-BDFE-192AAD5099B1}"

[HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4a9d-BDFE-192AAD5099B1}]

2010-09-28 08:58 3412792 ----a-w- c:\program files\MozyHome\mozyshell.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]

@="{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}"

[HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}]

2010-09-28 08:58 3412792 ----a-w- c:\program files\MozyHome\mozyshell.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]

"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]

"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 61440]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-05-29 1047656]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]

.

c:\users\Gary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote Table Of Contents.onetoc2 [2011-6-7 3656]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer6"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]

backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup

backupExtension=.CommonStartup

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Google Updater.lnk]

backup=c:\windows\pss\Google Updater.lnk.CommonStartup

backupExtension=.CommonStartup

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Google Updater.lnk

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup

backupExtension=.CommonStartup

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^MozyHome Status.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\MozyHome Status.lnk

backup=c:\windows\pss\MozyHome Status.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PHOTOfunSTUDIO -viewer-.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\PHOTOfunSTUDIO -viewer-.lnk

backup=c:\windows\pss\PHOTOfunSTUDIO -viewer-.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickSet.lnk]

backup=c:\windows\pss\QuickSet.lnk.CommonStartup

backupExtension=.CommonStartup

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickSet.lnk

.

[HKLM\~\startupfolder\C:^Users^Barb^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Easy Notification.lnk]

path=c:\users\Barb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Easy Notification.lnk

backup=c:\windows\pss\Easy Notification.lnk.Startup

backupExtension=.Startup

.

[HKLM\~\startupfolder\C:^Users^Barb^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ePrompter.lnk]

path=c:\users\Barb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ePrompter.lnk

backup=c:\windows\pss\ePrompter.lnk.Startup

backupExtension=.Startup

.

[HKLM\~\startupfolder\C:^Users^Barb^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]

path=c:\users\Barb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk

backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup

backupExtension=.Startup

.

[HKLM\~\startupfolder\C:^Users^Barb^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]

backup=c:\windows\pss\OpenOffice.org 3.0.lnk.Startup

backupExtension=.Startup

path=c:\users\Barb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk

.

[HKLM\~\startupfolder\C:^Users^Barb^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^SAM.lnk]

path=c:\users\Barb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SAM.lnk

backup=c:\windows\pss\SAM.lnk.Startup

backupExtension=.Startup

.

[HKLM\~\startupfolder\C:^Users^Gary^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]

path=c:\users\Gary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk

backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup

backupExtension=.Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-10-03 03:08 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApnUpdater]

2011-05-17 11:29 395144 ----a-w- c:\program files\Ask.com\Updater\Updater.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]

2007-12-08 12:34 3444736 ----a-w- c:\windows\System32\WLTRAY.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]

2011-03-21 18:56 1230704 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

2011-04-12 08:10 136176 ----atw- c:\users\Gary\AppData\Local\Google\Update\GoogleUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]

2008-10-25 09:44 31072 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

2007-10-14 19:17 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstallIQUpdater]

2011-06-22 11:34 2408448 ----a-w- c:\program files\W3i\InstallIQUpdater\InstallIQUpdater.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

2006-10-03 03:35 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

2006-10-03 03:37 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Megakey]

2011-05-27 08:43 2593280 ----a-w- c:\users\Gary\AppData\Local\Megamedia\Megakey\Megakey.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MegakeyUpdater]

2011-05-27 08:43 64000 ----a-w- c:\users\Gary\AppData\Local\Megamedia\Megakey\MegakeyUpdater.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

2010-11-10 00:54 4240760 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]

2009-06-23 01:37 745472 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PcSync2.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]

2009-06-25 05:12 1414144 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]

2006-10-20 09:23 118784 ----a-w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]

2006-11-02 12:34 1196032 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]

2007-09-13 12:44 405504 ----a-w- c:\program files\Sigmatel\C-Major Audio\WDM\sttray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

2011-04-18 15:30 15146376 ----a-r- c:\program files\Skype\Phone\Skype.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-04-16 02:30 148888 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]

2011-06-11 11:03 2424192 ----a-w- c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]

2006-11-20 17:51 815104 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]

2006-11-02 12:33 1004136 ----a-w- c:\program files\Windows Defender\MSASCui.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]

2006-11-02 12:34 201728 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{0228e555-4f9c-4e35-a3ec-b109a192b4c2}]

2005-07-15 21:48 479232 ----a-w- c:\program files\Google\Gmail Notifier\gnotify.exe

.

R1 MpKsl721c7d55;MpKsl721c7d55;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1B3EFF03-70A6-4B6A-B1DF-5BB9DFC6909A}\MpKsl721c7d55.sys [x]

R1 MpKsle8d8f78d;MpKsle8d8f78d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18CB7924-4BDF-4DB3-A50E-2114F022C0D8}\MpKsle8d8f78d.sys [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 wappstackPostgreSQL;wappstackPostgreSQL;C:/PROGRA~1/BITNAM~2/POSTGR~1/bin/pg_ctl.exe runservice -N wappstackPostgreSQL -D C:/PROGRA~1/BITNAM~2/POSTGR~1/data [x]

R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 84832]

R3 bsusbser;Basecom USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\bsusbser.sys [x]

R3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys [x]

R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [x]

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]

R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [2010-05-20 30576]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]

S1 bckd;bckd;c:\windows\system32\drivers\bckd.sys [2011-06-10 86544]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]

S2 bckwfs;Blue Coat K9 Web Protection;c:\program files\Blue Coat K9 Web Protection\k9filter.exe [2011-06-10 1575184]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]

S2 postgresqlPostgreSQL;postgresqlPostgreSQL;C:/PROGRA~1/BITNAM~2/POSTGR~1/bin/pg_ctl.exe runservice -N postgresqlPostgreSQL -D C:/PROGRA~1/BITNAM~2/POSTGR~1/data [x]

S2 wappstackApache;wappstackApache;c:\progra~1\BITNAM~2\apache2\bin\httpd.exe [2010-10-17 20549]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-05-29 22712]

.

.

--- Other Services/Drivers In Memory ---

.

*Deregistered* - eeCtrl

*Deregistered* - klbg

*Deregistered* - KLIF

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Contents of the 'Scheduled Tasks' folder

.

2011-07-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2958332866-2026460733-2266450084-1005Core.job

- c:\users\Gary\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-12 08:10]

.

