my computer is infected please help

sba6x · October 15, 2011

Please help me clean my computer...

sba6x · October 15, 2011

Hi,

This is a great service that you guys are providing and I plan on getting MBAM Pro. I got a virus recently, AV guard was coming up a lot. All my desktop icons, system files, and programs in start menu are gone/"hidden". I know they are still there because I see my antivirus (Trend micro) and MBAM scan through them on C: drive, but I can not access them. I was able to stop AV Guard with Rkill and cleaned a lot out with MBAM. I still can't see my files and my windows firewall is disabled and I can't activate it (and who knows what else is wrong). Could you please, please help me get my computer back to normal?

Below are the MBAM and DDS logs. I updated and did a quick scan with MBAM. Thanks in advance for you help...

(sorry for the first post, for some reason when I try to copy paste the logs it says connection was reset when I try to post, so I'm going to post it as I can...)

sba6x · October 15, 2011

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 7950

Windows 6.1.7600

Internet Explorer 9.0.8112.16421

10/14/2011 10:12:12 PM

mbam-log-2011-10-14 (22-12-12).txt

Scan type: Quick scan

Objects scanned: 201381

Time elapsed: 4 minute(s), 51 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

sba6x · October 15, 2011

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421

Run by owner at 21:53:16 on 2011-10-14

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3959.2123 [GMT -4:00]

.

AV: Trend Micro AntiVirus *Enabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}

SP: Trend Micro AntiVirus *Enabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\windows\system32\wininit.exe

C:\windows\system32\lsm.exe

C:\windows\system32\svchost.exe -k DcomLaunch

C:\windows\system32\nvvsvc.exe

C:\windows\system32\svchost.exe -k RPCSS

C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\windows\system32\svchost.exe -k netsvcs

C:\windows\system32\svchost.exe -k LocalService

C:\windows\system32\svchost.exe -k NetworkService

C:\windows\system32\nvvsvc.exe

C:\windows\System32\spoolsv.exe

C:\windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\windows\SysWOW64\svchost.exe -k hpdevmgmt

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\windows\System32\svchost.exe -k HPZ12

C:\windows\system32\Dwm.exe

C:\Program Files (x86)\GenArts\rlm\rlm.exe

C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE

C:\windows\Explorer.EXE

C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe

C:\windows\system32\svchost.exe -k imgsvc

C:\windows\system32\ThpSrv.exe

C:\Windows\system32\TODDSrv.exe

C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

C:\Program Files\TOSHIBA\TECO\TecoService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\windows\system32\SearchIndexer.exe

C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Program Files\TOSHIBA\TECO\Teco.exe

C:\Windows\System32\ThpSrv.exe

C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe

C:\windows\system32\taskeng.exe

C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe

C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe

C:\windows\system32\svchost.exe -k HPService

C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

C:\Program Files\TOSHIBA\FlashCards\Hotkey\TcrdKBB.exe

C:\Windows\System32\ctfmon.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe

C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe

C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

C:\windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe

C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe

C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe

C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe

C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

C:\Program Files\Trend Micro\BM\TMBMSRV.exe

C:\windows\system32\svchost.exe -k SDRSVC

C:\windows\SysWOW64\ping.exe

C:\windows\system32\conhost.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\windows\hh.exe

C:\windows\system32\wbem\wmiprvse.exe

C:\windows\system32\taskeng.exe

C:\windows\system32\SearchProtocolHost.exe

C:\windows\system32\SearchFilterHost.exe

C:\windows\system32\DllHost.exe

C:\windows\SysWOW64\cmd.exe

C:\windows\system32\conhost.exe

C:\windows\SysWOW64\cscript.exe

C:\windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA

uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA

mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA

mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA

uInternet Settings,ProxyOverride = <local>

BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MIF5BA~1\Office14\GROOVEEX.DLL

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL

BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll

uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

uRun: [Jing] C:\Program Files (x86)\TechSmith\Jing\Jing.exe

uRun: [AdobeBridge]

uRun: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

mRun: [TUSBSleepChargeSrv] %ProgramFiles(x86)%\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe

mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60

mRun: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun

mRun: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe

mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe

mRun: [<NO NAME>]

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

mRun: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin

mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume

mRun: [bCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)

uPolicies-explorer: HideSCAHealth = 1 (0x1)

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: EnableLinkedConnections = 1 (0x1)

dPolicies-system: DisableTaskMgr = 1 (0x1)

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

LSP: mswsock.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://juniper.net/dana-cached/sc/JuniperSetupClient.cab

TCP: DhcpNameServer = 68.87.77.134 68.87.72.134

TCP: Interfaces\{72A1FE2D-A0C1-4590-9A78-D3F07E740F34} : DhcpNameServer = 192.168.15.1

TCP: Interfaces\{D0BDCBBD-9EE4-46F5-8366-EA4784E2E4B8} : DhcpNameServer = 68.87.77.134 68.87.72.134

TCP: Interfaces\{D0BDCBBD-9EE4-46F5-8366-EA4784E2E4B8}\D4E454B42514D4 : DhcpNameServer = 192.168.1.254

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MIF5BA~1\Office14\GROOVEEX.DLL

SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2 sxssrv,4

BHO-X64: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

BHO-X64: HP Print Enhancer - No File

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MIF5BA~1\Office14\GROOVEEX.DLL

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO-X64: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll

BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL

BHO-X64: URLRedirectionBHO - No File

BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

BHO-X64: HP Smart BHO Class - No File

TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File

mRun-x64: [TUSBSleepChargeSrv] %ProgramFiles(x86)%\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe

mRun-x64: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun-x64: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60

mRun-x64: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun

mRun-x64: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe

mRun-x64: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe

mRun-x64: [(Default)]

mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun-x64: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

mRun-x64: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin

mRun-x64: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume

mRun-x64: [bCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices

mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MIF5BA~1\Office14\GROOVEEX.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\i5yauydc.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IPGTDF&PC=IPGTDF&q=

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IPGTDF&PC=IPGTDF&q=

FF - plugin: C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL

FF - plugin: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npicaN.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npMozCouponPrinter.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Users\owner\AppData\Roaming\Move Networks\plugins\npqmp071701000002.dll

FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Xmarks: foxmarks@kei.com - %profile%\extensions\foxmarks@kei.com

FF - Ext: Qute: {36C13C8F-54F1-412e-8177-2E411719162D} - %profile%\extensions\{36C13C8F-54F1-412e-8177-2E411719162D}

FF - Ext: Qute 3++ (custom mod): {aa26583b-4c35-4729-913e-156956078824} - %profile%\extensions\{aa26583b-4c35-4729-913e-156956078824}

FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

FF - Ext: Apture: plugin@apture.com - %profile%\extensions\plugin@apture.com

FF - Ext: Move Media Player: moveplayer@movenetworks.com - C:\Users\owner\AppData\Roaming\Move Networks

.

============= SERVICES / DRIVERS ===============

.

R0 PxHlpa64;PxHlpa64;C:\windows\system32\Drivers\PxHlpa64.sys --> C:\windows\system32\Drivers\PxHlpa64.sys [?]

R0 Thpdrv;TOSHIBA HDD Protection Driver;C:\windows\system32\DRIVERS\thpdrv.sys --> C:\windows\system32\DRIVERS\thpdrv.sys [?]

R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;C:\windows\system32\DRIVERS\Thpevm.SYS --> C:\windows\system32\DRIVERS\Thpevm.SYS [?]

R0 tos_sps64;TOSHIBA tos_sps64 Service;C:\windows\system32\DRIVERS\tos_sps64.sys --> C:\windows\system32\DRIVERS\tos_sps64.sys [?]

R1 NEOFLTR_650_15977;Juniper Networks TDI Filter Driver (NEOFLTR_650_15977);\??\C:\windows\system32\Drivers\NEOFLTR_650_15977.SYS --> C:\windows\system32\Drivers\NEOFLTR_650_15977.SYS [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\windows\system32\DRIVERS\vwififlt.sys --> C:\windows\system32\DRIVERS\vwififlt.sys [?]

R2 cfWiMAXService;ConfigFree WiMAX Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2009-10-28 252784]

R2 ConfigFree Service;ConfigFree Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-3-10 46448]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-12-9 13336]

R2 RLM-GenArts;RLM-GenArts;C:\Program Files (x86)\GenArts\rlm\rlm.exe [2010-8-22 1540096]

R2 tmpreflt;tmpreflt;C:\windows\system32\DRIVERS\tmpreflt.sys --> C:\windows\system32\DRIVERS\tmpreflt.sys [?]

R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;C:\Program Files\TOSHIBA\TECO\TecoService.exe [2009-9-28 251760]

R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;C:\windows\system32\DRIVERS\TVALZFL.sys --> C:\windows\system32\DRIVERS\TVALZFL.sys [?]

R2 UNS;Intel® Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2009-12-9 2314240]

R3 FwLnk;FwLnk Driver;C:\windows\system32\DRIVERS\FwLnk.sys --> C:\windows\system32\DRIVERS\FwLnk.sys [?]

R3 HECIx64;Intel® Management Engine Interface;C:\windows\system32\DRIVERS\HECIx64.sys --> C:\windows\system32\DRIVERS\HECIx64.sys [?]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\windows\system32\drivers\nvhda64v.sys --> C:\windows\system32\drivers\nvhda64v.sys [?]

R3 PGEffect;Pangu effect driver;C:\windows\system32\DRIVERS\pgeffect.sys --> C:\windows\system32\DRIVERS\pgeffect.sys [?]

R3 RTL8167;Realtek 8167 NT Driver;C:\windows\system32\DRIVERS\Rt64win7.sys --> C:\windows\system32\DRIVERS\Rt64win7.sys [?]

R3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;C:\windows\system32\DRIVERS\rtl8192se.sys --> C:\windows\system32\DRIVERS\rtl8192se.sys [?]

R3 TMachInfo;TMachInfo;C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-12-9 51512]

R3 TmProxy;Trend Micro Proxy Service;C:\Program Files\Trend Micro\Internet Security\TmProxy.exe [2010-2-16 917768]

R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-11-5 137560]

R3 TPCHSrv;TPCH Service;C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [2009-11-10 824688]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\windows\system32\DRIVERS\vwifimp.sys --> C:\windows\system32\DRIVERS\vwifimp.sys [?]

S2 BrowserSeek Service;BrowserSeek Service;"C:\Program Files (x86)\BrowserSeek\browserseek.exe" "C:\Program Files (x86)\BrowserSeek\browserseek.dll" datasugiq joruhife --> C:\Program Files (x86)\BrowserSeek\browserseek.exe [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-2-15 135664]

S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-2-28 183560]

S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-2-15 135664]

S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-6-12 31125880]

S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]

S3 SrvHsfHDA;SrvHsfHDA;C:\windows\system32\DRIVERS\VSTAZL6.SYS --> C:\windows\system32\DRIVERS\VSTAZL6.SYS [?]

S3 SrvHsfV92;SrvHsfV92;C:\windows\system32\DRIVERS\VSTDPV6.SYS --> C:\windows\system32\DRIVERS\VSTDPV6.SYS [?]

S3 SrvHsfWinac;SrvHsfWinac;C:\windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\windows\system32\DRIVERS\VSTCNXT6.SYS [?]

S3 StorSvc;Storage Service;C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]

S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\system32\Wat\WatAdminSvc.exe --> C:\windows\system32\Wat\WatAdminSvc.exe [?]

.

=============== Created Last 30 ================

.

