Infected?

BWC · October 12, 2011

I've run all the files mentioned and it appears as nothing was detected. However, I'm still receiving messages that Malware is blocking attempts to contact malicious websites as well as being attacked from outside. The "ark file is zero bytes and therefor not uploaded.

defogger_disable.log

protection-log-2011-10-12.txt

screen317 · October 14, 2011

Hi and welcome to Malwarebytes.

In the future, please post all logs directly into your reply instead of attaching them unless otherwise indicated. With that said, please update MBAM, run a Quick Scan, and post its log.

Next, run DDS again and post DDS.txt directly in your reply.

BWC · October 17, 2011

Hi and welcome to Malwarebytes.
In the future, please post all logs directly into your reply instead of attaching them unless otherwise indicated. With that said, please update MBAM, run a Quick Scan, and post its log.
Next, run DDS again and post DDS.txt directly in your reply.
09:49:29 (null) MESSAGE Scheduled update executed successfully
09:50:19 Wayne-Rhonda MESSAGE Protection started successfully
09:50:23 Wayne-Rhonda MESSAGE IP Protection started successfully
09:50:45 Wayne-Rhonda MESSAGE IP Protection stopped
09:50:46 Wayne-Rhonda MESSAGE Database updated successfully
09:50:46 Wayne-Rhonda MESSAGE IP Protection started successfully
11:39:43 Wayne-Rhonda IP-BLOCK 221.192.199.49 (Type: outgoing, Port: 137)
11:39:43 Wayne-Rhonda IP-BLOCK 221.192.199.49 (Type: outgoing, Port: 137)
11:39:43 Wayne-Rhonda IP-BLOCK 221.192.199.49 (Type: outgoing, Port: 137)
11:39:43 Wayne-Rhonda IP-BLOCK 221.192.199.49 (Type: outgoing, Port: 137)
13:22:57 Wayne-Rhonda IP-BLOCK 221.192.199.49 (Type: outgoing, Port: 137)
13:22:58 Wayne-Rhonda IP-BLOCK 221.192.199.49 (Type: outgoing, Port: 137)
13:22:58 Wayne-Rhonda IP-BLOCK 221.192.199.49 (Type: outgoing, Port: 137)
13:22:58 Wayne-Rhonda IP-BLOCK 221.192.199.49 (Type: outgoing, Port: 137)

DS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421

Run by Wayne-Rhonda at 14:33:40 on 2011-10-17

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.12279.10134 [GMT -7:00]

.

AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Windows\system32\mfevtps.exe

C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe

c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe

C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe

C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

c:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE

C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe

C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe

C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe

C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Program Files\mcafee.com\agent\mcagent.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Windows\SysWOW64\Ctxfihlp.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe

C:\Windows\SysWOW64\CTXFISPI.EXE

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\system32\DllHost.exe

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10x_ActiveX.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

.

============== Pseudo HJT Report ===============

.

mWinlogon: Userinit=userinit.exe

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll

BHO: StartNow Toolbar Helper: {6e13d095-45c3-4271-9475-f3b48227dd9f} - C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll

BHO: RoboForm BHO: {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll

BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20111012155818.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: Facetheme: {de4e75d3-60aa-4f02-a0e4-c8a40576574c} - C:\Program Files (x86)\Object\bho_project.dll

TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll

TB: StartNow Toolbar: {5911488e-9d1e-40ec-8cbb-06b231cc153f} - C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll

uRun: [Rainlendar2] C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe

uRun: [spybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

uRun: [Corel Photo Downloader] "C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup

uRun: [RoboForm] "C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"

mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [CTxfiHlp] CTXFIHLP.EXE

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mRun: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup

dRunOnce: [CTAutoUpdate] "C:\Program Files (x86)\Creative\Shared Files\Software Update\AutoUpdate.exe" /RunFromInstaller

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: Customize Menu - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html

IE: Fill Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html

IE: RoboForm Toolbar - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html

IE: Save Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html

IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html

IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html

IE: {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll

DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} - hxxps://support.dell.com/systemprofiler/SysProExe.CAB

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} - hxxp://support.dell.com/systemprofiler/DellSystemLite.CAB

DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab

DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab

DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15118/CTPID.cab

TCP: DhcpNameServer = 75.75.75.75 75.75.76.76

TCP: Interfaces\{F49114D8-41C8-4635-AAA3-DDA000FC615C} : DhcpNameServer = 75.75.75.75 75.75.76.76

Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~2\McAfee\msc\McSnIePl.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll

BHO-X64: StartNow Toolbar Helper: {6E13D095-45C3-4271-9475-F3B48227DD9F} - C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll

BHO-X64: StartNow Toolbar Helper - No File

C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll

BHO-X64: RoboForm BHO - No File

BHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20111012155818.dll

BHO-X64: scriptproxy - No File

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO-X64: Facetheme: {de4e75d3-60aa-4f02-a0e4-c8a40576574c} - C:\Program Files (x86)\Object\bho_project.dll

BHO-X64: BHO Project - No File

TB-X64: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll

TB-X64: StartNow Toolbar: {5911488E-9D1E-40ec-8CBB-06B231CC153F} - C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll

mRun-x64: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun-x64: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe

mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun-x64: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey

mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun-x64: [CTxfiHlp] CTXFIHLP.EXE

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mRun-x64: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup

IE-X64: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html

IE-X64: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html

IE-X64: {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html

.

============= SERVICES / DRIVERS ===============

.

R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\system32\drivers\mfehidk.sys --> C:\Windows\system32\drivers\mfehidk.sys [?]

R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\system32\drivers\mfewfpk.sys --> C:\Windows\system32\drivers\mfewfpk.sys [?]

R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]

R1 mfenlfk;McAfee NDIS Light Filter;C:\Windows\system32\DRIVERS\mfenlfk.sys --> C:\Windows\system32\DRIVERS\mfenlfk.sys [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-9-5 64952]

R2 DellDigitalDelivery;Dell Digital Delivery Service;C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe [2011-7-13 150920]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-9-15 13336]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-10-2 366664]

R2 McMPFSvc;McAfee Personal Firewall Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2011-1-27 249936]

R2 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2011-1-27 249936]

R2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2011-1-27 249936]

R2 McShield;McAfee McShield;C:\Program Files\Common Files\mcafee\systemcore\mcshield.exe [2011-9-15 199008]

R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe [2011-9-15 208272]

R2 mfevtp;McAfee Validation Trust Protection Service;"C:\Windows\system32\mfevtps.exe" --> C:\Windows\system32\mfevtps.exe [?]

R2 NOBU;Dell DataSafe Online;C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe [2010-8-25 2823000]

R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-9-28 2255464]

R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2011-10-12 1153368]

R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2011-9-15 1692480]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-8-3 379496]

R2 Updater Service for StartNow Toolbar;Updater Service for StartNow Toolbar;C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe [2011-7-27 267488]

R3 cfwids;McAfee Inc. cfwids;C:\Windows\system32\drivers\cfwids.sys --> C:\Windows\system32\drivers\cfwids.sys [?]

R3 CT20XUT.SYS;CT20XUT.SYS;C:\Windows\system32\drivers\CT20XUT.SYS --> C:\Windows\system32\drivers\CT20XUT.SYS [?]

R3 CTEXFIFX.SYS;CTEXFIFX.SYS;C:\Windows\system32\drivers\CTEXFIFX.SYS --> C:\Windows\system32\drivers\CTEXFIFX.SYS [?]

R3 CTHWIUT.SYS;CTHWIUT.SYS;C:\Windows\system32\drivers\CTHWIUT.SYS --> C:\Windows\system32\drivers\CTHWIUT.SYS [?]

R3 ha20x22k;Creative 20X2 HAL Driver;C:\Windows\system32\drivers\ha20x22k.sys --> C:\Windows\system32\drivers\ha20x22k.sys [?]

R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]

R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\system32\drivers\mfeavfk.sys --> C:\Windows\system32\drivers\mfeavfk.sys [?]

R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\system32\drivers\mfefirek.sys --> C:\Windows\system32\drivers\mfefirek.sys [?]

R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;C:\Windows\system32\DRIVERS\nusb3hub.sys --> C:\Windows\system32\DRIVERS\nusb3hub.sys [?]