2011-07-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2958332866-2026460733-2266450084-1005UA.job

- c:\users\Gary\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-12 08:10]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.usatoday.com/

uInternet Settings,ProxyServer = http=127.0.0.1:63111

IE: Capture Web Page - c:\users\Gary\AppData\Local\Megamedia\Megakey\CaptureWebPage.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

IE: Fetch to Megaupload - c:\users\Gary\AppData\Local\Megamedia\Megakey\MegaUpload.htm

LSP: c:\programdata\Megamedia\Megakey\msadm.dll

Trusted Zone: garmin.com

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\wd6t9fi5.default\

FF - prefs.js: browser.search.selectedEngine - Ask.com

FF - prefs.js: browser.startup.homepage - hxxp://www.usatoday.com/

FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=FKR&o=100000013&locale=en_FR&apn_uid=a070c667-a2ef-4ea0-baf4-8473914551ba&apn_ptnrs=2T&apn_sauid=53DAF7D5-5107-4ED7-AD15-13701CBBC70E&apn_dtid=YYYYYYYYFR&q=

FF - prefs.js: network.proxy.type - 0

.

- - - - ORPHANS REMOVED - - - -

.

MSConfigStartUp-yojomel - c:\programdata\rukohay\rukohay.dll

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-07-12 19:54

Windows 6.0.6002 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\postgresqlPostgreSQL]

"ImagePath"="C:/PROGRA~1/BITNAM~2/POSTGR~1/bin/pg_ctl.exe runservice -N \"postgresqlPostgreSQL\" -D \"C:/PROGRA~1/BITNAM~2/POSTGR~1/data\""

--

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wappstackPostgreSQL]

"ImagePath"="C:/PROGRA~1/BITNAM~2/POSTGR~1/bin/pg_ctl.exe runservice -N \"wappstackPostgreSQL\" -D \"C:/PROGRA~1/BITNAM~2/POSTGR~1/data\""

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\postgresqlPostgreSQL]

"ImagePath"="C:/PROGRA~1/BITNAM~2/POSTGR~1/bin/pg_ctl.exe runservice -N \"postgresqlPostgreSQL\" -D \"C:/PROGRA~1/BITNAM~2/POSTGR~1/data\""

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wappstackPostgreSQL]

"ImagePath"="C:/PROGRA~1/BITNAM~2/POSTGR~1/bin/pg_ctl.exe runservice -N \"wappstackPostgreSQL\" -D \"C:/PROGRA~1/BITNAM~2/POSTGR~1/data\""

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'Explorer.exe'(5504)

c:\program files\MozyHome\mozyshell.dll

c:\program files\MozyHome\LIBEAY32.dll

c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll

c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL

c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr

c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe

c:\windows\system32\Ati2evxx.exe

c:\windows\System32\WLTRYSVC.EXE

c:\windows\system32\WLANExt.exe

c:\windows\System32\bcmwltry.exe

c:\windows\system32\Ati2evxx.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

c:\program files\MozyHome\mozybackup.exe

c:\program files\Microsoft LifeCam\MSCamS32.exe

c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

c:\program files\MozyHome\mozybackup.exe

c:\progra~1\BITNAM~2\POSTGR~1\bin\pg_ctl.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\windows\system32\STacSV.exe

c:\progra~1\BITNAM~2\POSTGR~1\bin\postgres.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\progra~1\BITNAM~2\POSTGR~1\bin\postgres.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\windows\system32\WUDFHost.exe

c:\progra~1\BITNAM~2\POSTGR~1\bin\postgres.exe

c:\progra~1\BITNAM~2\POSTGR~1\bin\postgres.exe

c:\progra~1\BITNAM~2\POSTGR~1\bin\postgres.exe

c:\progra~1\BITNAM~2\POSTGR~1\bin\postgres.exe

c:\\?\c:\windows\system32\wbem\WMIADAP.EXE

c:\program files\Windows Media Player\wmpnetwk.exe

.

**************************************************************************

.

Completion time: 2011-07-12 20:01:37 - machine was rebooted

ComboFix-quarantined-files.txt 2011-07-12 18:01

ComboFix2.txt 2011-07-11 15:35

.

Pre-Run: 5,817,159,680 bytes free

Post-Run: 5,757,825,024 bytes free

.

- - End Of File - - 0A532D0C784F9EB426C374A77BB1BAA5

Link to post
Share on other sites

Looking good ;)

Let's run some more scans to see if there's any traces left. Are you experiencing any more symptoms or other irregular behavior?

Please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

  1. Tick the box next to YES, I accept the Terms of Use.
  2. Click Start
  3. When asked, allow the ActiveX control to install
  4. Click Start
  5. Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  6. Click Scan
    Wait for the scan to finish
  7. Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  8. Copy and paste that log as a reply to this topic

-----------

Please use the Internet Explorer and run a BitDefender Online scan from Here

  • Please check I agree with the Terms and Conditions and click Start Here
  • You will need to allow an Active X install for the scan to run.
  • Leave the scanning options at default and click Start Scan

Please post the results in your next reply.

Link to post
Share on other sites

Here they are

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=ea10fedcc9465a4a94acf07a9eb92572

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-07-13 10:24:57

# local_time=2011-07-14 12:24:57 (+0100, W. Europe Daylight Time)

# country="United States"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=5892 16776574 100 100 17549087 148117127 0 0

# compatibility_mode=8192 67108863 100 0 240 240 0 0

# scanned=225396

# found=0

# cleaned=0

# scan_time=11541

Bitdefender

QuickScan Beta 32-bit v0.9.9.96

-------------------------------

Scan date: Thu Jul 14 09:32:34 2011

Machine ID: 68F2F102

No infection found.

-------------------

Processes

---------

2007 Microsoft Office system 4216 C:\program files\Microsoft Office\Office12\WINWORD.EXE

Firefox 5008 C:\program files\Mozilla Firefox\firefox.exe

Firefox 4404 C:\program files\Mozilla Firefox\plugin-container.exe

Microsoft® Windows® Operating System 6100 C:\program files\Windows Media Player\wmpnscfg.exe

Microsoft® Windows® Operating System 5504 C:\windows\explorer.exe

Microsoft® Windows® Operating System 1900 C:\windows\System32\taskeng.exe

Windows® Internet Explorer 1852 C:\program files\Internet Explorer\iexplore.exe

Windows® Internet Explorer 1956 C:\program files\Internet Explorer\iexplore.exe

Windows® Search 4884 C:\windows\System32\SearchProtocolHost.exe

(verified) Microsoft® Windows® Operating System 2060 C:\windows\System32\dwm.exe

(verified) Microsoft® Windows® Operating System 4876 C:\windows\System32\wuauclt.exe