2011-10-13 16:35:17 -------- d-----w- C:\windows\System32\SPReview

2011-10-13 16:32:56 -------- d-----w- C:\windows\System32\EventProviders

2011-10-12 01:20:25 414368 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl

2011-10-10 12:29:54 64000 ----a-w- C:\windows\SysWow64\vtxA0ucS2b.exe

2011-10-10 12:29:51 128000 ----a-w- C:\windows\SysWow64\NcS13F4am5W7E8R.exe

2011-10-10 12:29:50 384000 ----a-w- C:\windows\SysWow64\jZqjYCwkVl.exe

2011-10-10 12:29:46 128000 ----a-w- C:\windows\SysWow64\u9gTjCwkrOPSb3G.exe

2011-10-10 12:29:40 2688000 ----a-w- C:\windows\SysWow64\XH6LYeVONx0c3nQ.exe

2011-10-10 03:55:20 -------- d-----w- C:\Program Files\Malwarebytes' Anti-Malware

2011-10-10 03:43:17 -------- d-----w- C:\Program Files (x86)\Setup Support for Browser Seek

2011-10-09 01:59:57 -------- d-----w- C:\Users\owner\AppData\Roaming\ssWJ7dEL8RqYwUP

2011-10-09 01:59:55 -------- d-----w- C:\Users\owner\AppData\Roaming\rhTXqjUCeIrOySn

2011-10-09 01:59:49 -------- d-----w- C:\Users\owner\AppData\Roaming\y4GJdKfZ9XUeINu

2011-10-09 01:59:45 -------- d-----w- C:\Users\owner\AppData\Roaming\E9TXjUCekzyAu2b

2011-10-09 01:59:14 -------- d-----w- C:\Users\owner\AppData\Roaming\XP0ycS1iv3n4mEw

2011-10-09 01:59:14 -------- d-----w- C:\Users\owner\AppData\Roaming\PXwezP0yc1vgUeI

2011-10-09 01:59:14 -------- d-----w- C:\Users\owner\AppData\Roaming\avD2onF4pHsJdKg

2011-10-09 01:59:13 -------- d-----w- C:\Users\owner\AppData\Roaming\R4aQ6sWKZwNx0c1

2011-10-09 01:58:38 -------- d-----w- C:\Users\owner\AppData\Roaming\lK7fRL9gTqYt

2011-10-09 01:58:38 -------- d-----w- C:\Users\owner\AppData\Roaming\l4aQH6sWKfLgtPu

2011-10-09 01:58:17 -------- d-----w- C:\Users\owner\AppData\Roaming\XA2o3pmG56fLhXj

2011-10-09 01:58:16 -------- d-----w- C:\Users\owner\AppData\Roaming\oUlOBt0ioHs

2011-10-09 01:58:12 -------- d-----w- C:\Users\owner\AppData\Roaming\D5sQJ6E8RlNA23G

2011-10-09 01:58:10 -------- d-----w- C:\Users\owner\AppData\Roaming\uYOPSiD3o4s7

2011-10-09 01:57:29 -------- d-----w- C:\Users\owner\AppData\Roaming\gzv2ibF3pGK9z0c

2011-10-09 01:57:27 -------- d-----w- C:\Users\owner\AppData\Roaming\ysLhXkUVOyvnQgw

2011-10-09 01:57:14 -------- d-----w- C:\Users\owner\AppData\Roaming\JF5K8LqkO2b3

2011-10-09 01:57:13 -------- d-----w- C:\Users\owner\AppData\Roaming\LOBt0iopsK9UeB

2011-10-09 01:56:46 -------- d-----w- C:\Users\owner\AppData\Roaming\YbWXOxc2DGHfTCr

2011-10-09 01:56:36 -------- d-----w- C:\Users\owner\AppData\Roaming\agTXqjYVNAbpGQs

2011-10-09 01:56:35 -------- d-----w- C:\Users\owner\AppData\Roaming\OZ9hXwlzxFm5Q6W

2011-10-09 01:56:27 -------- d-----w- C:\Users\owner\AppData\Roaming\jwP13sZOyi

2011-10-09 01:56:24 -------- d-----w- C:\Users\owner\AppData\Roaming\whlAnJXPupEhB

2011-10-09 01:56:07 -------- d-----w- C:\Users\owner\AppData\Roaming\LF56dWKRLjIzxSb

2011-10-09 01:56:05 -------- d-----w- C:\Users\owner\AppData\Roaming\kDpGsQdfZXl

2011-10-09 01:55:37 -------- d-----w- C:\Users\owner\AppData\Roaming\uN1vS2bF3GdRTqU

2011-10-09 01:55:35 -------- d-----w- C:\Users\owner\AppData\Roaming\hEL8getpHd8R9Yw

2011-10-09 01:55:18 -------- d-----w- C:\Users\owner\AppData\Roaming\wlyvo3Jd9qjCB2K

2011-10-09 01:55:15 -------- d-----w- C:\Users\owner\AppData\Roaming\zHfgCVOP1F57ZXU

2011-10-09 01:55:01 -------- d-----w- C:\Users\owner\AppData\Roaming\aD68wx1H7RXkVlB

2011-10-09 01:54:54 -------- d-----w- C:\Users\owner\AppData\Roaming\O4HsK77E9gqYwOA

2011-10-09 01:54:52 -------- d-----w- C:\Users\owner\AppData\Roaming\HVyndkz2nHEhtDb

2011-10-09 01:54:49 -------- d-----w- C:\Users\owner\AppData\Roaming\l7jkVrtxAubH7Tq

2011-10-09 01:54:32 -------- d-----w- C:\Users\owner\AppData\Roaming\vP0ycS1iv3nYwUe

2011-10-09 01:54:24 -------- d-----w- C:\Users\owner\AppData\Roaming\Q5aQJ6dWKf9qBNx

2011-10-09 01:54:19 -------- d-----w- C:\Users\owner\AppData\Roaming\LCekIrNA0Sip5Q6

2011-10-09 01:54:19 -------- d-----w- C:\Users\owner\AppData\Roaming\GzPNycAuvb59eAo

2011-10-09 01:54:05 -------- d-----w- C:\Users\owner\AppData\Roaming\DyxA0uvS27qYeIr

2011-10-09 01:54:00 -------- d-----w- C:\Users\owner\AppData\Roaming\x9hTlASFmJ8R9Xj

2011-10-09 01:53:48 -------- d-----w- C:\Users\owner\AppData\Roaming\GSm5sERYV14sE

2011-10-09 01:53:42 -------- d-----w- C:\Users\owner\AppData\Roaming\zCkUVrlOBx0c1

2011-10-09 01:53:31 -------- d-----w- C:\Users\owner\AppData\Roaming\GXCeIApfB0

2011-10-09 01:53:29 -------- d-----w- C:\Users\owner\AppData\Roaming\nwUVelP12m7E8ZY

2011-10-09 01:53:03 -------- d-----w- C:\Users\owner\AppData\Roaming\m4amH6sWJLqkrBx

2011-10-09 01:53:02 -------- d-----w- C:\Users\owner\AppData\Roaming\gib3pn4QHsKfLg

2011-10-09 01:52:42 -------- d-----w- C:\Users\owner\AppData\Roaming\qK7fRLgXeOtAubn

2011-10-09 01:52:41 -------- d-----w- C:\Users\owner\AppData\Roaming\blrzPNyxAv3GJRh

2011-10-09 01:52:25 -------- d-----w- C:\Users\owner\AppData\Roaming\wrlOtxP0yS

2011-10-09 01:52:24 -------- d-----w- C:\Users\owner\AppData\Roaming\N7fEL9gTZjCkVOt

2011-10-09 01:52:24 -------- d-----w- C:\Users\owner\AppData\Roaming\GxP0ucSinJTqYwU

2011-10-09 01:52:22 -------- d-----w- C:\Users\owner\AppData\Roaming\vVyo5gBup6e1p

2011-10-09 01:51:55 -------- d-----w- C:\Users\owner\AppData\Roaming\qSboGamH6WfLgZY

2011-10-09 01:51:54 -------- d-----w- C:\Users\owner\AppData\Roaming\NdK7fRLgTqCzuDG

2011-10-09 01:51:31 -------- d-----w- C:\Users\owner\AppData\Roaming\Y5WTriHjlbswvsd

2011-10-09 01:51:30 -------- d-----w- C:\Users\owner\AppData\Roaming\agYCekIVrN03467

2011-10-09 01:51:29 -------- d-----w- C:\Users\owner\AppData\Roaming\VelIBrzPNx1v25L

2011-10-09 01:51:28 -------- d-----w- C:\Users\owner\AppData\Roaming\dycA1uvD2

2011-10-09 01:50:54 -------- d-----w- C:\Users\owner\AppData\Roaming\kAv2b4msJEZXCBN

2011-10-09 01:50:37 -------- d-----w- C:\Users\owner\AppData\Roaming\WucS1ibDm6YUtyS

2011-10-09 01:50:30 -------- d-----w- C:\Users\owner\AppData\Roaming\JEK8fRZ9h

2011-10-09 01:50:29 -------- d-----w- C:\Users\owner\AppData\Roaming\ZRZ9hYXwjVlBzNc

2011-10-09 01:50:29 -------- d-----w- C:\Users\owner\AppData\Roaming\tD2onF4pm5QdgZh

2011-10-09 01:50:24 -------- d-----w- C:\Users\owner\AppData\Roaming\zL8gTZqhYwUrOtP

2011-10-09 01:50:24 -------- d-----w- C:\Users\owner\AppData\Roaming\uXwjUVelItNc1v2

2011-10-09 01:50:22 -------- d-----w- C:\Users\owner\AppData\Roaming\OgTXqjYCeIrOt

2011-10-09 01:50:08 -------- d-----w- C:\Users\owner\AppData\Roaming\KxP0ycS1i3

2011-10-09 01:50:08 -------- d-----w- C:\Users\owner\AppData\Roaming\CwkIVrlONxuSiDo

2011-10-09 01:48:59 -------- d-----w- C:\Users\owner\AppData\Roaming\FnG4aQH6sKE9TqY

2011-10-09 01:47:48 -------- d-----w- C:\Users\owner\AppData\Roaming\U8gRZqhYXkVlBz

2011-10-09 01:46:58 -------- d-----w- C:\Users\owner\AppData\Roaming\FL9gTZqjYwIrOtP

2011-10-09 01:45:59 -------- d-----w- C:\Users\owner\AppData\Roaming\nL9gTXqjYeIrOAS

2011-10-09 01:44:59 -------- d-----w- C:\Users\owner\AppData\Roaming\WTXwjUCelBzNx1S

2011-10-09 01:43:58 -------- d-----w- C:\Users\owner\AppData\Roaming\LTUrlOBt0Si

2011-10-09 01:42:59 -------- d-----w- C:\Users\owner\AppData\Roaming\FVrzONtx0c2b

2011-10-09 01:41:59 -------- d-----w- C:\Users\owner\AppData\Roaming\iH5sQJ7dE8RhX

2011-10-09 01:40:58 -------- d-----w- C:\Users\owner\AppData\Roaming\QfRL9gTXqYeIrOt

2011-10-09 01:39:59 -------- d-----w- C:\Users\owner\AppData\Roaming\i6dWK7fRLgXjCkV

2011-10-09 01:38:56 -------- d-----w- C:\Users\owner\AppData\Roaming\HrzPNyxA1v2b3m5

2011-10-09 01:37:59 -------- d-----w- C:\Users\owner\AppData\Roaming\R0ucS1ibDoGaHsJ

2011-10-09 01:36:56 -------- d-----w- C:\Users\owner\AppData\Roaming\AmH6sWJ7f

2011-10-09 01:35:59 -------- d-----w- C:\Users\owner\AppData\Roaming\aycA1ivDn4

2011-10-09 01:34:54 -------- d-----w- C:\Users\owner\AppData\Roaming\mThwUltci3n4Hs7

2011-10-09 01:34:42 -------- d-----w- C:\Users\owner\AppData\Roaming\K3pmG5aQJdKfL

2011-10-09 01:34:41 -------- d-----w- C:\Users\owner\AppData\Roaming\SelOBtzP0c

2011-10-09 01:34:38 -------- d-----w- C:\Users\owner\AppData\Roaming\FWWK7fRL9TqY

2011-10-09 01:34:33 -------- d-----w- C:\Users\owner\AppData\Roaming\EHHH6ssWK7fE9gZ

2011-10-09 01:34:28 -------- d-----w- C:\Users\owner\AppData\Roaming\RnG5aQH6dKfLgXj

2011-10-09 01:34:26 -------- d-----w- C:\Users\owner\AppData\Roaming\kgRZqhYXwUeOtP

2011-10-09 01:34:22 -------- d-----w- C:\Users\owner\AppData\Roaming\fVelIBtzPyAuD

2011-10-09 01:34:18 -------- d-----w- C:\Users\owner\AppData\Roaming\KG5aQJ6dW8R9TqU

2011-10-09 01:34:15 -------- d-----w- C:\Users\owner\AppData\Roaming\mA0uS2ibDpGaHsK

2011-10-09 01:34:10 -------- d-----w- C:\Users\owner\AppData\Roaming\S2ibD3pnGaHsKfL

2011-10-09 01:34:06 -------- d-----w- C:\Users\owner\AppData\Roaming\e0ucS2ibDpGaHs

2011-10-09 01:32:59 -------- d-----w- C:\Users\owner\AppData\Roaming\zi2np5JEg9XUl

2011-10-09 01:32:59 -------- d-----w- C:\Users\owner\AppData\Roaming\hDpJK9YjeIzu2bp

2011-10-09 01:32:59 -------- d-----w- C:\Users\owner\AppData\Roaming\FycA1DoFm5Jd

2011-10-09 01:32:52 -------- d-----w- C:\Users\owner\AppData\Roaming\fx0Si3n4HsJE8ZY

2011-10-09 01:32:46 -------- d-----w- C:\Users\owner\AppData\Roaming\b9XjCkBzNAv

2011-10-09 01:32:44 -------- d-----w- C:\Users\owner\AppData\Roaming\mbp5QW79XjeVOx0