R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;C:\Windows\system32\DRIVERS\nusb3xhc.sys --> C:\Windows\system32\DRIVERS\nusb3xhc.sys [?]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]

S2 0223521318461630mcinstcleanup;McAfee Application Installer Cleanup (0223521318461630);C:\Windows\TEMP\022352~1.EXE C:\PROGRA~2\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> C:\Windows\TEMP\022352~1.EXE C:\PROGRA~2\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2011-9-26 79360]

S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-9-26 79360]

S3 Creative Media Toolbox 6 Licensing Service;Creative Media Toolbox 6 Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\MT6Licensing.exe [2011-9-26 79360]

S3 CT20XUT;CT20XUT;C:\Windows\system32\drivers\CT20XUT.SYS --> C:\Windows\system32\drivers\CT20XUT.SYS [?]

S3 CTEXFIFX;CTEXFIFX;C:\Windows\system32\drivers\CTEXFIFX.SYS --> C:\Windows\system32\drivers\CTEXFIFX.SYS [?]

S3 CTHWIUT;CTHWIUT;C:\Windows\system32\drivers\CTHWIUT.SYS --> C:\Windows\system32\drivers\CTHWIUT.SYS [?]

S3 dmvsc;dmvsc;C:\Windows\system32\drivers\dmvsc.sys --> C:\Windows\system32\drivers\dmvsc.sys [?]

S3 McAWFwk;McAfee Activation Service;C:\PROGRA~1\mcafee\msc\mcawfwk.exe [2011-9-15 224704]

S3 MEMSWEEP2;MEMSWEEP2;\??\C:\Windows\system32\FA53.tmp --> C:\Windows\system32\FA53.tmp [?]

S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\system32\drivers\mferkdet.sys --> C:\Windows\system32\drivers\mferkdet.sys [?]

S3 netvsc;netvsc;C:\Windows\system32\DRIVERS\netvsc60.sys --> C:\Windows\system32\DRIVERS\netvsc60.sys [?]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?]

S3 Synth3dVsc;Microsoft Virtual 3D Video Transport Driver;C:\Windows\system32\drivers\Synth3dVsc.sys --> C:\Windows\system32\drivers\Synth3dVsc.sys [?]

S3 SynthVid;SynthVid;C:\Windows\system32\DRIVERS\VMBusVideoM.sys --> C:\Windows\system32\DRIVERS\VMBusVideoM.sys [?]

S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\system32\drivers\terminpt.sys --> C:\Windows\system32\drivers\terminpt.sys [?]

S3 ThreatFire;ThreatFire;C:\Program Files (x86)\PC Tools Security\TFEngine\TFService.exe service --> C:\Program Files (x86)\PC Tools Security\TFEngine\TFService.exe service [?]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]

S3 tsusbhub;Remote Deskotop USB Hub;C:\Windows\system32\drivers\tsusbhub.sys --> C:\Windows\system32\drivers\tsusbhub.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

S4 McOobeSv;McAfee OOBE Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2011-1-27 249936]

S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

.

=============== Created Last 30 ================

.

2011-10-13 02:43:26 -------- d-----w- C:\Windows\SysWow64\Dell

2011-10-12 21:43:26 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy

2011-10-12 21:43:26 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy

2011-10-12 21:35:17 -------- d-----w- C:\Program Files (x86)\Object

2011-10-12 21:35:16 -------- d-----w- C:\Program Files (x86)\Shop to Win 22

2011-10-12 21:35:15 -------- d-----w- C:\Program Files (x86)\Shop To Win

2011-10-12 21:35:11 -------- d-----w- C:\Program Files (x86)\StartNow Toolbar

2011-10-11 19:54:43 3138048 ----a-w- C:\Windows\System32\win32k.sys

2011-10-11 19:54:36 75776 ----a-w- C:\Windows\SysWow64\psisrndr.ax

2011-10-11 19:54:36 613888 ----a-w- C:\Windows\System32\psisdecd.dll

2011-10-11 19:54:35 465408 ----a-w- C:\Windows\SysWow64\psisdecd.dll

2011-10-11 19:54:35 108032 ----a-w- C:\Windows\System32\psisrndr.ax

2011-10-11 19:54:34 331776 ----a-w- C:\Windows\System32\oleacc.dll

2011-10-11 19:54:34 233472 ----a-w- C:\Windows\SysWow64\oleacc.dll

2011-10-11 19:54:33 861696 ----a-w- C:\Windows\System32\oleaut32.dll

2011-10-11 19:54:33 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll

2011-10-09 18:15:57 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\{24F259D6-DD9F-41E6-974C-26BE46E746EE}