Network activity

----------------

Process iexplore.exe (1852) connected on port 80 (HTTP) --> 195.12.231.17

Process iexplore.exe (1852) connected on port 80 (HTTP) --> 195.12.231.17

Process iexplore.exe (1852) connected on port 80 (HTTP) --> 209.85.146.101

Process iexplore.exe (1852) connected on port 80 (HTTP) --> 209.85.146.101

Process iexplore.exe (1852) connected on port 80 (HTTP) --> 209.85.146.101

Process iexplore.exe (1852) connected on port 80 (HTTP) --> 69.63.189.34

Process iexplore.exe (1852) connected on port 80 (HTTP) --> 69.63.189.34

Process iexplore.exe (1852) connected on port 80 (HTTP) --> 213.248.111.234

Process iexplore.exe (1852) connected on port 80 (HTTP) --> 213.248.111.234

Process firefox.exe (5008) connected on port 443 (HTTP over SSL) --> 66.220.151.76

Process firefox.exe (5008) connected on port 80 (HTTP) --> 195.12.231.35

Process firefox.exe (5008) connected on port 80 (HTTP) --> 74.125.230.88

Process firefox.exe (5008) connected on port 80 (HTTP) --> 195.12.231.35

Process firefox.exe (5008) connected on port 80 (HTTP) --> 195.12.231.35

Process firefox.exe (5008) connected on port 80 (HTTP) --> 74.125.230.88

Autoruns and critical files

---------------------------

hpwuSchd Application C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

Catalyst® Control Center C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

Facebook Update C:\Users\Gary\AppData\Local\Facebook\Update\FacebookUpdate.exe

Gmail C:\Program Files\Google\Gmail Notifier\gnotify.exe

GrooveShellExtensions Module C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

hp digital imaging - hp all-in-one seri C:\program files\HP\Digital Imaging\bin\hpqtra08.exe

Internet Explorer C:\Program Files\Internet Explorer

Malwarebytes' Anti-Malware C:\program files\Malwarebytes' Anti-Malware\mbam.exe

Malwarebytes' Anti-Malware C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

Microsoft LifeCam C:\Program Files\Microsoft LifeCam\LifeExp.exe

Microsoft Security Client c:\Program Files\Microsoft Security Client\msseces.exe

Microsoft® Windows® Operating System C:\program files\Windows Media Player\wmpnscfg.exe

Microsoft® Windows® Operating System C:\Windows\system32\BROWSEUI.dll

Windows® Internet Explorer c:\windows\system32\webcheck.dll

(verified) Google Update C:\Users\Gary\AppData\Local\Google\Update\GoogleUpdate.exe

(verified) Microsoft® Windows® Operating System c:\windows\system32\userinit.exe

Browser plugins

---------------

2007 Microsoft Office system C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL

Bing Bar c:\program files\msn toolbar\platform\6.3.2322.0\npwinext.dll

BitDefender QuickScan C:\windows\Downloaded Program Files\qsax.dll

Browser Address Error Redirector C:\Program Files\BAE\BAE.dll

DivX Plus Web Player HTML5 <video> c:\program files\divx\divx plus web player\ie\divxhtml5\divxhtml5.dll

DivX VOD Helper Plug-in C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll

DivX Web Player C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll

Facebook Video Calling Plugin C:\Users\Gary\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll

Garmin Communicator Plug-In C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\wd6t9fi5.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}\plugins\npGarmin.dll

Google Update C:\Users\Gary\AppData\Local\Google\Update\1.3.21.53\npGoogleUpdate3.dll

GrooveShellExtensions Module C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

HP Smart Web Printing c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll

Java Platform SE 6 U13 C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll

Megakey C:\ProgramData\Megamedia\Megakey\msadm.dll

Megakey C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhhocpdgkjoocfobhdbcfeafckeoiemc\0.6.0.0_0\plugin\npMegaPlugin.dll

Megakey C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhhocpdgkjoocfobhdbcfeafckeoiemc\0.6.0.0_0\plugin\npms.dll

Megakey c:\users\gary\appdata\local\megamedia\megakey\megaiehelper.dll

Microsoft Search Enhancement Pack c:\program files\microsoft\search enhancement pack\search helper\sepsearchhelperie.dll

Microsoft Support Diagnostic Tool C:\Windows\Downloaded Program Files\MSDCode.DLL

Microsoft® CoReXT c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll

Microsoft® Windows Media Player Firefox C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll

Mozilla ActiveX control and plugin supp C:\Program Files\Mozilla Firefox\plugins\npmozax.dll

NPSWF32.dll C:\Windows\system32\Macromed\Flash\NPSWF32.dll

Silverlight Plug-In c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll

Skype Toolbars c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Skype Toolbars C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.5.0.7280_0\npSkypeChromePlugin.dll

Toolbar c:\program files\ask.com\genericasktoolbar.dll

Windows Live Messenger Companion c:\program files\windows live\companion\companioncore.dll

Windows Live Photo Gallery C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

Windows Presentation Foundation c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

Windows® Internet Explorer C:\Windows\system32\IEFRAME.dll

(verified) Adobe Acrobat C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll

(verified) Java Platform SE 6 U13 c:\program files\java\jre6\bin\jp2ssv.dll

(verified) Microsoft® Windows® Operating System C:\Windows\system32\mswsock.dll

(verified) Microsoft® Windows® Operating System C:\Windows\system32\napinsp.dll

(verified) Microsoft® Windows® Operating System C:\Windows\system32\NLAapi.dll

(verified) Microsoft® Windows® Operating System C:\Windows\system32\pnrpnsp.dll

(verified) Microsoft® Windows® Operating System C:\Windows\System32\winrnr.dll

Missing files

-------------

File not found: c:\program files\common files\adobe\acrobat\activex\acroiehelpershim.dll

--> HKLM\Software\Classes\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32\"(default)"

Scan

----

MD5: 5de3eea2224085e520dd7afdc3605df2 C:/PROGRA~1/BITNAM~2/POSTGR~1/bin/pg_ctl.exe

MD5: a277716d0e98115121978c70b011325f c:\program files\ask.com\genericasktoolbar.dll

MD5: c24e0303133512c7eb8c3de44697487a C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll

MD5: 492c24d63daad8ec2bedefa8525d27e5 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiamenu.dll

MD5: 53fd418622b72d709ce92aa8dbfdb0f6 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

MD5: 1a4f60ef6da38621f1091b0cb0fa2c09 C:\Program Files\BAE\BAE.dll

MD5: a49f12b3157b35e221da1c70ad36664a C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe

MD5: 70d7be78061126dd0c3accdb7e129017 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

MD5: 5c88054458e044f1deb77855f6137a25 C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll

MD5: 772c253285e11033d159d87d175f5404 C:\Program Files\Common Files\Microsoft Shared\office12\riched20.dll

MD5: c2b290ce6b81520b96377e890f4c021c C:\Program Files\Common Files\Microsoft Shared\PROOF\1033\MSGR3EN.DLL

MD5: 6bf01e200063d7274f3af06d226671f5 c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll

MD5: 0a70f4022ec2e14c159efc4f69aa2477 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

MD5: a96cf24dce0dbac3c3b80b61fb1c44a7 C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll

MD5: 96af88a09cf6b048dea8c51bd3b4fe0f c:\program files\divx\divx plus web player\ie\divxhtml5\divxhtml5.dll

MD5: 0734c95492371d092367f2f3af794a0d C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll

MD5: 3df7ac30a381c57d0c70eaefee3c4ef2 C:\Program Files\Google\Gmail Notifier\gnotify.exe

MD5: 0a3c6aa4a9fc38c20ba4eac2c3351c05 C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll

MD5: ee4c7a4cf2316701ffde90f404520265 C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll

MD5: cf03c8f6f6b0d71f6e5bce167fcf7ca6 C:\program files\HP\Digital Imaging\bin\hpqtra08.exe

MD5: 4a8a49921534b030b27f16fc68fba1dc c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll

MD5: 062f3db9afa9c3ce0da52f28595c0c6d C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

MD5: a1659e4d08fe8d0f0bc61960d8c0369e C:\Program Files\Internet Explorer\ieproxy.dll

MD5: daab337efa9577364a245d3c6ca8d00c C:\program files\Internet Explorer\IEShims.dll

MD5: 904e13ba41af2e353a32cf351ca53639 C:\program files\Internet Explorer\iexplore.exe

MD5: 2487c45b64790fc210547919f18fac71 C:\program files\Malwarebytes' Anti-Malware\mbam.exe

MD5: f06ca6475b7a538db9dc3f7b896b97e4 C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

MD5: ec60491a5ff57700f10fe0403f7dcad4 C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

MD5: 19be5bf2ff9283894bc0f22322fdf56b C:\Program Files\Microsoft LifeCam\LifeExp.exe

MD5: d98350792a7ce82e7459a7c36481beda C:\Program Files\Microsoft LifeCam\MSCamS32.exe

MD5: 451b004c4ace3b84a75cb982627b5e0c C:\Program Files\Microsoft Office\Office12\1033\GrooveIntlResource.dll

MD5: 11da24e40264b9fcb14b8477e25ed09a C:\Program Files\Microsoft Office\Office12\GrooveUtil.DLL

MD5: 2cf6c76abc6a464375c2ba5097239df1 C:\Program Files\Microsoft Office\OFFICE12\NLSDATA000A.DLL

MD5: 3fbbb520d6204198d26dd7b794659b91 C:\Program Files\Microsoft Office\OFFICE12\NLSLEXICONS000A_SP.dll

MD5: 00acf67cd8b79980b826ab81fe3a960d C:\Program Files\Microsoft Office\OFFICE12\NLSMODELS000A.dll

MD5: 81df1d2312ce980b844a6bc0863fe40f C:\program files\Microsoft Office\Office12\WINWORD.EXE

MD5: e0bf563c97d8a716977cca7cd71d6830 C:\Program Files\Microsoft Office\Office12\wwlib.dll

MD5: 4397a7614d29030465d746176f46b2c3 c:\Program Files\Microsoft Security Client\Antimalware\MpOAv.dll

MD5: 90dc23d940551db35367fb1e40575b25 c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

MD5: c73de53197ac0c4db60b80588f0d54df c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

MD5: 1d6174de4ded26e5d91b9b66e0fe4dac c:\Program Files\Microsoft Security Client\msseces.exe

MD5: c3e42cbf8215171a524d123a54ae3233 c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll

MD5: 16a252022535b680046f6e34e136d378 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

MD5: a4ad1aa4c57409480c1d84bbca6becf0 c:\program files\microsoft\search enhancement pack\search helper\sepsearchhelperie.dll

MD5: 7e7bc43fdfdde4ca95be1513a9bdcd02 C:\program files\Mozilla Firefox\components\browsercomps.dll

MD5: bfb7fde289f63f74bde5226c6c5e1090 C:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll

MD5: e83508d9a0f0d0d8449317dc6a4c5e02 C:\program files\Mozilla Firefox\firefox.exe

MD5: 95b99d7c415449faeae642255f9f5a86 C:\program files\Mozilla Firefox\freebl3.dll

MD5: 9d9fdca1ea28ede048e99b99b7e0ef5d C:\program files\Mozilla Firefox\mozalloc.dll

MD5: 636d2f44e0724fadc4f711e5225615ae C:\program files\Mozilla Firefox\MOZCPP19.dll

MD5: abf1c2a7cf3b43e2d481c14019dfa41e C:\program files\Mozilla Firefox\MOZCRT19.dll

MD5: 5d7ffcc9deb5bb08417ceae51d2afed4 C:\program files\Mozilla Firefox\mozjs.dll

MD5: fb1d53fd3be9ba1ca856b46302896e8e C:\program files\Mozilla Firefox\mozsqlite3.dll

MD5: 64027d23eed51e74f695470622b7ba46 C:\program files\Mozilla Firefox\nspr4.dll

MD5: 10eb50bef8b826c10534b7540e67feac C:\program files\Mozilla Firefox\nss3.dll

MD5: 8b2f57de183b741f3ba3b0d0320a4c67 C:\program files\Mozilla Firefox\nssckbi.dll

MD5: a4964c95a9ceeb1f101a697e9e79c356 C:\program files\Mozilla Firefox\nssdbm3.dll

MD5: 2e60538b761ba2cb8b34c9833b3ea00e C:\program files\Mozilla Firefox\nssutil3.dll

MD5: 37a4f08d9c3553da583ca7ced1fddfe9 C:\program files\Mozilla Firefox\plc4.dll

MD5: 45ffabca094e6ed6e6214530a7ef9746 C:\program files\Mozilla Firefox\plds4.dll

MD5: 3b2cc09944488db5ed5dfdc315c9ab57 C:\program files\Mozilla Firefox\plugin-container.exe

MD5: 99f97c9fe748c37528c338a423577fcb C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll

MD5: 04579df5b53a251fb929c83e01b5744f C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll

MD5: bb2fd4632cbf410c584bab0be026b733 C:\Program Files\Mozilla Firefox\plugins\npmozax.dll