2011-10-09 01:32:41 -------- d-----w- C:\Users\owner\AppData\Roaming\gDbp5JEfZTjeIz

2011-10-09 01:32:36 -------- d-----w- C:\Users\owner\AppData\Roaming\aa6WfLTjCkBxv

2011-10-09 01:32:33 -------- d-----w- C:\Users\owner\AppData\Roaming\lG4aQH6sW7E9TqY

2011-10-09 01:32:27 -------- d-----w- C:\Users\owner\AppData\Roaming\qONyxA0uv2b3

2011-10-09 01:32:23 -------- d-----w- C:\Users\owner\AppData\Roaming\gVelIBtzPyAuDo

2011-10-09 01:32:16 -------- d-----w- C:\Users\owner\AppData\Roaming\o5sQJ7dEKgZhXj

2011-10-09 01:32:05 -------- d-----w- C:\Users\owner\AppData\Roaming\sivD2onF4m5Q7E8

2011-10-09 01:30:59 -------- d-----w- C:\Users\owner\AppData\Roaming\oxA0uvS2iFpGaJd

2011-10-09 01:29:59 -------- d-----w- C:\Users\owner\AppData\Roaming\c0ycA1ivDoFp

2011-10-09 01:28:59 -------- d-----w- C:\Users\owner\AppData\Roaming\YWK7fEL9gZjCkVl

2011-10-09 01:13:07 -------- d-----w- C:\Users\owner\AppData\Roaming\yH5sQJ7dE8R9YwU

2011-10-09 01:13:07 -------- d-----w- C:\Users\owner\AppData\Roaming\GpH5sQJ7dKgZhXj

2011-10-09 01:13:06 -------- d-----w- C:\Users\owner\AppData\Roaming\cH5sQJ7dE

2011-10-09 01:13:06 -------- d-----w- C:\Users\owner\AppData\Roaming\A5sQJ7dEK

2011-10-09 01:12:13 -------- d-----w- C:\Users\owner\AppData\Roaming\NVelIBtzPyA

2011-10-09 01:12:12 -------- d-----w- C:\Users\owner\AppData\Roaming\cycS1ivD3

2011-10-09 01:12:10 -------- d-----w- C:\Users\owner\AppData\Roaming\BuvS2ibF3n5Q6W7

2011-10-09 01:12:07 -------- d-----w- C:\Users\owner\AppData\Roaming\sVrlONtxPuSiDoG

2011-10-09 01:12:03 -------- d-----w- C:\Users\owner\AppData\Roaming\vnG4amH6sJfLg

2011-10-09 01:10:46 -------- d-----w- C:\Users\owner\AppData\Roaming\BycA1uvD2b4m5Q6

2011-10-09 01:10:45 -------- d-----w- C:\Users\owner\AppData\Roaming\KgTZqhYCwUrOtPy

2011-10-09 01:10:43 -------- d-----w- C:\Users\owner\AppData\Roaming\oXqjYCekIrO

2011-10-09 01:10:35 -------- d-----w- C:\Users\owner\AppData\Roaming\scS1ibD3oGa

2011-10-09 01:10:25 -------- d-----w- C:\Users\owner\AppData\Roaming\uZqhYCwkU

2011-10-09 01:10:23 -------- d-----w- C:\Users\owner\AppData\Roaming\GtxA0ucS2b

2011-10-09 01:10:21 -------- d-----w- C:\Users\owner\AppData\Roaming\XK8gRZ9hYw

2011-10-09 01:10:20 -------- d-----w- C:\Users\owner\AppData\Roaming\WJ7dEL8gRqYw

2011-10-09 01:10:20 -------- d-----w- C:\Users\owner\AppData\Roaming\G1ibD3onGaHsJfL

2011-10-09 01:10:16 -------- d-----w- C:\Users\owner\AppData\Roaming\w2onF4pmHsJdK

2011-10-09 01:10:13 -------- d-----w- C:\Users\owner\AppData\Roaming\mibF3pnG5Q6W7

2011-10-09 01:10:10 -------- d-----w- C:\Users\owner\AppData\Roaming\S6sWK7fELgZjC

2011-10-09 01:10:07 -------- d-----w- C:\Users\owner\AppData\Roaming\qPNyxA1uv

2011-10-09 01:08:58 -------- d-----w- C:\Users\owner\AppData\Roaming\t4amH5sWJd

2011-10-09 01:08:57 -------- d-----w- C:\Users\owner\AppData\Roaming\UG4amH6sW7E8Tq

2011-10-09 01:08:53 -------- d-----w- C:\Users\owner\AppData\Roaming\gucS1ibD3n4m6W7

2011-10-09 01:08:44 -------- d-----w- C:\Users\owner\AppData\Roaming\GZ9hYXwjUe

2011-10-09 01:08:39 -------- d-----w- C:\Users\owner\AppData\Roaming\NG5aQH6dW7R9Tq

2011-10-09 01:08:33 -------- d-----w- C:\Users\owner\AppData\Roaming\HYCwkUVrlBx0c1

2011-10-09 01:08:33 -------- d-----w- C:\Users\owner\AppData\Roaming\baQH6sWK7E9TqYw

2011-10-09 01:04:55 -------- d-----w- C:\Users\owner\AppData\Roaming\wAA0uvS2iF3pG

2011-10-09 01:03:59 -------- d-----w- C:\Users\owner\AppData\Roaming\UivD2onF4m5Q7Rh

2011-10-08 19:53:35 -------- d-----w- C:\Users\owner\AppData\Roaming\hZjwIrNP0c1b3Ga

2011-10-08 19:53:10 -------- d-----w- C:\Users\owner\AppData\Roaming\hYIrOxP0uSiDoGa

2011-10-08 19:53:00 -------- d-----w- C:\Users\owner\AppData\Roaming\JG4amH6sW7E8TqY

2011-10-08 19:52:50 -------- d-----w- C:\Users\owner\AppData\Roaming\kONtx0ucSiDoGa

2011-10-08 19:52:44 -------- d-----w- C:\Users\owner\AppData\Roaming\IobF3pmG5Q6W8R9

2011-10-08 19:52:09 -------- d-----w- C:\Users\owner\AppData\Roaming\KXwjUVelItPyAuD

2011-10-08 19:50:40 -------- d-----w- C:\Users\owner\AppData\Roaming\PwBu3sgjtnQTexu

2011-10-08 19:50:36 -------- d-----w- C:\Users\owner\AppData\Roaming\dRZ98Vvbms9rupf

2011-10-08 19:50:29 -------- d-----w- C:\Users\owner\AppData\Roaming\LrAmLDk1Ki608Aq

2011-10-08 19:50:27 -------- d-----w- C:\Users\owner\AppData\Roaming\glsOs4l63cw6cOq

2011-10-08 19:50:26 -------- d-----w- C:\Users\owner\AppData\Roaming\k1qDX3ShFtrdbrZ

2011-10-08 19:50:21 -------- d-----w- C:\Users\owner\AppData\Roaming\AN6k4ZB2shtoTnh

2011-10-08 19:50:11 -------- d-----w- C:\Users\owner\AppData\Roaming\nNhsGDVZdH1jpN7

2011-10-08 19:50:07 -------- d-----w- C:\Users\owner\AppData\Roaming\EAw4z9bk5rgaV

2011-10-08 19:50:02 -------- d-----w- C:\Users\owner\AppData\Roaming\J58WDk97i

2011-10-08 19:50:01 -------- d-----w- C:\Users\owner\AppData\Roaming\J4zW3Usvq

2011-10-08 19:49:58 -------- d-----w- C:\Users\owner\AppData\Roaming\rPROYQAFu4dCfBD

2011-10-08 19:49:47 -------- d-----w- C:\Users\owner\AppData\Roaming\Y6Bp7l1mWjSEP7S

2011-10-08 19:49:34 -------- d-----w- C:\Users\owner\AppData\Roaming\frE0dNHSdI5cd

2011-10-08 19:49:31 -------- d-----w- C:\Users\owner\AppData\Roaming\j3VJx9iCHrWDX4I

2011-10-08 19:49:12 -------- d-----w- C:\Users\owner\AppData\Roaming\PYcEjt3RzGTtseG

2011-10-08 19:49:01 -------- d-----w- C:\Users\owner\AppData\Roaming\t1JVbLxHkofOoZx

2011-10-08 19:48:56 -------- d-----w- C:\Users\owner\AppData\Roaming\lqc7rQVFwFqigy6

2011-10-08 19:48:52 -------- d-----w- C:\Users\owner\AppData\Roaming\Lv8r3LIb9xa9Ad

2011-10-08 19:48:39 -------- d-----w- C:\Users\owner\AppData\Roaming\bNodeSQZOoKIiJw

2011-10-08 19:48:38 -------- d-----w- C:\Users\owner\AppData\Roaming\WrvaT0FKY0FgNpE

2011-10-08 19:48:33 -------- d-----w- C:\Users\owner\AppData\Roaming\bAG8C04ZziW

2011-10-08 19:48:14 -------- d-----w- C:\Users\owner\AppData\Roaming\NYxDpfjV0SHRriW

2011-10-08 19:48:09 -------- d-----w- C:\Users\owner\AppData\Roaming\LLLqYCI2adZB0Da

2011-10-08 19:46:59 -------- d-----w- C:\Users\owner\AppData\Roaming\V89lPAo5WLqIyS3

2011-10-08 19:45:58 -------- d-----w- C:\Users\owner\AppData\Roaming\O0cS1ivD3n4m5W7

2011-10-08 19:44:59 -------- d-----w- C:\Users\owner\AppData\Roaming\I4amH6sWJfLgZhC

2011-10-08 19:43:50 -------- d-----w- C:\Users\owner\AppData\Roaming\kyxA0uvS2b3n5Q

2011-10-08 19:42:59 -------- d-----w- C:\Users\owner\AppData\Roaming\yrOtySvo4HW7Lgq

2011-10-08 19:41:46 -------- d-----w- C:\Users\owner\AppData\Roaming\wUHyUvX3O93rmwv

2011-10-08 19:40:59 -------- d-----w- C:\Users\owner\AppData\Roaming\Zn9yR0aw3

2011-10-08 19:40:58 -------- d-----w- C:\Users\owner\AppData\Roaming\VLSL1RprJDqaCsS

2011-10-08 19:40:57 -------- d-----w- C:\Users\owner\AppData\Roaming\jP6IHe5r91UJx9S

2011-10-08 19:40:56 -------- d-----w- C:\Users\owner\AppData\Roaming\koQLN4LVDQX

2011-10-08 19:40:55 -------- d-----w- C:\Users\owner\AppData\Roaming\zzbsZeybKNDJUxn

2011-10-08 19:40:53 -------- d-----w- C:\Users\owner\AppData\Roaming\bL2YszQImlGNTDt

2011-10-08 19:40:51 -------- d-----w- C:\Users\owner\AppData\Roaming\u0oQLN4LV

2011-10-08 19:40:50 -------- d-----w- C:\Users\owner\AppData\Roaming\tAL2YszQImlGNTD

2011-10-08 19:40:49 -------- d-----w- C:\Users\owner\AppData\Roaming\BL2YszQImlGNT

2011-10-08 19:40:47 -------- d-----w- C:\Users\owner\AppData\Roaming\gFZB2QgkP26

2011-10-08 19:40:46 -------- d-----w- C:\Users\owner\AppData\Roaming\b3JhIuGgz2HTlcb

2011-10-08 19:40:45 -------- d-----w- C:\Users\owner\AppData\Roaming\rxFZB2Qgk

2011-10-08 19:40:44 -------- d-----w- C:\Users\owner\AppData\Roaming\g0hpj3kHxCJAwiY

2011-10-08 19:38:25 -------- d-----w- C:\Users\owner\AppData\Roaming\mr7SVWAZoC5z7

2011-10-08 19:38:09 -------- d-----w- C:\Users\owner\AppData\Roaming\O1LSXiqbhFOE1Tb

2011-10-08 19:36:59 -------- d-----w- C:\Users\owner\AppData\Roaming\SnF4amH5sJdLgZh

2011-10-08 19:35:58 -------- d-----w- C:\Users\owner\AppData\Roaming\FqjUCekIBzNx0v2

2011-10-08 19:34:58 -------- d-----w- C:\Users\owner\AppData\Roaming\PNycA1uvDoFpGsJ

2011-10-08 19:33:57 -------- d-----w- C:\Users\owner\AppData\Roaming\I7fEL9gTZjCkVlN

2011-10-08 19:32:59 -------- d-----w- C:\Users\owner\AppData\Roaming\ITZqjYCwk

2011-10-08 19:31:59 -------- d-----w- C:\Users\owner\AppData\Roaming\vZ9hTXwjUeIrPx1