2011-10-09 18:15:48 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\{A74FF26D-8035-4461-BCDF-17D0F31E5D12}

2011-10-09 18:15:29 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\{034D76F2-0E09-41D9-B481-A8794C1B7861}

2011-10-09 17:55:54 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\{86888F14-9455-46E1-A2FB-ABBE69670F0F}

2011-10-09 17:55:44 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\{05B017AA-6B7F-4D6A-BB54-47C804DBE620}

2011-10-09 17:53:35 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\{7980FCD3-F7AC-4E77-B996-9312C74CB92B}

2011-10-09 17:53:25 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\{57DD774A-4273-465C-B398-A70297368803}

2011-10-09 17:52:21 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\{6658FA9C-222F-4F19-A63E-FF4AD11821E2}

2011-10-09 17:52:11 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\{8F40CBDE-1ED8-4166-B729-08430D2F9C1F}

2011-10-09 17:44:52 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\Windows Live

2011-10-09 17:44:37 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\{A0D45EBC-B685-4DEB-AD55-0DD11F777630}

2011-10-08 18:01:55 -------- d-----w- C:\Program Files (x86)\MSECache

2011-10-06 01:46:26 465264 ----a-w- C:\Program Files (x86)\Common Files\AppFramework.dll

2011-10-06 01:46:26 402800 ----a-w- C:\Program Files (x86)\Common Files\facebook.dll

2011-10-06 01:46:26 332144 ----a-w- C:\Program Files (x86)\Common Files\MediaOrganizer.dll

2011-10-06 01:46:26 33136 ----a-w- C:\Program Files (x86)\Common Files\FlickrProvider.dll

2011-10-06 01:46:26 130416 ----a-w- C:\Program Files (x86)\Common Files\PluginCommon.dll

2011-10-05 03:33:41 6144 ------w- C:\Windows\System32\FA53.tmp

2011-10-05 03:33:20 6144 ------w- C:\Windows\System32\A86C.tmp

2011-10-05 03:33:07 -------- d-----w- C:\Program Files (x86)\Sophos

2011-10-03 21:40:35 230400 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\hpzppw71.dll

2011-10-03 17:26:38 -------- d-----w- C:\Users\Wayne-Rhonda\My Backup Files

2011-10-03 16:25:14 -------- d-----w- C:\Program Files (x86)\Dell Touch Software Suite

2011-10-03 16:25:14 -------- d-----w- C:\FIND_EULA_PATH

2011-10-03 04:17:49 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Roaming\PCTools

2011-10-03 03:49:54 -------- d-----w- C:\ProgramData\PC Tools

2011-10-02 19:43:16 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\Adobe

2011-09-28 21:01:39 -------- d-----w- C:\Program Files (x86)\NVIDIA Corporation

2011-09-28 20:57:43 -------- d-----w- C:\Program Files (x86)\SystemRequirementsLab

2011-09-28 20:54:27 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\Microsoft Games

2011-09-28 16:19:39 -------- d-----w- C:\Users\Wayne-Rhonda\.rainlendar2

2011-09-28 16:19:26 -------- d-----w- C:\Program Files (x86)\Rainlendar2

2011-09-28 03:30:01 8 --sh--r- C:\ProgramData\AC859C82A4.sys

2011-09-28 03:30:01 8 --sh--r- C:\ProgramData\4CB328A682.sys

2011-09-28 03:30:01 8 --sh--r- C:\ProgramData\4C5B74840F.sys

2011-09-28 03:30:00 8 --sh--r- C:\ProgramData\DED7A8BC10.sys

2011-09-28 03:30:00 8 --sh--r- C:\ProgramData\07B2980D97.sys

2011-09-28 03:22:52 8 --sh--r- C:\ProgramData\F351B99706.sys

2011-09-28 03:22:52 8 --sh--r- C:\ProgramData\C019B48D0E.sys

2011-09-28 03:22:52 8 --sh--r- C:\ProgramData\313F27D68B.sys

2011-09-28 03:22:51 8456 --sha-w- C:\ProgramData\KGyGaAvL.sys

2011-09-27 21:35:29 -------- d-----w- C:\Program Files (x86)\Siber Systems

2011-09-27 21:06:17 -------- d-----w- C:\ProgramData\eSellerate

2011-09-27 21:05:56 -------- d-----w- C:\Program Files (x86)\SmartSound Software

2011-09-27 21:05:55 -------- d-----w- C:\ProgramData\SmartSound Software Inc

2011-09-27 21:05:38 -------- d--h--w- C:\Windows\msdownld.tmp

2011-09-27 21:05:38 -------- d-----w- C:\Windows\RegisteredPackages

2011-09-27 21:05:34 -------- d-----w- C:\ProgramData\InterVideo

2011-09-27 21:05:31 32768 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll

2011-09-27 21:05:31 225280 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\IScript\IScript.dll

2011-09-27 21:05:31 176128 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll

2011-09-27 21:05:30 77824 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll

2011-09-27 21:05:30 212992 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ILog.dll

2011-09-27 21:03:11 -------- d-----w- C:\Program Files (x86)\Windows Media Components

2011-09-27 21:02:52 -------- d-----w- C:\Program Files (x86)\Common Files\Ulead Systems

2011-09-27 21:01:18 614532 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\IKernel.exe

2011-09-27 20:57:57 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin7.dll

2011-09-27 20:57:57 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin6.dll

2011-09-27 20:57:57 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin5.dll

2011-09-27 20:57:57 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin4.dll

2011-09-27 20:57:57 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin3.dll

2011-09-27 20:57:57 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin2.dll

2011-09-27 20:57:57 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin.dll

2011-09-27 20:57:02 -------- d-----w- C:\ProgramData\Corel

2011-09-27 20:57:02 -------- d-----w- C:\Program Files (x86)\Common Files\Protexis

2011-09-27 20:55:36 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\Corel

2011-09-27 20:54:07 -------- d-----w- C:\Program Files (x86)\Corel

2011-09-27 20:54:07 -------- d-----w- C:\Program Files (x86)\Common Files\Corel

2011-09-27 20:39:59 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Roaming\Malwarebytes

2011-09-27 20:39:54 -------- d-----w- C:\ProgramData\Malwarebytes

2011-09-27 20:39:51 25416 ----a-w- C:\Windows\System32\drivers\mbam.sys

2011-09-27 20:39:50 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2011-09-27 20:10:18 -------- d-----w- C:\Program Files\CCleaner

2011-09-27 17:00:22 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Roaming\PCDr

2011-09-27 17:00:02 -------- d-----w- C:\ProgramData\PCDr

2011-09-27 15:23:18 -------- d-----w- C:\Program Files (x86)\MSXML 4.0

2011-09-27 15:13:45 -------- d-----w- C:\Program Files (x86)\Common Files\AnswerWorks 5.0

2011-09-27 15:13:43 4199768 ----a-w- C:\Windows\SysWow64\cdintf400.dll

2011-09-27 15:13:21 -------- d-----w- C:\Program Files (x86)\Common Files\Intuit

2011-09-27 15:13:19 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Roaming\Intuit

2011-09-27 15:13:19 -------- d-----w- C:\Program Files (x86)\Quicken

2011-09-27 15:12:55 -------- d-----w- C:\ProgramData\Intuit

2011-09-27 01:37:28 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\Cyberlink

2011-09-27 01:03:12 -------- d-----w- C:\ProgramData\Creative Labs

2011-09-27 01:02:33 90624 ----a-w- C:\Windows\System32\drivers\bowser.sys

2011-09-27 01:02:32 1923968 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2011-09-27 00:59:55 53248 ------w- C:\Windows\Ctregrun.exe

2011-09-27 00:59:16 61440 ------w- C:\Windows\SysWow64\CTChkAud.dll

2011-09-27 00:59:16 183296 ------w- C:\Windows\System32\CTOPT352.dll

2011-09-27 00:59:16 166912 ------w- C:\Windows\SysWow64\CTOPT352.dll

2011-09-27 00:59:15 49664 ------w- C:\Windows\System32\CTChkAud.dll

2011-09-27 00:59:15 42496 ------w- C:\Windows\System32\AddCat.exe

2011-09-27 00:41:30 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Roaming\Roxio Log Files

2011-09-27 00:40:49 -------- d-----w- C:\Windows\System32\appmgmt

2011-09-27 00:34:31 -------- d-----w- C:\Program Files (x86)\Common Files\Creative Labs Shared