MD5: 9a6101f29e2e9d41b99cbcc8f106e8fe C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL

MD5: 29fe789054c24b4b87c9171435261ec5 C:\program files\Mozilla Firefox\smime3.dll

MD5: da3635c5f94f638eba72ea767348ce29 C:\program files\Mozilla Firefox\softokn3.dll

MD5: dc555cc963f13626672d6f4b4883a557 C:\program files\Mozilla Firefox\ssl3.dll

MD5: 007236381f7a2a0e20a2813f8b3c5bf7 C:\program files\Mozilla Firefox\xpcom.dll

MD5: 56b4b5181549f6e07672a498d3046674 C:\program files\Mozilla Firefox\xul.dll

MD5: f488258357e0fde71117ee3866a7032b C:\Program Files\MozyHome\LIBEAY32.dll

MD5: 3273e8f9085aa0cc1356b8bb20c213cc C:\Program Files\MozyHome\mozybackup.exe

MD5: f78810c3c023c913a8e89afb4676ce01 C:\Program Files\MozyHome\mozyshell.dll

MD5: da7763dbf7d7679b52a3f1484fbd3fb7 c:\program files\msn toolbar\platform\6.3.2322.0\npwinext.dll

MD5: 073cfca2f6a6829980b5cb96caf8f913 C:\Program Files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr

MD5: 289891a688a9fda4cebd370f230ff846 C:\Program Files\Nokia\Nokia PC Suite 7\NGSCM.DLL

MD5: ddf5324e0f3065846e9b65ff3afd379e C:\Program Files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll

MD5: 0ae3ee2a15685bcde716e1ef410d4436 c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

MD5: 88d0d8ce3eff3c44b0530507f12893e1 C:\Program Files\Skype\Toolbars\Shared\SkypePnr.dll

MD5: d8b10e42325445f5d800d5846dff71b8 C:\Program Files\Windows Defender\MpOav.dll

MD5: 47bdbce3e2d819b17ab9fa4539b9df71 c:\program files\windows live\companion\companioncore.dll

MD5: 4ce9dac1518ff7e77bd213e6394b9d77 C:\Program Files\Windows Live\Family Safety\fsssvc.exe

MD5: 6067acef367e79914af628fa1e9b5330 C:\Program Files\Windows Live\Mesh\wlcrasvc.exe

MD5: ac421a44de902f2627f1e63793ed89cd C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

MD5: acb2e63d50157e3ea7140f29d9e76a48 C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5: 20ef9002cff89c4c1077e4415ec7297b C:\program files\Windows Media Player\wmpnscfg.exe

MD5: 71e979899a9ffddb0d1d80153192db86 C:\Program Files\Windows Media Player\wmpnssci.dll

MD5: a628af2c05f28d1dc9510db5fd646d2b C:\Program Files\Windows Photo Gallery\PhotoBase.dll

MD5: 5eb87ba0b93ca7e894fc8002e3ce4c2a C:\Program Files\Windows Portable Devices\SqmApi.dll

MD5: e46e52fdac7b4ecc83acd05d9aa0d48f C:\ProgramData\Megamedia\Megakey\msadm.dll

MD5: 53ea061ecc67223a430f153c3682ad54 C:\PROGRA~1\BITNAM~2\apache2\bin\httpd.exe

MD5: fcc7c432fbf465c38fd5d940580ef9b7 C:\Users\Gary\AppData\Local\Facebook\Update\FacebookUpdate.exe

MD5: 476bb117a95da959f96dd507560b0b44 C:\Users\Gary\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll

MD5: ec5f1b4482b01afb20c111973f9a920d C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.5.0.7280_0\npSkypeChromePlugin.dll

MD5: 95b0a3ac3ea7f599a0439a64d5bdc436 C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhhocpdgkjoocfobhdbcfeafckeoiemc\0.6.0.0_0\plugin\npMegaPlugin.dll

MD5: 5489172161215be7ca2ebe890d634a40 C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhhocpdgkjoocfobhdbcfeafckeoiemc\0.6.0.0_0\plugin\npms.dll

MD5: 866ce04905aa02fc0de5b306b25032c3 C:\Users\Gary\AppData\Local\Google\Update\1.3.21.53\npGoogleUpdate3.dll

MD5: 02e0f5e485d94b75a8b31243a6d430cc c:\users\gary\appdata\local\megamedia\megakey\megaiehelper.dll

MD5: 2dfc98e67ed88ec016caefca070ffa4c C:\Users\Gary\AppData\Local\Megamedia\Megakey\{1D3DB383-DB45-45b2-9F46-91218CA2CBCB}\components\NativeWrapper.dll

MD5: db4ba0130d2a4727abe171750cf7031d C:\Users\Gary\AppData\LocalLow\Megamedia\Megakey\LIBEAY32.dll

MD5: 5a34f5a8990a1ebce746df7902b087de C:\Users\Gary\AppData\LocalLow\Megamedia\Megakey\MegaCore.dll

MD5: a1e7537cf72a4224926c283b1091ac57 C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\wd6t9fi5.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}\plugins\npGarmin.dll

MD5: 0c9fffc25f797f8c7c3f99bc12cfa411 C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f6deb187f24bb3185841092b89fbfdbb\mscorlib.ni.dll

MD5: 23dc75d158d484177ffe99e23264f89f C:\windows\Downloaded Program Files\qsax.dll

MD5: 6717ae12e326dd1e39f6ee183a37dc0f C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll

MD5: f3432e0c2d2c257d07d43fd57a0cde6a C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll

MD5: ab87eeffd18f2baafc274e7075ea6c67 c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

MD5: 1a11a757d613f8a815b8e30025522628 C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll

MD5: 86acb6a60c50e99eb8e68710d5a12654 C:\Windows\system32\Ati2evxx.exe

MD5: 80efedd1f8b4427191b6a2447c339dd6 C:\Windows\system32\atipdlxx.dll

MD5: 3665ef877d1a83c6bd9ba65dede5232e C:\Windows\system32\atitmmxx.dll

MD5: 60a2aabc0e594016c45be3d6dd692a3d C:\Windows\system32\atiumdag.dll

MD5: d0e5dce4cec8bf33f4cd76cf35c460ed C:\Windows\system32\BCMWLCPL.CPL

MD5: 74f26fc01b180d4a99a168ed69c30a53 C:\Windows\system32\cmd.exe

MD5: 3dfeec45e5f22993216083fb777719d5 C:\Windows\system32\d2d1.dll

MD5: 8b02d2ecc7ef6e1f6af08459e3f741f6 C:\Windows\system32\d3d10.dll

MD5: 29e4ea31c6debe5efb384eefa4f1ef63 C:\Windows\system32\d3d10_1.dll

MD5: 556f1cbe9ba19e2ccd6f8d9af71af5c7 C:\Windows\system32\d3d10_1core.dll

MD5: 9c7094f537782a82b6a29b4a7172e180 C:\Windows\system32\d3d10core.dll

MD5: 33ebf5dcd45f878b3622ad82ab37af3a C:\Windows\system32\D3D10Warp.dll

MD5: 85e861d0b88db2b54acb0839654c09f7 C:\Windows\system32\DNSAPI.dll

MD5: 57d762f6f5974af0da2be88a3349baaa C:\Windows\System32\dnsrslvr.dll

MD5: 3911b972b55fea0478476b2e777b29fa C:\Windows\system32\drivers\afd.sys

MD5: 3a99cb23a2d326fd532618705d6e3048 C:\Windows\system32\drivers\aliide.sys

MD5: 4333c133dbd71c7d7fe4fb1b83f9ee3e C:\Windows\system32\drivers\amdide.sys

MD5: e54e27976e2c5a6465d44c10b1d87ac0 C:\Windows\System32\DRIVERS\ASPI32.sys

MD5: 7db96c2801a78513bdc133c25d07929e C:\Windows\system32\DRIVERS\atikmdag.sys

MD5: a356e45e8432432c06981ea63a1e0fe8 C:\Windows\system32\DRIVERS\AtiPcie.sys

MD5: 7cfd6d37aba7006148abbf4f629b2d2a C:\Windows\system32\drivers\bckd.sys

MD5: cd4646067cc7dcba1907fa0acf7e3966 C:\Windows\system32\DRIVERS\bcm4sbxp.sys

MD5: abd543e555bc0453bf52664936df4dcd C:\Windows\system32\DRIVERS\bcmwl6.sys

MD5: 35f376253f687bde63976ccb3f2108ca C:\Windows\system32\DRIVERS\bowser.sys

MD5: dfb94a6fc3a26972b0461ab5f1d8272b C:\Windows\system32\drivers\cmdide.sys

MD5: 622c41a07ca7e6dd91770f50d532cb6c C:\Windows\System32\Drivers\dfsc.sys

MD5: 4f59c172c094e1a1d46463a8dc061cbd C:\Windows\system32\DRIVERS\Dot4.sys

MD5: 80bf3ba09f6f2523c8f6b7cc6dbf7bd5 C:\Windows\system32\DRIVERS\Dot4Prt.sys

MD5: c55004ca6b419b6695970dfe849b122f C:\Windows\system32\DRIVERS\dot4usb.sys

MD5: c68ac676b0ef30cfbb1080adce49eb1f C:\Windows\System32\drivers\dxgkrnl.sys

MD5: d909075fa72c090f27aa926c32cb4612 C:\Windows\system32\DRIVERS\fssfltr.sys

MD5: 6d2350bb6e77e800fc4be4e5b7a2e89a C:\Windows\system32\DRIVERS\HSX_CNXT.sys

MD5: 53229dcf431d76434816cd29251168a0 C:\Windows\system32\DRIVERS\HSX_DPV.sys

MD5: 31f949d452201f2f0af0c88d7db512cd C:\Windows\system32\DRIVERS\HSXHWAZL.sys

MD5: 1c60617d54bc9f035671a44b75d9f7cc C:\Windows\system32\drivers\intelide.sys

MD5: ce44cc04262f28216dd4341e9e36a16f C:\Windows\system32\DRIVERS\intelppm.sys

MD5: 3d2c13377763eeac0ca6fb46f57217ed C:\Windows\system32\drivers\mbam.sys

MD5: 19cb6b226733843817d607c46fdb310c C:\Windows\system32\DRIVERS\mozy.sys

MD5: 7e34bfa1a7b60bba1da03d677f16cd63 C:\Windows\system32\DRIVERS\MpFilter.sys

MD5: f32e2d6a1640a469a9ed4f1929a4a861 C:\Windows\system32\DRIVERS\MpNWMon.sys

MD5: 1e94971c4b446ab2290deb71d01cf0c2 C:\Windows\system32\DRIVERS\mrxsmb.sys

MD5: d4a3c7c580c4ccb5c06f2ada933ad507 C:\Windows\system32\DRIVERS\mrxsmb10.sys

MD5: c3cb1b40ad4a0124d617a1199b0b9d7c C:\Windows\system32\DRIVERS\mrxsmb20.sys

MD5: f0ec3a4e0693a34b148723b4da31668c C:\Windows\system32\drivers\msahci.sys

MD5: 17e2c08c5ecfbe94a7c67b1c275ee9d9 C:\Windows\system32\DRIVERS\NisDrvWFP.sys

MD5: 6f785db62a6d8f3fafd3e5695277e849 C:\Windows\system32\drivers\nvraid.sys

MD5: 4a5fcab82d9bf6af8a023a66802fe9e9 C:\Windows\system32\drivers\nvstor.sys

MD5: 5119ffc2a6b51089cdb0efdc75808c97 C:\Windows\System32\Drivers\nx6000.sys

MD5: 1636d43f10416aeb483bc6001097b26c C:\Windows\system32\drivers\pciide.sys

MD5: d85e3fa9f5b1f29bb4ed185c450d1470 C:\Windows\system32\DRIVERS\rimmptsk.sys

MD5: db8eb01c58c9fada00c70b1775278ae0 C:\Windows\system32\drivers\rimsptsk.sys

MD5: 6c1f93c0760c9f79a1869d07233df39d C:\Windows\system32\drivers\rixdptsk.sys

MD5: 41987f9fc0e61adf54f581e15029ad91 C:\Windows\System32\DRIVERS\srv.sys

MD5: ff33aff99564b1aa534f58868cbe41ef C:\Windows\System32\DRIVERS\srv2.sys

MD5: 7605c0e1d01a08f3ecd743f38b834a44 C:\Windows\System32\DRIVERS\srvnet.sys

MD5: 6a2a5e809c2c0178326d92b19ee4aad3 C:\Windows\system32\drivers\stwrt.sys

MD5: 1f5192248a364d4ab68db063d18a2139 C:\Windows\system32\DRIVERS\SynTP.sys

MD5: 6a10afce0b38371064be41c1fbfd3c6b C:\Windows\System32\drivers\tcpip.sys

MD5: 9bf343f4c878d6ad6922b2c5a4fefe0d C:\Windows\System32\drivers\tcpipreg.sys

MD5: 325dbbacb8a36af9988ccf40eac228cc C:\Windows\system32\DRIVERS\usbuhci.sys