2011-10-08 19:30:57 -------- d-----w- C:\Users\owner\AppData\Roaming\bn4msJEK8RqYwUe

2011-10-08 19:29:58 -------- d-----w- C:\Users\owner\AppData\Roaming\nonG4amH6

2011-10-08 19:28:24 -------- d-----w- C:\Users\owner\AppData\Roaming\j8gRZ9hYXj

2011-10-08 19:27:59 -------- d-----w- C:\Users\owner\AppData\Roaming\OUlt0ci2Fms7KRh

2011-10-08 19:26:57 -------- d-----w- C:\Users\owner\AppData\Roaming\JIwdn2rYWvlw

2011-10-08 19:26:55 -------- d-----w- C:\Users\owner\AppData\Roaming\VLplTHywQSBTHuk

2011-10-08 19:26:55 -------- d-----w- C:\Users\owner\AppData\Roaming\jgm2xULs30

2011-10-08 19:26:54 -------- d-----w- C:\Users\owner\AppData\Roaming\Wyze97QDPVR6FxV

2011-10-08 19:26:54 -------- d-----w- C:\Users\owner\AppData\Roaming\rTpO94lE1h4zWSe

2011-10-08 19:26:53 -------- d-----w- C:\Users\owner\AppData\Roaming\W1lRp0kK3Bqsbxe

2011-10-08 19:26:53 -------- d-----w- C:\Users\owner\AppData\Roaming\CU6bOXQuY7ie83x

2011-10-08 19:26:53 -------- d-----w- C:\Users\owner\AppData\Roaming\byU6bOXQuY7ie83

2011-10-08 19:26:53 -------- d-----w- C:\Users\owner\AppData\Roaming\bDt9GSVEGxY7puI

2011-10-08 19:26:52 -------- d-----w- C:\Users\owner\AppData\Roaming\WVJAhmkW2VJcYFl

2011-10-08 19:26:52 -------- d-----w- C:\Users\owner\AppData\Roaming\GEuw5rfDOEiwptK

2011-10-08 19:26:50 -------- d-----w- C:\Users\owner\AppData\Roaming\Jbo0NjJHDAPjgWH

2011-10-08 19:25:06 -------- d-----w- C:\Users\owner\AppData\Roaming\qWK8fRL9hXjCkBz

2011-10-08 19:25:05 -------- d-----w- C:\Users\owner\AppData\Roaming\qhTXwjUCeIrPyAu

2011-10-08 19:25:02 -------- d-----w- C:\Users\owner\AppData\Roaming\XxA0ucS2iDpGa

2011-10-08 19:25:02 -------- d-----w- C:\Users\owner\AppData\Roaming\cnG5aQH6d

2011-10-08 19:23:59 -------- d-----w- C:\Users\owner\AppData\Roaming\LekIBrzONx0

2011-10-08 19:22:47 -------- d-----w- C:\Users\owner\AppData\Roaming\UvD3onF4aHsJdLg

2011-10-08 19:21:59 -------- d-----w- C:\Users\owner\AppData\Roaming\zmsJdLgZYwUeO

2011-10-08 19:19:03 -------- d-----w- C:\Users\owner\AppData\Roaming\IF7kpEI1sCmZzF8

2011-10-08 19:17:59 -------- d-----w- C:\Users\owner\AppData\Roaming\KEgZhktyvnm5dgY

2011-10-08 19:16:59 -------- d-----w- C:\Users\owner\AppData\Roaming\UCzuFQ8XkNS

2011-10-08 19:16:56 -------- d-----w- C:\Users\owner\AppData\Roaming\BasETYUB013as

2011-10-08 19:16:55 -------- d-----w- C:\Users\owner\AppData\Roaming\ztPu1b3GaHsJfLg

2011-10-08 19:16:55 -------- d-----w- C:\Users\owner\AppData\Roaming\wOi5Re15ReybWUy

2011-10-08 19:16:55 -------- d-----w- C:\Users\owner\AppData\Roaming\ReAn7IxS4WgCluD

2011-10-08 19:16:53 -------- d-----w- C:\Users\owner\AppData\Roaming\HkyFEwNFEjP26q

2011-10-08 19:16:53 -------- d-----w- C:\Users\owner\AppData\Roaming\byAv3n4msdgZhX

2011-10-08 19:16:51 -------- d-----w- C:\Users\owner\AppData\Roaming\byA3n4m5JdLgZh

2011-10-08 19:16:49 -------- d-----w- C:\Users\owner\AppData\Roaming\LcLPQlpXvfzGqbf

2011-10-08 16:32:10 -------- d-----w- C:\Users\owner\AppData\Roaming\zP5jS8zGqcWVGqc

2011-10-08 16:32:10 -------- d-----w- C:\Users\owner\AppData\Roaming\gsJdLgZhXkV

2011-10-08 16:32:09 -------- d-----w- C:\Users\owner\AppData\Roaming\kjCkVlNx0ci

2011-10-08 16:32:08 -------- d-----w- C:\Users\owner\AppData\Roaming\v3ZSEx5knZuEBmT

2011-10-08 16:32:06 -------- d-----w- C:\Users\owner\AppData\Roaming\kEz5jSRNQkoh1Lt

2011-10-08 16:32:04 -------- d-----w- C:\Users\owner\AppData\Roaming\oG444aQH6sWK7E

2011-10-08 16:32:04 -------- d-----w- C:\Users\owner\AppData\Roaming\BwIrOtPu1b

2011-10-08 16:32:00 -------- d-----w- C:\Users\owner\AppData\Roaming\Tnhi8cKNdO6rWO6

2011-10-08 16:30:59 -------- d-----w- C:\Users\owner\AppData\Roaming\KWWWK88fRL

2011-10-08 16:29:59 -------- d-----w- C:\Users\owner\AppData\Roaming\rrOxcvFs8qklPAD

2011-10-08 16:28:56 -------- d-----w- C:\Users\owner\AppData\Roaming\jP1n6EqUxc3md

2011-10-08 16:27:59 -------- d-----w- C:\Users\owner\AppData\Roaming\WpEYtumEXBum

2011-10-08 16:26:59 -------- d-----w- C:\Users\owner\AppData\Roaming\uvqvZv9SUpearHl

2011-10-08 16:25:57 -------- d-----w- C:\Users\owner\AppData\Roaming\DEqUt1n5EhVzuFs

2011-10-08 16:24:59 -------- d-----w- C:\Users\owner\AppData\Roaming\PmJKZXeryuopQW

2011-10-08 16:23:57 -------- d-----w- C:\Users\owner\AppData\Roaming\QryuomQKLjkOAS

2011-10-08 16:22:59 -------- d-----w- C:\Users\owner\AppData\Roaming\UrWvY71Us0w5y9

2011-10-08 16:21:58 -------- d-----w- C:\Users\owner\AppData\Roaming\KhUOPADFH789wet

2011-10-08 16:20:59 -------- d-----w- C:\Users\owner\AppData\Roaming\XEcgFUpe5xR2ZbV

2011-10-08 16:19:59 -------- d-----w- C:\Users\owner\AppData\Roaming\x89qByub5679jkz

2011-10-08 16:18:58 -------- d-----w- C:\Users\owner\AppData\Roaming\qjVlBzyAuDoFp5Q

2011-10-08 16:17:59 -------- d-----w- C:\Users\owner\AppData\Roaming\vVFYvfNdraI5I4N

2011-10-08 16:16:57 -------- d-----w- C:\Users\owner\AppData\Roaming\LOtyiomQERY

2011-10-08 16:15:58 -------- d-----w- C:\Users\owner\AppData\Roaming\PaHsJERhXkVlBz

2011-10-08 16:14:57 -------- d-----w- C:\Users\owner\AppData\Roaming\P3ppm5QJJdW8fL

2011-10-08 16:13:56 -------- d-----w- C:\Users\owner\AppData\Roaming\ZlOOtPPc1onFasJ

2011-10-08 16:12:59 -------- d-----w- C:\Users\owner\AppData\Roaming\FKgZhXjVltPyAuD

2011-10-08 16:11:58 -------- d-----w- C:\Users\owner\AppData\Roaming\yGaHsKfLTqY

2011-10-08 16:10:59 -------- d-----w- C:\Users\owner\AppData\Roaming\qqYeIrOtAu2b

2011-10-08 16:09:59 -------- d-----w- C:\Users\owner\AppData\Roaming\QosgUPD5gU0nQRV

2011-10-08 16:08:58 -------- d-----w- C:\Users\owner\AppData\Roaming\ylxFJhkxFWCSHZO

2011-10-08 16:07:58 -------- d-----w- C:\Users\owner\AppData\Roaming\zAe7QSw7oz

2011-10-08 16:06:59 -------- d-----w- C:\Users\owner\AppData\Roaming\N4yw7ozhaul84PX

2011-10-08 16:05:59 -------- d-----w- C:\Users\owner\AppData\Roaming\aZkt1nsLYr03mfq

2011-10-08 16:04:54 -------- d-----w- C:\Users\owner\AppData\Roaming\muuv2b3GaH6W7

2011-10-08 03:42:16 -------- d-----w- C:\Users\owner\AppData\Roaming\XO1Gs8wBc3

2011-10-08 03:42:14 -------- d-----w- C:\Users\owner\AppData\Roaming\EKhjkOASFaKhe

2011-10-08 03:42:13 -------- d-----w- C:\Users\owner\AppData\Roaming\R22obFF3pmG5QdW

2011-10-08 03:42:11 -------- d-----w- C:\Users\owner\AppData\Roaming\XlxcvFH78hcvFH7

2011-10-08 03:42:11 -------- d-----w- C:\Users\owner\AppData\Roaming\I2n4msJdKgZh

2011-10-08 03:42:10 -------- d-----w- C:\Users\owner\AppData\Roaming\TuioaWETCUlBx0c

2011-10-08 03:42:10 -------- d-----w- C:\Users\owner\AppData\Roaming\QuucS1ibD3oGaHs

2011-10-08 03:42:10 -------- d-----w- C:\Users\owner\AppData\Roaming\CYVN01346fghkB0

2011-10-08 03:42:09 -------- d-----w- C:\Users\owner\AppData\Roaming\I5679qerxcbnQWE

2011-10-08 03:42:04 -------- d-----w- C:\Users\owner\AppData\Roaming\VkOASFGH79qkzAS

2011-10-08 03:42:04 -------- d-----w- C:\Users\owner\AppData\Roaming\rnQWRTIOASDG

2011-10-08 03:42:04 -------- d-----w- C:\Users\owner\AppData\Roaming\m6KfLgXYkVzNAuS

2011-10-08 03:42:03 -------- d-----w- C:\Users\owner\AppData\Roaming\oN1245dfhjl

2011-10-08 03:40:58 -------- d-----w- C:\Users\owner\AppData\Roaming\uxJebLt4Zxah

2011-10-08 03:39:58 -------- d-----w- C:\Users\owner\AppData\Roaming\w46XzvGKUN2QL

2011-10-08 03:38:59 -------- d-----w- C:\Users\owner\AppData\Roaming\dgXIyosRUPmKqzS

2011-10-08 03:37:56 -------- d-----w- C:\Users\owner\AppData\Roaming\jRTUIN0ipQWLqeI

2011-10-08 03:36:56 -------- d-----w- C:\Users\owner\AppData\Roaming\ClPinm7RUt1n7hI

2011-10-08 03:35:59 -------- d-----w- C:\Users\owner\AppData\Roaming\WNvi3naJfhqUkBO

2011-10-08 03:34:59 -------- d-----w- C:\Users\owner\AppData\Roaming\yZhwUeOtPc1Do4m

2011-10-08 03:33:51 -------- d-----w- C:\Users\owner\AppData\Roaming\HwjjUVVIBN1voFm

2011-10-08 03:32:59 -------- d-----w- C:\Users\owner\AppData\Roaming\feBPyAuSo3m5JW8

2011-10-08 03:31:59 -------- d-----w- C:\Users\owner\AppData\Roaming\BoKBpRz3Ll3LVDE

2011-10-08 03:30:58 -------- d-----w- C:\Users\owner\AppData\Roaming\WaJKjCIrOy0v2pG

2011-10-08 03:29:58 -------- d-----w- C:\Users\owner\AppData\Roaming\sklzAD457ghjIP

2011-10-08 03:28:58 -------- d-----w- C:\Users\owner\AppData\Roaming\ZG9z37kS6qxGLrv

2011-10-08 03:27:59 -------- d-----w- C:\Users\owner\AppData\Roaming\OOtPc1b3GaHE8Th

2011-10-08 03:26:59 -------- d-----w- C:\Users\owner\AppData\Roaming\QOyAu23GQdf

2011-10-08 03:25:59 -------- d-----w- C:\Users\owner\AppData\Roaming\annnFm5QJdKgZYw