2011-09-27 00:24:29 -------- d-----w- C:\Windows\SysWow64\Wat

2011-09-27 00:24:29 -------- d-----w- C:\Windows\System32\Wat

2011-09-27 00:23:29 -------- d-----w- C:\Program Files (x86)\OpenAL

2011-09-27 00:19:36 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\Thunderbird

2011-09-26 23:08:06 288768 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys

2011-09-26 23:07:51 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

2011-09-26 23:07:51 2048 ----a-w- C:\Windows\System32\tzres.dll

2011-09-26 22:29:07 -------- d-----w- C:\Program Files (x86)\Common Files\Intel Corporation

2011-09-26 20:25:31 -------- d-----w- C:\Netgear

2011-09-26 20:23:03 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Roaming\Macrovision

2011-09-26 19:19:32 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\Diagnostics

2011-09-26 19:15:09 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\Nero_AG

2011-09-26 18:45:16 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\Dell

2011-09-26 18:45:11 -------- d-sh--w- C:\System Recovery

2011-09-26 18:44:26 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Roaming\Fingertapps

2011-09-26 18:44:25 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Roaming\Dell

2011-09-26 18:44:13 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Roaming\Dell Touch Zone

2011-09-26 18:44:03 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Roaming\Intel Corporation

2011-09-26 18:43:26 -------- d-----r- C:\Users\Wayne-Rhonda\Virtual Machines

2011-09-26 18:43:06 -------- d-----w- C:\Users\Wayne-Rhonda\AppData\Local\VirtualStore

.

==================== Find3M ====================

.

2011-10-04 15:38:41 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2011-09-27 01:40:13 29480 ----a-w- C:\Windows\SysWow64\msxml3a.dll

2011-09-27 01:40:12 505128 ----a-w- C:\Windows\SysWow64\msvcp71.dll

2011-09-27 01:40:12 353576 ----a-w- C:\Windows\SysWow64\msvcr71.dll

2011-09-27 00:23:29 466520 ----a-w- C:\Windows\System32\wrap_oal.dll

2011-09-27 00:23:29 445016 ----a-w- C:\Windows\SysWow64\wrap_oal.dll

2011-09-27 00:23:29 123480 ----a-w- C:\Windows\System32\OpenAL32.dll

2011-09-27 00:23:28 109144 ----a-w- C:\Windows\SysWow64\OpenAL32.dll

2011-09-15 22:46:06 86528 ----a-w- C:\Windows\SysWow64\iesysprep.dll

2011-09-15 21:24:48 521448 ----a-w- C:\Windows\System32\deployJava1.dll

2011-09-01 05:24:07 2309120 ----a-w- C:\Windows\System32\jscript9.dll

2011-09-01 05:17:57 1389056 ----a-w- C:\Windows\System32\wininet.dll

2011-09-01 05:12:04 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

2011-09-01 02:35:59 1798144 ----a-w- C:\Windows\SysWow64\jscript9.dll

2011-09-01 02:28:15 1126912 ----a-w- C:\Windows\SysWow64\wininet.dll

2011-09-01 02:22:54 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2011-08-19 22:59:28 158832 ----a-w- C:\Windows\System32\mfevtps.exe

2011-08-15 17:00:06 9984 ----a-w- C:\Windows\System32\drivers\mfeclnk.sys

2011-08-15 17:00:06 75672 ----a-w- C:\Windows\System32\drivers\mfenlfk.sys

2011-08-15 17:00:06 65128 ----a-w- C:\Windows\System32\drivers\cfwids.sys

2011-08-15 17:00:06 642824 ----a-w- C:\Windows\System32\drivers\mfehidk.sys

2011-08-15 17:00:06 481504 ----a-w- C:\Windows\System32\drivers\mfefirek.sys

2011-08-15 17:00:06 283744 ----a-w- C:\Windows\System32\drivers\mfewfpk.sys

2011-08-15 17:00:06 228752 ----a-w- C:\Windows\System32\drivers\mfeavfk.sys

2011-08-15 17:00:06 158584 ----a-w- C:\Windows\System32\drivers\mfeapfk.sys

2011-08-15 17:00:06 100904 ----a-w- C:\Windows\System32\drivers\mferkdet.sys

2011-08-03 10:31:54 311912 ----a-w- C:\Windows\SysWow64\nvStreaming.exe

.

============= FINISH: 14:34:12.02 ===============