MD5: 58c8d5ac5c3eef40e7e704a5ced7987d C:\Windows\system32\drivers\viaide.sys

MD5: 28dc5d626e036a75a572556f0a6eb1f6 C:\Windows\system32\DRIVERS\xaudio.exe

MD5: 5a7ff9a18ff6d7e0527fe3abf9204ef8 C:\Windows\system32\DRIVERS\xaudio.sys

MD5: 6843926aff733d46a04f9d4e1c1a6b14 C:\Windows\system32\DWrite.dll

MD5: aaae543c535ed596ecad2ab8761c2c6f C:\Windows\system32\dxgi.dll

MD5: 4312debdacbe338f0b90e7f08e7672be C:\Windows\system32\Dxtmsft.dll

MD5: ca493a92da9880b6f1a89c3dbd54ba5b C:\Windows\system32\Dxtrans.dll

MD5: 8ce364388c8eca59b14b539179276d44 C:\Windows\system32\FntCache.dll

MD5: 70f60de5f06cdf8e0b8b48e3bce82987 C:\Windows\system32\HLINK.DLL

MD5: ed6f6fbbcdec95483b7351e23f4fcdf6 C:\Windows\system32\IEADVPACK.DLL

MD5: ee9d715af1b928982f417238b9914484 C:\Windows\system32\ieapfltr.dll

MD5: 9af36c3c48f82d95b5670d7c29923d8a C:\Windows\system32\IEFRAME.dll

MD5: 733c7f11b06892f9dc283d4bb34abd25 C:\Windows\system32\iertutil.dll

MD5: 33de59ca6dc188029528033aee06d780 C:\Windows\system32\IEUI.dll

MD5: dfae18c675d71fd06d57dc69d2913975 C:\Windows\system32\inetsrv\apphostsvc.dll

MD5: f22ca75c05204f76d06e6c530529455c C:\Windows\system32\inetsrv\iisw3adm.dll

MD5: c92f538f531f26f2e240a8b21420692a C:\Windows\System32\jscript9.dll

MD5: 21a67095edc11a528f5434d28bb0ef3c C:\Windows\system32\Macromed\Flash\NPSWF32.dll

MD5: 7940c04ce581288a3498d57ec4ee47d2 C:\Windows\System32\msfeeds.dll

MD5: 3f63f95c998f7e1af409bc74e83d45e5 C:\Windows\system32\MSHTML.dll

MD5: aab5feaabf4cb6f76d794203831c8d94 C:\Windows\system32\Msidle.dll

MD5: 35aae2e841aa1a949775168e119482c9 C:\Windows\system32\msls31.dll

MD5: ff41e1ac301f51e16f61ad7c0f45467c C:\Windows\System32\msshsq.dll

MD5: 708fb84003732e220c23cdf207f5a329 C:\Windows\system32\ntdll.dll

MD5: 9586e7cb2255a8b097a7e4538202585e C:\Windows\system32\ole32.dll

MD5: de4cd76c254e143f40e62952788d3be7 C:\Windows\system32\OLEAUT32.dll

MD5: ab530fdd34c67b497a20171d1234cfe9 C:\Windows\system32\RICHED32.DLL

MD5: 2ab58991862153a248779174d4e4212b C:\Windows\system32\schannel.dll

MD5: 1a58069db21d05eb2ab58ee5753ebe8d C:\Windows\system32\schedsvc.dll

MD5: 167ac31450c0c53a01fa1491e94d7678 C:\Windows\system32\shdocvw.dll

MD5: 33ae914c24f546aabf281ba7b138186d C:\Windows\system32\SHELL32.dll

MD5: 9176285122b7b849fec2aa1b72a8f7a8 C:\Windows\system32\SHLWAPI.dll

MD5: c7230fbee14437716701c15be02c27b8 C:\Windows\System32\shsvcs.dll

MD5: 8c1611e8824c5b454c6827b4f06fcb0c C:\Windows\system32\spool\DRIVERS\W32X86\3\HPFIE5mu.dll

MD5: e2370657e2e2d55d8fb8f4959233bb7f C:\Windows\system32\spool\DRIVERS\W32X86\3\hpz3r5mu.dll

MD5: 8554097e5136c3bf9f69fe578a1b35f4 C:\Windows\System32\spoolsv.exe

MD5: 1bf5eebfd518dd7298434d8c862f825d C:\Windows\System32\srvsvc.dll

MD5: 7e6dd4b34acd36af6c711d2bde91b040 C:\Windows\system32\STacSV.exe

MD5: b5950df243837d8217f4e597919b224a C:\Windows\system32\stobject.dll

MD5: bfa034aac103d8a6f591ac9364688339 C:\Windows\system32\t2embed.dll

MD5: 3d50c4b10352367d5cb20ed1f50f8da2 C:\windows\System32\taskeng.exe

MD5: 52e129522c1775dbb8cc252e7a0655c7 C:\Windows\system32\taskschd.dll

MD5: cde36a70a5280fc0696e6e4363c4c71d C:\Windows\system32\TaskSchdPS.dll

MD5: df6de2f5afb9fa1cfa02081ef9b3e7e8 C:\Windows\system32\urlmon.dll

MD5: 80fff14f1757b9af8be9d314fc1ae88b C:\Windows\system32\USP10.dll

MD5: 5193de33f3284c447e0d31dafbf92570 c:\windows\system32\webcheck.dll

MD5: a1236375b74ea63c75657d564890c436 C:\Windows\system32\WININET.dll

MD5: 5ec8fb83f31aa2d6f421f02c3f4f4475 C:\Windows\system32\WINSPOOL.DRV

MD5: a9662bcf218bc76869a8d91635d5f93a C:\Windows\System32\Wpc.dll

MD5: d5e459bed3db9cf7fc6cc1455f177d2d C:\Windows\WinSxS\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d1cb102c435421de\ATL80.DLL

MD5: 1d109ed0d660654ea7ff1574558031c4 C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\msvcm80.dll

MD5: 0b3595a4ff0b36d68e5fc67fd7d70fdc C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCP80.dll

MD5: c9564cf4976e7e96b4052737aa2492b4 C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR80.dll

MD5: 1f5afd468eb5e09e9ed75a087529eab5 C:\Windows\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.6195_none_cbf5e994470a1a8f\MFC80.DLL

MD5: 28a09777d2d952122567a8a82f1a2c7b C:\Windows\WinSxS\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.6195_none_03ce2c72205943d3\MFC80ENU.DLL

MD5: 35acd5ea63d75e97dd0e9a1629e582b2 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.6002.18305_none_88f3a38569c2c436\COMCTL32.dll

MD5: be3c082837866c4c291adaf163c10ea6 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll

MD5: b5b09091b0e33c396ceec8995515bd41 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll

No file uploaded.