2011-10-08 03:24:59 -------- d-----w- C:\Users\owner\AppData\Roaming\Wx2ndLYzuDa7

2011-10-08 03:23:58 -------- d-----w- C:\Users\owner\AppData\Roaming\RUz1n5KhVzuFsKh

2011-10-08 03:22:54 -------- d-----w- C:\Users\owner\AppData\Roaming\EivD2onF4m5Q7E8

2011-10-08 03:21:51 -------- d-----w- C:\Users\owner\AppData\Roaming\f1uvD2obFp

2011-10-08 03:20:55 -------- d-----w- C:\Users\owner\AppData\Roaming\US2obF3pGQWf9XU

2011-10-08 03:19:37 -------- d-----w- C:\Users\owner\AppData\Roaming\kekIBrzON0i3aWL

2011-10-08 03:18:59 -------- d-----w- C:\Users\owner\AppData\Roaming\wp5aQHfXVNx0c2D

2011-10-08 03:17:59 -------- d-----w- C:\Users\owner\AppData\Roaming\CEfZ9hwerN1v23G

2011-10-08 03:16:59 -------- d-----w- C:\Users\owner\AppData\Roaming\SaHJE8qkeBPy1

2011-10-08 03:15:59 -------- d-----w- C:\Users\owner\AppData\Roaming\L9gTZqjYCkVlNx0

2011-10-08 03:15:56 -------- d-----w- C:\Users\owner\AppData\Roaming\bBtzP0ycAiDoFp

2011-10-08 03:15:55 -------- d-----w- C:\Users\owner\AppData\Roaming\aamH5sWJ7E8Rq

2011-10-08 03:15:54 -------- d-----w- C:\Users\owner\AppData\Roaming\nIrzONtxA

2011-10-08 03:15:10 -------- d-----w- C:\Users\owner\AppData\Roaming\SONtxA0uc2b3n4Q

2011-10-08 03:15:10 -------- d-----w- C:\Users\owner\AppData\Roaming\RlONtxP0uSiDoGa

2011-10-08 03:15:08 -------- d-----w- C:\Users\owner\AppData\Roaming\LmG5sQJ6dKfZhX

2011-10-08 03:15:08 -------- d-----w- C:\Users\owner\AppData\Roaming\eyxA1uvS2b3m5Q6

2011-10-08 03:15:06 -------- d-----w- C:\Users\owner\AppData\Roaming\m1ivD3onFaHsJdL

2011-10-08 03:15:05 -------- d-----w- C:\Users\owner\AppData\Roaming\YgTZqjYCwVlNx0c

2011-10-08 03:15:02 -------- d-----w- C:\Users\owner\AppData\Roaming\WVrlOBtxPciDoFa

2011-10-08 03:15:02 -------- d-----w- C:\Users\owner\AppData\Roaming\NOBP0ycA1v2n4HQ

2011-10-08 03:15:01 -------- d-----w- C:\Users\owner\AppData\Roaming\OuSbp46Kf9qCIPc

2011-10-08 03:13:59 -------- d-----w- C:\Users\owner\AppData\Roaming\cdEK8gRZ9YwUeIt

2011-10-08 03:12:59 -------- d-----w- C:\Users\owner\AppData\Roaming\QKK77EELgTZjCwI

2011-10-08 03:11:58 -------- d-----w- C:\Users\owner\AppData\Roaming\z8Vc4LUy4EXIAbs

2011-10-08 03:10:54 -------- d-----w- C:\Users\owner\AppData\Roaming\jXAQVFTbCpYiZbZ

2011-10-08 03:09:59 -------- d-----w- C:\Users\owner\AppData\Roaming\ijCIzNxuSi

2011-10-08 03:08:53 -------- d-----w- C:\Users\owner\AppData\Roaming\U7gYVByinHJ8hUB

2011-10-08 03:07:59 -------- d-----w- C:\Users\owner\AppData\Roaming\qZhXkVlBzyAi

2011-10-08 03:06:59 -------- d-----w- C:\Users\owner\AppData\Roaming\ZpaWLXerxcbnHKL

2011-10-08 03:05:58 -------- d-----w- C:\Users\owner\AppData\Roaming\YOyiF5dRwVOtPy1

2011-10-08 03:04:57 -------- d-----w- C:\Users\owner\AppData\Roaming\una6KfLTqYkuSb3

2011-10-08 03:03:59 -------- d-----w- C:\Users\owner\AppData\Roaming\gnQWLgqCkrOt0Si

2011-10-08 03:02:58 -------- d-----w- C:\Users\owner\AppData\Roaming\zEhOSFsgkPDH8

2011-10-08 03:01:59 -------- d-----w- C:\Users\owner\AppData\Roaming\A4Lkc4fkya8e

2011-10-08 03:00:59 -------- d-----w- C:\Users\owner\AppData\Roaming\XWRL9gTXqYeIr

2011-10-08 02:59:58 -------- d-----w- C:\Users\owner\AppData\Roaming\rRqXkVOt0c1Do4m

2011-10-08 02:58:58 -------- d-----w- C:\Users\owner\AppData\Roaming\a2afjr036gIPnJT

2011-10-08 02:57:58 -------- d-----w- C:\Users\owner\AppData\Roaming\YTuF5d9jkNubH

2011-10-08 02:56:58 -------- d-----w- C:\Users\owner\AppData\Roaming\SHQd8ZYjeB

2011-10-08 02:55:59 -------- d-----w- C:\Users\owner\AppData\Roaming\orNAc2D4WLZwVNu

2011-10-08 02:54:56 -------- d-----w- C:\Users\owner\AppData\Roaming\YfBF8rnXuHCDg0J

2011-10-08 02:53:57 -------- d-----w- C:\Users\owner\AppData\Roaming\Pi3na6Wf8Th

2011-10-08 02:52:53 -------- d-----w- C:\Users\owner\AppData\Roaming\SAj7GxoyzUhWRqB

2011-10-08 02:51:59 -------- d-----w- C:\Users\owner\AppData\Roaming\z5XkNPSDu1NkZ

2011-10-08 02:51:43 -------- d-----w- C:\Users\owner\AppData\Roaming\VpYvX3TDh

2011-10-08 02:51:36 -------- d-----w- C:\Users\owner\AppData\Roaming\PzFKCy4fecaRB2W

2011-10-08 02:51:36 -------- d-----w- C:\Users\owner\AppData\Roaming\NWUApRVSHZB26qz

2011-10-08 02:51:36 -------- d-----w- C:\Users\owner\AppData\Roaming\hyodwyDJhB2djyp

2011-10-08 02:50:54 -------- d-----w- C:\Users\owner\AppData\Roaming\lndjN3WCz26q

2011-10-08 02:50:53 -------- d-----w- C:\Users\owner\AppData\Roaming\hkgQF2xxOx0iGfk

2011-10-08 02:48:57 -------- d-----w- C:\Users\owner\AppData\Roaming\ELRhXUOPci2Fmsd

2011-10-08 02:47:58 -------- d-----w- C:\Users\owner\AppData\Roaming\UgqXUlt0Avo

2011-10-08 02:46:45 -------- d-----w- C:\Users\owner\AppData\Roaming\pfvTFYnIa

2011-10-08 02:46:28 -------- d-----w- C:\Users\owner\AppData\Roaming\gS2ibF3pn5Q6Xj

2011-10-08 02:46:24 -------- d-----w- C:\Users\owner\AppData\Roaming\eK7fEL9gTqYwIrO

2011-10-08 02:46:21 -------- d-----w- C:\Users\owner\AppData\Roaming\vssWWJ77dELgRqh

2011-10-08 02:46:19 -------- d-----w- C:\Users\owner\AppData\Roaming\nVrzONtxASiD

2011-10-08 02:46:17 -------- d-----w- C:\Users\owner\AppData\Roaming\gYXwjUVelBzNc1v

2011-10-08 02:46:12 -------- d-----w- C:\Users\owner\AppData\Roaming\TRZ9hTXwj

2011-10-08 02:46:06 -------- d-----w- C:\Users\owner\AppData\Roaming\UfEL8gTZqYwUrOt

2011-10-08 02:46:05 -------- d-----w- C:\Users\owner\AppData\Roaming\fnG4amH6sJ

2011-10-07 22:02:59 -------- d-----w- C:\Users\owner\AppData\Roaming\RaJdLTqCIzyAvi3

2011-10-07 22:01:59 -------- d-----w- C:\Users\owner\AppData\Roaming\ZJE8RhXUeBzy

2011-10-07 22:00:59 -------- d-----w- C:\Users\owner\AppData\Roaming\b2GdgeNcnsLCNSo

2011-10-07 21:59:59 -------- d-----w- C:\Users\owner\AppData\Roaming\kjeIzxuSbp5Qd7L

2011-10-07 21:58:59 -------- d-----w- C:\Users\owner\AppData\Roaming\Z04LV16ZtDJC04L

2011-10-07 21:57:59 -------- d-----w- C:\Users\owner\AppData\Roaming\In0EygvX8uZShiT

2011-10-07 21:56:59 -------- d-----w- C:\Users\owner\AppData\Roaming\cOx0v2bpGQdKR9X

2011-10-07 21:55:59 -------- d-----w- C:\Users\owner\AppData\Roaming\sgqYkeB0Avo

2011-10-07 21:54:57 -------- d-----w- C:\Users\owner\AppData\Roaming\evFsE9jINuF5dLq

2011-10-07 21:53:57 -------- d-----w- C:\Users\owner\AppData\Roaming\S3Fms7E8ZYwVlt0

2011-10-07 21:52:58 -------- d-----w- C:\Users\owner\AppData\Roaming\Zn4Hs7EgZYwV

2011-10-07 21:51:55 -------- d-----w- C:\Users\owner\AppData\Roaming\s3aWLjVxiG6EqUt

2011-10-07 21:50:59 -------- d-----w- C:\Users\owner\AppData\Roaming\pfRL9XjeIrNAu2p

2011-10-07 21:49:59 -------- d-----w- C:\Users\owner\AppData\Roaming\WDF5dRXVtA24sdR

2011-10-07 21:48:58 -------- d-----w- C:\Users\owner\AppData\Roaming\kP1235dRXezA2G6

2011-10-07 21:47:58 -------- d-----w- C:\Users\owner\AppData\Roaming\mvH8Uzu4JRjru

2011-10-07 21:46:52 -------- d-----w- C:\Users\owner\AppData\Roaming\CXqjYCekIrOtAuS

2011-10-07 21:45:59 -------- d-----w- C:\Users\owner\AppData\Roaming\w2DpGa6Wf9TjC

2011-10-07 21:44:59 -------- d-----w- C:\Users\owner\AppData\Roaming\lyxA1uvS2b3m5Q6

2011-10-07 21:43:59 -------- d-----w- C:\Users\owner\AppData\Roaming\SvD2onF4pHsJdKg

2011-10-07 21:42:58 -------- d-----w- C:\Users\owner\AppData\Roaming\FCekIBrzOyAu

2011-10-07 21:41:59 -------- d-----w- C:\Users\owner\AppData\Roaming\nL9hTXqjU

2011-10-07 21:40:58 -------- d-----w- C:\Users\owner\AppData\Roaming\mjYCwkIVrOtPuSi

2011-10-07 21:39:59 -------- d-----w- C:\Users\owner\AppData\Roaming\bibD3onG4m6W7E8

2011-10-07 13:52:11 2412032 ----a-w- C:\windows\SysWow64\dllIBzPyxA1v.exe

2011-10-06 02:28:54 747356 ----a-w- C:\windows\System32\PerfStringBackup.TMP

2011-10-03 00:40:50 -------- d-----we C:\windows\system64

2011-09-17 17:06:13 -------- d--h--w- C:\Users\owner\AppData\Roaming\OpenCloud Security

.

==================== Find3M ====================

.

============= FINISH: 21:54:10.16 ===============

sba6x · October 15, 2011

I can't post the attach dds log... it says connection is reset every time i try to post it so I'm going to attach it below, hope you don't mind...

sba6x · October 15, 2011

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows 7 Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 1/21/2010 1:26:01 PM

System Uptime: 10/14/2011 8:27:07 PM (1 hours ago)

.

Motherboard: TOSHIBA | | Portable PC

Processor: Intel® Core i3 CPU M 330 @ 2.13GHz | CPU | 2133/1066mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 454 GiB total, 20.677 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {6bdd1fc6-810f-11d0-bec7-08002be2092f}

Description: Photosmart C6100 series

Device ID: ROOT\IMAGE\0000

Manufacturer: HP

Name: Photosmart C6100 series

PNP Device ID: ROOT\IMAGE\0000

Service: StillCam

.