Scan finished - communication took 2 sec

Total traffic - 0.02 MB sent, 0.84 KB recvd

Scanned 729 files and modules - 36 seconds

==============================================================================

Link to post
Share on other sites

Looking good ;)

Before we move on, please take the time to install the following updates, as using outdated applications leaves you extremely vulnerable getting infected again :):

Java is out of date and older versions contain vulnerabilities. Please update to the newest version.

Download the newest version from here http://www.oracle.com/technetwork/java/javase/downloads/index.html.

It's important to remove older versions of Java since it does not do so automatically and old versions still leave you vulnerable.

Go to Start > Control Panel and open Add or Remove Programs.

Search in the list for all previous installed versions of Java. (J2SE Runtime Environment).

They will have this icon next to them: javaicon.gif

Select each in turn and click Remove.

Once old versions are gone, please install the newest version.

----------

You are using Internet Explorer version 8. Since you are using Vista, you qualify for the latest version, which is 9. Using an outdated version of a web browser leaves you extremley vulnerable to malware!

Please see this link to download the latest version: http://windows.microsoft.com/en-US/internet-explorer/products/ie/home

----------

Please let me know how the updates went, as failed updates may indicate additional malware ;)

Link to post
Share on other sites

Glad to hear the updates went well :)

Unless you have any more questions or concerns, I will now provide you with some suggestions for security software, but first, ComboFix must be uninstalled ;):

The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /Uninstall

-------------

Please consider using these ideas to help secure your computer. While there is no way to guarantee safety when you use a computer, these steps will make it much less likely that you will need to endure another infection. While we really like to help people, we would rather help you protect yourself so that you won't need that help in the future. :)

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates or get into the habit of checking Windows Update regularly. They usually have security updates every month. You can set Windows to notify you of Updates so that you can choose, but only do this if you believe you are able to understand which ones are needed. This is a crucial security measure.

It is really dangerous to go online without an antivirus. Without one, you are extremely likely to get infected and the consequences could be even worse next time. All of the following are excellent free antiviruses. Be sure to only install one.

avast!.

AntiVir

AVG

Please consider installing and running some of the following programs; they are either free or have free versions of commercial programs:

Spybot-Search & Destroy

A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features if you don't have the resident part of another anti-spyware program running.

SpywareBlaster

A tutorial on using SpywareBlaster to prevent malware from ever installing on your computer may be found here.

SpywareGuard

A tutorial on using SpywareGuard for real-time protection against spyware and hijackers may be found here.

Please, consider maintaining a firewall with HIPS (Host Intrusion Prevention Systems). Firewalls are extremely important and are the first part of your computer's defense. HIPS stops malware by monitoring its behavior and it's very important, too.

A firewall is a software program or piece of hardware that helps screen out hackers, viruses, and worms that try to reach your computer over the Internet.

If you are using the Windows Firewall please note that it doesn't monitor or block outbound traffic and is therefore less effective than other free alternatives.

These firewalls are good and do have free versions available

A tutorial on understanding and using firewalls may be found here.

If you use Internet Explorer, it is a good idea to use IE-Spyad for ZonedOut which provides protections against malicious websites. (Requires 2 downloads)

Please keep these programs up-to-date and run them whenever you suspect a problem to prevent malware problems. A number of programs have resident protection and it is a good idea to run the resident protection of one of each type of program to maintain protection. However, it is important to run only one resident program of each type since they can conflict and become less effective. That means only one antivirus, firewall and scanning anti-spyware program at a time. Passive protectors, like SpywareBlaster and IE-Spyad can be run with any of them.

Note that there are a lot of rogue programs out there that want to scare you into giving them your money and some malware actually claims to be security programs. If you get a popup for a security program that you did not install yourself, do NOT click on it and ask for help immediately. It is very important to run an antivirus and firewall, but you can't always rely on reviews and ads for information. Ask in a security forum that you trust if you are not sure. If you are unsure and looking for anti-spyware programs, you can find out if it is a rogue here:

http://www.spywarewarrior.com/rogue_anti-spyware.htm

A similar category of programs is now called "scareware." Scareware programs are active infections that will pop-up on your computer and tell you that you are infected. If you look closely, it will usually have a name that looks like it might be legitimate, but it is NOT one of the programs you installed. It tells you to click and install it right away. If you click on any part of it, including the 'X' to close it, you may actually help it infect your computer further. Keeping protection updated and running resident protection can help prevent these infections. If it happens anyway, get offline as quickly as you can. Pull the internet connection cable or shut down the computer if you have to. Contact someone to help by using another computer if possible. These programs are also sometimes called 'rogues', but they are different than the older version of rogues mentioned above.

Please consider using an alternate browser. Mozilla's Firefox browser is a very good alternative. In addition to being generally more secure than Internet Explorer, it has a very good built-in popup blocker and add-ons, like NoScripts, can make it even more secure. Opera is another good option.

If you are interested, Firefox may be downloaded from here

Opera is available here: http://www.opera.com/download/

For much more useful information, please also read Tony Klein's excellent article: How did I get infected in the first place

Hopefully these steps will help to keep you error free. If you run into more difficulty, we will certainly do what we can to help. :)

Link to post
Share on other sites

I'm currently running Microsoft security essentials and SuperAntiSpyware. Do you have an opinion an either of these? I guess I need a firewall in addition, and I will look into this.

Personally I use Avast! Free edition and Malwarebytes PRO. I'm not too familiar with MSE and SuperAntiSpyware, but in my experience, Avira and Avast seem to be the better ones available right now.

Hope that helps :)

Link to post
Share on other sites

I just wanted to thank you for all your help. I really appreciate it.

Also would like to mention that I installed Online Armor and then every program I tried to run on my computer got an application error and wouldn't start. In the end I decided to uninstall it, which I couldn't. Eventually after a restart and closing the firewall down, I managed to get rid of it.

Link to post
Share on other sites

I just wanted to thank you for all your help. I really appreciate it.

You're welcome, it was nice working with you :)

Also would like to mention that I installed Online Armor and then every program I tried to run on my computer got an application error and wouldn't start. In the end I decided to uninstall it, which I couldn't. Eventually after a restart and closing the firewall down, I managed to get rid of it.

That's odd that Online Armor was acting that way... you might want to try Outpost Firewall and see if you have any luck with that ;)

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.