Class GUID: {6bdd1fc6-810f-11d0-bec7-08002be2092f}

Description: Photosmart C6100 series

Device ID: ROOT\IMAGE\0001

Manufacturer: HP

Name: Photosmart C6100 series

PNP Device ID: ROOT\IMAGE\0001

Service: StillCam

.

Class GUID: {6bdd1fc6-810f-11d0-bec7-08002be2092f}

Description: Photosmart Prem C310 series

Device ID: ROOT\IMAGE\0002

Manufacturer: HP

Name: Photosmart Prem C310 series

PNP Device ID: ROOT\IMAGE\0002

Service: StillCam

.

Class GUID: {745a17a0-74d3-11d0-b6fe-00a0c90f57da}

Description: USB Optical Mouse

Device ID: USB\VID_1BCF&PID_05CE&MI_01\7&177033FA&0&0001

Manufacturer: USB Optical Mouse

Name: USB Optical Mouse

PNP Device ID: USB\VID_1BCF&PID_05CE&MI_01\7&177033FA&0&0001

Service: HidUsb

.

Class GUID: {4d36e96a-e325-11ce-bfc1-08002be10318}

Description: Ricoh PCIe Memory Stick Host Controller

Device ID: PCI\VEN_1180&DEV_E230&SUBSYS_FF1E1179&REV_01\4&C666C98&0&01E3

Manufacturer: Ricoh Company

Name: Ricoh PCIe Memory Stick Host Controller

PNP Device ID: PCI\VEN_1180&DEV_E230&SUBSYS_FF1E1179&REV_01\4&C666C98&0&01E3

Service: rimspci

.

Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Description: Windows Firewall Authorization Driver

Device ID: ROOT\LEGACY_MPSDRV\0000

Manufacturer:

Name: Windows Firewall Authorization Driver

PNP Device ID: ROOT\LEGACY_MPSDRV\0000

Service: mpsdrv

.

Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}

Description: Photosmart C6100 series

Device ID: ROOT\MULTIFUNCTION\0000

Manufacturer: HP

Name: Photosmart C6100 series

PNP Device ID: ROOT\MULTIFUNCTION\0000

Service:

.

Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}

Description: Photosmart Prem C310 series

Device ID: ROOT\MULTIFUNCTION\0001

Manufacturer: HP

Name: Photosmart Prem C310 series

PNP Device ID: ROOT\MULTIFUNCTION\0001

Service:

.

Class GUID: {4d36e96a-e325-11ce-bfc1-08002be10318}

Description: Ricoh PCIe xD-Picture Card Controller

Device ID: PCI\VEN_1180&DEV_E852&SUBSYS_FF1E1179&REV_01\4&C666C98&0&02E3

Manufacturer: Ricoh Company

Name: Ricoh PCIe xD-Picture Card Controller

PNP Device ID: PCI\VEN_1180&DEV_E852&SUBSYS_FF1E1179&REV_01\4&C666C98&0&02E3

Service: rixdpcie

.

sba6x · October 15, 2011

==== System Restore Points ===================

.

RP134: 10/13/2011 12:34:33 PM - Windows 7 Service Pack 1

.

==== Installed Programs ======================

.

AC3Filter 1.63b

Add or Remove Adobe Creative Suite 3 Master Collection

Add or Remove Adobe Premiere Pro CS5

Adobe After Effects CS5

Adobe After Effects CS5 Third Party Content

Adobe After Effects CS5 Third Party Royalty Content

Adobe AIR

Adobe Anchor Service CS3

Adobe Asset Services CS3

Adobe Bridge CS3

Adobe Bridge Start Meeting

Adobe Camera Raw 4.0

Adobe CMaps

Adobe Community Help

Adobe ExtendScript Toolkit 2

Adobe Flash Player 10 ActiveX

Adobe Flash Player 11 Plugin

Adobe Media Encoder CS5 PCI X64

Adobe Media Player

Adobe PDF Library Files

Adobe Photoshop CS5

Adobe Reader 9.4.6

Adobe Setup

Adobe Type Support

Adobe Update Manager CS3

AIO_CDA_ProductContext

AIO_CDA_Software

AIO_Scan

Apple Application Support

Apple Software Update

Athan Basic 3.8

AVS Update Manager 1.0

AVS Video Converter 6

AVS4YOU Software Navigator 1.4

Best Buy Software Installer

Bing Bar

BufferChm

C310

C6100

c6100_Help

CCleaner

Citrix Presentation Server Client

Compatibility Pack for the 2007 Office system

Copy

Definition update for Microsoft Office 2010 (KB982726) 32-Bit Edition

Destinations

DeviceDiscovery

DocProc

Fax

Geek Squad 24 Hour Computer Support

GenArts Sapphire RLM Server 8.0.5.1

GOM Player

Google Toolbar for Internet Explorer

Google Update Helper

GPBaseService2

High-Definition Video Playback 10

HP Photo Creations

HP Update

HPAppStudio

HPPhotoGadget

HPPhotoSmartDiscLabelContent1

HPPhotosmartEssential

HPProductAssistant

HPSSupply

Intel® Control Center

Intel® Management Engine Components

Intel® Rapid Storage Technology

Java 6 Update 14

Jing

Juniper Networks Secure Application Manager

Juniper Networks Setup Client

Juniper Networks Setup Client Activex Control

Junk Mail filter update

Malwarebytes' Anti-Malware version 1.51.2.1300

MarketResearch

Microsoft Choice Guard

Microsoft Default Manager

Microsoft Office 2010 Service Pack 1 (SP1)

Microsoft Office Access MUI (English) 2010

Microsoft Office Access Setup Metadata MUI (English) 2010

Microsoft Office Excel MUI (English) 2010

Microsoft Office Groove MUI (English) 2010

Microsoft Office InfoPath MUI (English) 2010

Microsoft Office OneNote MUI (English) 2010

Microsoft Office Outlook MUI (English) 2010

Microsoft Office PowerPoint MUI (English) 2010

Microsoft Office PowerPoint Viewer 2007 (English)

Microsoft Office Professional Plus 2010

Microsoft Office Proof (English) 2010

Microsoft Office Proof (French) 2010

Microsoft Office Proof (Spanish) 2010

Microsoft Office Proofing (English) 2010

Microsoft Office Publisher MUI (English) 2010

Microsoft Office Shared MUI (English) 2010

Microsoft Office Shared Setup Metadata MUI (English) 2010

Microsoft Office Suite Activation Assistant

Microsoft Office Word MUI (English) 2010

Microsoft Primary Interoperability Assemblies 2005

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Works

Microsoft_VC80_ATL_x86

Microsoft_VC80_CRT_x86

Microsoft_VC80_MFC_x86

Microsoft_VC80_MFCLOC_x86

Microsoft_VC90_ATL_x86

Microsoft_VC90_CRT_x86

Microsoft_VC90_MFC_x86

Move Media Player

Mozilla Firefox (3.6.8)

MPEG2 Codec(libmpeg2/mad)

MSVCRT

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Nero 10 ClipartPack

Nero 10 Menu TemplatePack 1

Nero 10 Menu TemplatePack 2

Nero 10 Menu TemplatePack 3

Nero 10 Menu TemplatePack Basic

Nero 10 Movie ThemePack 1

Nero 10 Movie ThemePack 2

Nero 10 Movie ThemePack Basic

Nero BackItUp 10

Nero BackItUp 10 Help (CHM)

Nero Burning ROM 10

Nero BurningROM 10 Help (CHM)

Nero BurnRights 10

Nero BurnRights 10 Help (CHM)

Nero Control Center 10

Nero ControlCenter 10 Help (CHM)

Nero Core Components 10

Nero CoverDesigner 10

Nero CoverDesigner 10 Help (CHM)

Nero DiscSpeed 10

Nero DiscSpeed 10 Help (CHM)

Nero Dolby Files 10

Nero Express 10

Nero Express 10 Help (CHM)

Nero InfoTool 10

Nero InfoTool 10 Help (CHM)

Nero MediaHub 10

Nero MediaHub 10 Help (CHM)

Nero Multimedia Suite 10

Nero Recode 10

Nero Recode 10 Help (CHM)

Nero RescueAgent 10

Nero RescueAgent 10 Help (CHM)

Nero SoundTrax 10

Nero SoundTrax 10 Help (CHM)

Nero StartSmart 10

Nero StartSmart 10 Help (CHM)

Nero Update

Nero Vision 10

Nero Vision 10 Help (CHM)

Nero WaveEditor 10

Nero WaveEditor 10 Help (CHM)

NVIDIA PhysX

PDF Settings CS5

PS_AIO_07_C310_SW_Min

PxMergeModule

QuickTime

QuickTransfer

Realtek Ethernet Controller Driver

Realtek High Definition Audio Driver

Realtek WLAN Driver

RICOH R5U230 Media Driver ver.2.06.03.02

Roxio Burn

Roxio Express Labeler 3

Roxio Roxio Burn

Roxio Update Manager

Scan

Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft Excel 2010 (KB2553070)

Security Update for Microsoft Office 2010 (KB2553091)

Security Update for Microsoft Office 2010 (KB2553096)

Security Update for Microsoft Office 2010 (KB2584066)

Security Update for Microsoft SharePoint Workspace 2010 (KB2566445)

Setup Support for Browser Seek

Skype Toolbars

Skype™ 4.2

SmartWebPrinting

SolutionCenter

StarCraft II

Status

Toolbox

Toshiba Application Installer

TOSHIBA Assist

TOSHIBA Bulletin Board

TOSHIBA ConfigFree

TOSHIBA DVD PLAYER

TOSHIBA eco Utility

TOSHIBA Extended Tiles for Windows Mobility Center

TOSHIBA Face Recognition

TOSHIBA Hardware Setup

TOSHIBA HDD/SSD Alert

TOSHIBA Media Controller

TOSHIBA Quality Application

TOSHIBA ReelTime

TOSHIBA Service Station

TOSHIBA Speech System Applications

TOSHIBA Speech System SR Engine(U.S.) Version1.0

TOSHIBA Speech System TTS Engine(U.S.) Version1.0

TOSHIBA Supervisor Password

TOSHIBA USB Sleep and Charge Utility

TOSHIBA Value Added Package

TOSHIBA Web Camera Application

ToshibaRegistration

TrayApp

UnloadSupport

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft Office 2010 (KB2494150)

Update for Microsoft Office 2010 (KB2553065)

Update for Microsoft Office 2010 (KB2553092)

Update for Microsoft Office 2010 (KB2566458)

Update for Microsoft Outlook Social Connector (KB2583935)

WBFS Manager 3.0

WebReg

Windows Live Call

Windows Live Communications Platform

Windows Live Essentials

Windows Live Mail

Windows Live Messenger

Windows Live Movie Maker

Windows Live Photo Gallery

Windows Live Sync

Windows Live Upload Tool

Windows Live Writer

Windows Media Player Firefox Plugin

WinZip 14.5

Xvid 1.2.1 final uninstall

.

sba6x · October 15, 2011

==== Event Viewer Messages From Past Week ========

.

10/9/2011 11:29:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

10/8/2011 9:35:53 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.

10/8/2011 9:34:34 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Presentation Foundation Font Cache 3.0.0.0 service to connect.

10/8/2011 9:34:34 PM, Error: Service Control Manager [7000] - The Windows Presentation Foundation Font Cache 3.0.0.0 service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

10/8/2011 9:07:46 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Intel® Rapid Storage Technology service to connect.

10/8/2011 9:07:46 PM, Error: Service Control Manager [7000] - The Intel® Rapid Storage Technology service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

10/8/2011 9:06:29 PM, Error: Microsoft-Windows-DriverFrameworks-UserMode [10101] - The driver package installation has failed. The final status was 0x45B.

10/8/2011 3:41:33 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.

10/8/2011 3:40:09 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the wlidsvc service.

10/7/2011 8:45:29 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the HPSLPSVC service.

10/14/2011 9:50:07 PM, Error: Service Control Manager [7023] - The Peer Name Resolution Protocol service terminated with the following error: Access is denied.

10/14/2011 9:50:07 PM, Error: Service Control Manager [7001] - The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: Access is denied.

10/14/2011 9:50:07 PM, Error: Microsoft-Windows-PNRPSvc [102] - The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80070005.

10/14/2011 9:50:06 PM, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143.

10/14/2011 9:50:05 PM, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file.

10/14/2011 8:29:59 PM, Error: Microsoft-Windows-WMPNSS-Service [14346] - A new media server was not initialized because RegisterRunningDevice() encountered error '0x80070005'. Restart your computer, and then restart the WMPNetworkSvc service.

10/14/2011 8:27:31 PM, Error: Service Control Manager [7001] - The Windows Firewall service depends on the Windows Firewall Authorization Driver service which failed to start because of the following error: Cannot create a file when that file already exists.

10/14/2011 8:27:31 PM, Error: Service Control Manager [7000] - The Windows Firewall Authorization Driver service failed to start due to the following error: Cannot create a file when that file already exists.

10/14/2011 8:27:31 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\??\C:\Users\owner\ntuser.dat' was corrupted and it has been recovered. Some data might have been lost.

10/14/2011 8:27:26 PM, Error: Microsoft-Windows-Eventlog [22] - The event logging service encountered an error while initializing publishing resources for channel DebugChannel. If channel type is Analytic or Debug, then this could mean there was an error initializing logging resources as well.

sba6x · October 15, 2011

10/13/2011 9:17:28 AM, Error: Service Control Manager [7022] - The HomeGroup Listener service hung on starting.

sba6x · October 15, 2011

10/13/2011 4:43:21 PM, Error: Microsoft-Windows-Windows UpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800f0826: Windows 7 Service Pack 1 for x64-based Systems (KB976932).

sba6x · October 15, 2011

10/13/2011 4:41:08 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Trend Micro Unauthorized Change Prevention Service service to connect.

10/13/2011 4:41:08 PM, Error: Service Control Manager [7000] - The Trend Micro Unauthorized Change Prevention Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

10/12/2011 7:35:51 AM, Error: Service Control Manager [7001] - The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: After starting, the service hung in a start-pending state.

10/12/2011 7:35:49 AM, Error: Service Control Manager [7022] - The Peer Name Resolution Protocol service hung on starting.

10/12/2011 7:35:37 AM, Error: Service Control Manager [7022] - The Windows Presentation Foundation Font Cache 3.0.0.0 service hung on starting.

sba6x · October 15, 2011

10/11/2011 9:20:11 PM, Error: Microsoft-Windows-Windows UpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070005: Update for Windows 7 for x64-based Systems (KB976422).

10/11/2011 9:14:51 PM, Error: Service Control Manager [7024] - The Superfetch service terminated with service-specific error The operation completed successfully..

10/11/2011 9:06:24 PM, Error: Microsoft-Windows-Windows UpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80246007: Windows 7 Service Pack 1 for x64-based Systems (KB976932).

sba6x · October 15, 2011

10/10/2011 9:14:31 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SysMain service.

10/10/2011 2:35:20 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}

10/10/2011 12:17:16 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.

10/10/2011 12:17:15 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

10/10/2011 12:17:15 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

10/10/2011 12:17:11 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

10/10/2011 12:17:02 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}

10/10/2011 12:16:59 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache spldr tmtdi Wanarpv6

.

==== End Of File ===========================

sba6x · October 15, 2011

sorry for the segmented logs... its all there is order though. In post # 10 and 12 I had to put a space between "Windows" and "UpdateClient [20]", otherwise it wouldn't let me post because the connection was reset. It took me a while to figure that out, I'm not sure if that means anything.

Thanks again in advance for your help.

screen317 · October 18, 2011

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the contents of C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

sba6x · October 19, 2011

Thanks for your help! My desktop and files are back. MBAM and my Trend antivirus are still picking up trojans and other things every now and then but I updated and here are the logs after removing those found:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 7977

Windows 6.1.7600

Internet Explorer 9.0.8112.16421

10/18/2011 10:06:35 PM

mbam-log-2011-10-18 (22-06-35).txt

Scan type: Quick scan

Objects scanned: 200679

Time elapsed: 15 minute(s), 32 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Combofix log:

ComboFix 11-10-18.04 - owner 10/18/2011 22:30:38.1.4 - x64

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3959.2649 [GMT -4:00]

Running from: c:\users\owner\Desktop\ComboFix.exe

AV: Trend Micro AntiVirus *Enabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}

SP: Trend Micro AntiVirus *Enabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files (x86)\Internet Explorer\2CAB.tmp

c:\program files (x86)\Internet Explorer\817E.tmp

c:\program files (x86)\Internet Explorer\BEEB.tmp

c:\program files (x86)\Internet Explorer\FD72.tmp

c:\users\owner\AppData\Local\Temp\winupd.exe

c:\users\owner\AppData\Roaming\5A9C990B38FCD123F913C83E811E1AD7

c:\users\owner\AppData\Roaming\5A9C990B38FCD123F913C83E811E1AD7\enemies-names.txt

c:\users\owner\AppData\Roaming\5A9C990B38FCD123F913C83E811E1AD7\local.ini

c:\users\owner\AppData\Roaming\5A9C990B38FCD123F913C83E811E1AD7\lsrslt.ini

c:\users\owner\AppData\Roaming\Adobe\plugs

c:\users\owner\AppData\Roaming\Adobe\shed

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\delfile.dll

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\delfile.tmp

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\dudl.exe

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\dudl.tmp

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\eb.sys

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\energy.drv

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\energy.sys

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\exec.exe

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\exec.sys

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\fan.dll

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\FW.dll

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\FW.drv

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\hymt.sys

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\kernel32.dll

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\PE.dll

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\PE.drv

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\sld.dll

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\sld.drv

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\SM.drv

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\tjd.drv

c:\users\owner\AppData\Roaming\Microsoft\Windows\Recent\tjd.sys

c:\users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Zentom System Guard.lnk

c:\users\owner\AppData\Roaming\OpenCloud Security

c:\users\owner\AppData\Roaming\OpenCloud Security\OpenCloud Security.ico

c:\users\owner\AppData\Roaming\OpenCloud Security\wmf.cfg

c:\windows\assembly\tmp\U

c:\windows\assembly\tmp\U\00000001.@

c:\windows\assembly\tmp\U\00000002.@

c:\windows\assembly\tmp\U\000000c0.@

c:\windows\assembly\tmp\U\000000cb.@

c:\windows\assembly\tmp\U\000000cf.@

c:\windows\assembly\tmp\U\80000000.@

c:\windows\assembly\tmp\U\80000032.@

c:\windows\assembly\tmp\U\80000064.@

c:\windows\assembly\tmp\U\800000c0.@

c:\windows\assembly\tmp\U\800000cb.@

c:\windows\assembly\tmp\U\800000cf.@

c:\windows\iun6002.exe

c:\windows\system32\consrv.dll

c:\windows\system32\Thumbs.db

c:\windows\System64

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_BrowserSeek Service

.

((((((((((((((((((((((((( Files Created from 2011-09-19 to 2011-10-19 )))))))))))))))))))))))))))))))

.

2011-10-19 02:43 . 2011-10-19 02:43 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-10-13 16:35 . 2011-10-13 16:35 -------- d-----w- c:\windows\system32\SPReview

2011-10-13 16:32 . 2011-10-13 16:32 -------- d-----w- c:\windows\system32\EventProviders

2011-10-12 01:20 . 2011-10-12 01:20 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2011-10-10 12:29 . 2011-10-10 12:29 128000 ----a-w- c:\windows\SysWow64\NcS13F4am5W7E8R.exe

2011-10-10 12:29 . 2011-10-10 12:29 384000 ----a-w- c:\windows\SysWow64\jZqjYCwkVl.exe

2011-10-10 03:55 . 2011-10-10 03:58 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-10-10 03:43 . 2011-10-10 03:43 -------- d-----w- c:\program files (x86)\Setup Support for Browser Seek

2011-10-09 01:59 . 2011-10-09 01:59 -------- d-----w- c:\users\owner\AppData\Roaming\avD2onF4pHsJdKg

2011-10-09 01:56 . 2011-10-09 01:56 -------- d-----w- c:\users\owner\AppData\Roaming\agTXqjYVNAbpGQs

2011-10-09 01:55 . 2011-10-09 01:55 -------- d-----w- c:\users\owner\AppData\Roaming\aD68wx1H7RXkVlB

2011-10-09 01:52 . 2011-10-09 01:52 -------- d-----w- c:\users\owner\AppData\Roaming\blrzPNyxAv3GJRh

2011-10-09 01:51 . 2011-10-09 01:51 -------- d-----w- c:\users\owner\AppData\Roaming\agYCekIVrN03467

2011-10-09 01:49 . 2011-10-09 01:49 -------- d-----w- c:\users\owner\AppData\Roaming\BCIVrzt0uSipGaH

2011-10-09 01:49 . 2011-10-09 01:49 -------- d-----w- c:\users\owner\AppData\Roaming\AP0yc1ivD

2011-10-09 01:48 . 2011-10-09 01:48 -------- d-----w- c:\users\owner\AppData\Roaming\BIlONtxP0ciGsJf

2011-10-09 01:46 . 2011-10-09 01:46 -------- d-----w- c:\users\owner\AppData\Roaming\aEK8fRZ9hXeIrPy

2011-10-09 01:46 . 2011-10-09 01:46 -------- d-----w- c:\users\owner\AppData\Roaming\AonG4amH6W7E8Tq

2011-10-09 01:45 . 2011-10-09 01:45 -------- d-----w- c:\users\owner\AppData\Roaming\aWK8fRL9hXjCIyA

2011-10-09 01:44 . 2011-10-09 01:44 -------- d-----w- c:\users\owner\AppData\Roaming\b6dWK8fRLhq

2011-10-09 01:44 . 2011-10-09 01:44 -------- d-----w- c:\users\owner\AppData\Roaming\BZ9hYXwjUeItPyA

2011-10-09 01:44 . 2011-10-09 01:44 -------- d-----w- c:\users\owner\AppData\Roaming\AcS1ibD3o

2011-10-09 01:44 . 2011-10-09 01:44 -------- d-----w- c:\users\owner\AppData\Roaming\BVOBtzP0yAiDoFp

2011-10-09 01:44 . 2011-10-09 01:44 -------- d-----w- c:\users\owner\AppData\Roaming\c2o4GsQJE

2011-10-09 01:43 . 2011-10-09 01:43 -------- d-----w- c:\users\owner\AppData\Roaming\AA1u2obF3madRhU

2011-10-09 01:43 . 2011-10-09 01:43 -------- d-----w- c:\users\owner\AppData\Roaming\BqXUVelOBz0c1v2

2011-10-09 01:43 . 2011-10-09 01:43 -------- d-----w- c:\users\owner\AppData\Roaming\A6sWK7fELgZjCkV

2011-10-09 01:43 . 2011-10-09 01:43 -------- d-----w- c:\users\owner\AppData\Roaming\AhTXwjUCeBzNx1v

2011-10-09 01:42 . 2011-10-09 01:42 -------- d-----w- c:\users\owner\AppData\Roaming\a9hYXwjUVlBzNc1

2011-10-09 01:42 . 2011-10-09 01:42 -------- d-----w- c:\users\owner\AppData\Roaming\aycS1ivD3n4Hs

2011-10-09 01:42 . 2011-10-09 01:42 -------- d-----w- c:\users\owner\AppData\Roaming\AP0ycA1iv2n4m5Q

2011-10-09 01:42 . 2011-10-09 01:42 -------- d-----w- c:\users\owner\AppData\Roaming\bCwkIVrlOtPuSi

2011-10-09 01:42 . 2011-10-09 01:42 -------- d-----w- c:\users\owner\AppData\Roaming\BJ6dWK8fLh

2011-10-09 01:41 . 2011-10-09 01:41 -------- d-----w- c:\users\owner\AppData\Roaming\bkUVrlOBtPc

2011-10-09 01:41 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\aD3onF4am5W7E8R

2011-10-09 01:40 . 2011-10-09 01:40 -------- d-----w- c:\users\owner\AppData\Roaming\b0uvS2ibFpG

2011-10-09 01:40 . 2011-10-09 01:40 -------- d-----w- c:\users\owner\AppData\Roaming\A1ivD2onFpHsJdK

2011-10-09 01:39 . 2011-10-09 01:39 -------- d-----w- c:\users\owner\AppData\Roaming\BG4amH6sJfLgZhC

2011-10-09 01:39 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\BgRZ9hYXwUeIt

2011-10-09 01:38 . 2011-10-09 01:38 -------- d-----w- c:\users\owner\AppData\Roaming\B2Fp5JW8RhXUe

2011-10-09 01:38 . 2011-10-09 01:38 -------- d-----w- c:\users\owner\AppData\Roaming\aD3Fa5WdLg

2011-10-09 01:38 . 2011-10-09 01:38 -------- d-----w- c:\users\owner\AppData\Roaming\a3oFm57EgZ

2011-10-09 01:38 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\BZqjYCwkIr

2011-10-09 01:38 . 2011-10-09 01:38 -------- d-----w- c:\users\owner\AppData\Roaming\bdEK8fRZ9TwUeIr

2011-10-09 01:37 . 2011-10-09 01:37 -------- d-----w- c:\users\owner\AppData\Roaming\bXjeBOy0viFn5Q

2011-10-09 01:37 . 2011-10-09 01:37 -------- d-----w- c:\users\owner\AppData\Roaming\bXjeBOxu2Fna6W

2011-10-09 01:37 . 2011-10-09 01:37 -------- d-----w- c:\users\owner\AppData\Roaming\An4Hs7E8Z

2011-10-09 01:37 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\bwjUVelIBcD

2011-10-09 01:36 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\AmH6sWJ7f

2011-10-09 01:36 . 2011-10-09 01:36 -------- d-----w- c:\users\owner\AppData\Roaming\aK8fRL9hTqUeIrO

2011-10-09 01:36 . 2011-10-09 01:36 -------- d-----w- c:\users\owner\AppData\Roaming\BtyDFpHs7E

2011-10-09 01:36 . 2011-10-09 01:36 -------- d-----w- c:\users\owner\AppData\Roaming\a7dEL8gRZhXkVlB

2011-10-09 01:36 . 2011-10-09 01:36 -------- d-----w- c:\users\owner\AppData\Roaming\BCwkIVrlOtPuSiD

2011-10-09 01:35 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\aycA1ivDn4

2011-10-09 01:35 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\a3onF4amHsJdLgZ

2011-10-09 01:35 . 2011-10-09 01:35 -------- d-----w- c:\users\owner\AppData\Roaming\B1ivD3onFaHsJdL

2011-10-09 01:35 . 2011-10-09 01:35 -------- d-----w- c:\users\owner\AppData\Roaming\C3pnG5aQHdKfLgX

2011-10-09 01:35 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\AWJ7dEL8gZhXkVl

2011-10-09 01:35 . 2011-10-09 01:35 -------- d-----w- c:\users\owner\AppData\Roaming\c5aQH6dWK

2011-10-09 01:33 . 2011-10-09 01:33 -------- d-----w- c:\users\owner\AppData\Roaming\b66ddWK88RL9hXj

2011-10-09 01:33 . 2011-10-09 01:33 -------- d-----w- c:\users\owner\AppData\Roaming\aF3pmG5aQ6

2011-10-09 01:33 . 2011-10-09 01:33 -------- d-----w- c:\users\owner\AppData\Roaming\by1v2Fp5JdKRhXU

2011-10-09 01:32 . 2011-10-09 01:32 -------- d-----w- c:\users\owner\AppData\Roaming\b9XjCkBzNAv

2011-10-09 01:32 . 2011-10-09 01:32 -------- d-----w- c:\users\owner\AppData\Roaming\aa6WfLTjCkBxv

2011-10-09 01:31 . 2011-10-09 01:31 -------- d-----w- c:\users\owner\AppData\Roaming\aG5JEf9XUlrPx1S

2011-10-09 01:31 . 2011-10-09 01:31 -------- d-----w- c:\users\owner\AppData\Roaming\BuvS2obF3m5Q6

2011-10-09 01:29 . 2011-10-09 01:29 -------- d-----w- c:\users\owner\AppData\Roaming\c0ycA1ivDoFp

2011-10-09 01:29 . 2011-10-09 01:29 -------- d-----w- c:\users\owner\AppData\Roaming\auvS2obF3m5Q6W8

2011-10-09 01:29 . 2011-10-09 01:29 -------- d-----w- c:\users\owner\AppData\Roaming\AF4pmG5sQ6E8

2011-10-09 01:29 . 2011-10-09 01:29 -------- d-----w- c:\users\owner\AppData\Roaming\BbD3na6Wf8ZYkrB

2011-10-09 01:28 . 2011-10-09 01:28 -------- d-----w- c:\users\owner\AppData\Roaming\BhTXwjUCeIzNx1v

2011-10-09 01:13 . 2011-10-09 01:13 -------- d-----w- c:\users\owner\AppData\Roaming\A5sQJ7dEK

2011-10-09 01:12 . 2011-10-09 01:12 -------- d-----w- c:\users\owner\AppData\Roaming\BuvS2ibF3n5Q6W7

2011-10-09 01:11 . 2011-10-09 01:11 -------- d-----w- c:\users\owner\AppData\Roaming\bpnG5aQH6W7R9Tq

2011-10-09 01:11 . 2011-10-09 01:11 -------- d-----w- c:\users\owner\AppData\Roaming\BBrzONyxAu

2011-10-09 01:10 . 2011-10-09 01:10 -------- d-----w- c:\users\owner\AppData\Roaming\BycA1uvD2b4m5Q6

2011-10-09 01:09 . 2011-10-09 01:09 -------- d-----w- c:\users\owner\AppData\Roaming\aqhYXwkUVlBz0c1

2011-10-09 01:08 . 2011-10-09 01:08 -------- d-----w- c:\users\owner\AppData\Roaming\baQH6sWK7E9TqYw

2011-10-09 01:05 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\beIzNx0cbGsEZYw

2011-10-09 01:05 . 2011-10-09 01:05 -------- d-----w- c:\users\owner\AppData\Roaming\BqjjYCwkIr

2011-10-09 01:03 . 2011-10-09 01:03 -------- d-----w- c:\users\owner\AppData\Roaming\ajYwIVrlOx0c1

2011-10-09 01:03 . 2011-10-09 01:03 -------- d-----w- c:\users\owner\AppData\Roaming\aqjYCkIVrOtPu

2011-10-09 01:03 . 2011-10-09 01:03 -------- d-----w- c:\users\owner\AppData\Roaming\ajYCwkIVrOtPu

2011-10-09 01:03 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\by3dTzbWYt3HLwx

2011-10-08 19:51 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\bH6sWK7fE9TqYwI

2011-10-08 19:51 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\bQH6sWK7fLgZjCk

2011-10-08 19:50 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\AN6k4ZB2shtoTnh

2011-10-08 19:48 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\bNodeSQZOoKIiJw

2011-10-08 19:48 . 2011-10-08 19:48 -------- d-----w- c:\users\owner\AppData\Roaming\bAG8C04ZziW

2011-10-08 19:47 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\C4KqNoWZVyaEw0o

2011-10-08 19:46 . 2011-10-08 19:46 -------- d-----w- c:\users\owner\AppData\Roaming\BlIBtzPNy1DwF

2011-10-08 19:46 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\BNSoH7TCrx13a

2011-10-08 19:46 . 2011-10-08 19:46 -------- d-----w- c:\users\owner\AppData\Roaming\ac12bj1vbmaJdfW

2011-10-08 19:45 . 2011-10-08 19:45 -------- d-----w- c:\users\owner\AppData\Roaming\a4amH6sWJfLgZ

2011-10-08 19:45 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\bjerNAvopa6KRhj

2011-10-08 19:44 . 2011-10-08 19:44 -------- d-----w- c:\users\owner\AppData\Roaming\BXwjUVelItPyA

2011-10-08 19:43 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\AJ7EL8gRZhXkVlB

2011-10-08 19:43 . 2011-10-08 19:43 -------- d-----w- c:\users\owner\AppData\Roaming\b3na6KfELTjwrOP

2011-10-08 19:43 . 2011-10-08 19:43 -------- d-----w- c:\users\owner\AppData\Roaming\aa6KfEL9Tj

2011-10-08 19:42 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\ANAci3nHW7Eg

2011-10-08 19:42 . 2011-10-08 19:42 -------- d-----w- c:\users\owner\AppData\Roaming\aeBzxu2Fna

2011-10-08 19:42 . 2011-10-08 19:42 -------- d-----w- c:\users\owner\AppData\Roaming\BJZrynJZVy2mdZj

2011-10-08 19:42 . 2011-10-08 19:42 -------- d-----w- c:\users\owner\AppData\Roaming\AVSG6ZB2G7qri5X

2011-10-08 19:42 . 2011-10-08 19:42 -------- d-----w- c:\users\owner\AppData\Roaming\A2gA8vLuR07x6Uo

2011-10-08 19:42 . 2011-10-08 19:42 -------- d-----w- c:\users\owner\AppData\Roaming\BzWN7y8iKNdA8xK

2011-10-08 19:41 . 2011-10-08 19:41 -------- d-----w- c:\users\owner\AppData\Roaming\amP82wHNTnO8oz8

2011-10-08 19:41 . 2011-10-08 19:41 -------- d-----w- c:\users\owner\AppData\Roaming\BhsygbVdxTmP82w

2011-10-08 19:40 . 2011-10-08 19:40 -------- d-----w- c:\users\owner\AppData\Roaming\bL2YszQImlGNTDt

2011-10-08 19:40 . 2011-10-08 19:40 -------- d-----w- c:\users\owner\AppData\Roaming\BL2YszQImlGNT

2011-10-08 19:40 . 2011-10-08 19:40 -------- d-----w- c:\users\owner\AppData\Roaming\b3JhIuGgz2HTlcb

2011-10-08 19:37 . 2011-10-08 19:37 -------- d-----w- c:\users\owner\AppData\Roaming\AQH6dWK7fLgXjCk

2011-10-08 19:37 . 2011-10-08 19:37 -------- d-----w- c:\users\owner\AppData\Roaming\BucS2ibD3n4Q6W7

2011-10-08 19:36 . 2011-10-08 19:36 -------- d-----w- c:\users\owner\AppData\Roaming\a6dWK8fRLhXjCkB

2011-10-08 19:36 . 2011-10-08 19:36 -------- d-----w- c:\users\owner\AppData\Roaming\BF4pmH5sQ7

2011-10-08 19:36 . 2011-10-08 19:36 -------- d-----w- c:\users\owner\AppData\Roaming\aWK7fELgTqYwI

2011-10-08 19:35 . 2011-10-08 19:35 -------- d-----w- c:\users\owner\AppData\Roaming\aH6dWK7fR9TqYeI

2011-10-08 19:35 . 2011-10-08 19:35 -------- d-----w- c:\users\owner\AppData\Roaming\aycS1ivD3n4m5

2011-10-08 19:35 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\AjUCelIBrPyAuSo

2011-10-08 19:35 . 2011-10-08 19:35 -------- d-----w- c:\users\owner\AppData\Roaming\AtzPNycA1v2b

2011-10-08 19:35 . 2011-10-08 19:35 -------- d-----w- c:\users\owner\AppData\Roaming\BA0ucS2ib3n4Q

2011-10-08 19:35 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\b8gTZqhYCkVlBx0

2011-10-08 19:34 . 2011-10-08 19:34 -------- d-----w- c:\users\owner\AppData\Roaming\BTXqjYCekVzNx0c

2011-10-08 19:33 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\BONtxA0uc2b3n

2011-10-08 19:33 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\btzP0ycA1v2

2011-10-08 19:33 . 2011-10-10 12:43 -------- d-----w- c:\users\owner\AppData\Roaming\bamH6sWJ7E8TqYw

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-10-13 18:06 . 2011-10-13 18:06 1126912 ----a-w- c:\windows\SysWow64\wininet.dll

2011-10-13 18:06 . 2011-10-13 18:06 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe

2011-10-13 18:06 . 2011-10-13 18:06 63488 ----a-w- c:\windows\SysWow64\tdc.ocx

2011-10-13 18:06 . 2011-10-13 18:06 420864 ----a-w- c:\windows\SysWow64\vbscript.dll

2011-10-13 18:06 . 2011-10-13 18:06 152064 ----a-w- c:\windows\SysWow64\wextract.exe

2011-10-10 12:29 . 2011-10-10 12:29 64000 ----a-w- c:\windows\SysWow64\vtxA0ucS2b.exe

2011-10-10 12:29 . 2011-10-10 12:29 128000 ----a-w- c:\windows\SysWow64\u9gTjCwkrOPSb3G.exe

2011-10-10 12:29 . 2011-10-10 12:29 2688000 ----a-w- c:\windows\SysWow64\XH6LYeVONx0c3nQ.exe

2011-07-21 12:28 . 2011-07-21 12:28 0 ---ha-w- c:\users\owner\AppData\Local\BITD7E8.tmp

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-02 39408]

"Jing"="c:\program files (x86)\TechSmith\Jing\Jing.exe" [2010-03-30 3036424]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2009-10-02 284696]

"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2009-10-06 1294136]

"TWebCamera"="c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2009-11-05 2446648]

"hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]

"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-03-18 421888]

"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]

"Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-07-17 288080]

"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]

.

c:\users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

winupd.lnk - c:\users\owner\AppData\Local\Temp\winupd.exe [N/A]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"EnableLinkedConnections"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-16 135664]

R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]

R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-16 135664]

R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]

R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-10-06 51512]

R3 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [2010-02-16 917768]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]

S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys [x]

S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS [x]

S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [x]

S1 NEOFLTR_650_15977;Juniper Networks TDI Filter Driver (NEOFLTR_650_15977);c:\windows\system32\Drivers\NEOFLTR_650_15977.SYS [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2009-10-28 252784]

S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-03-11 46448]

S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-10-02 13336]

S2 RLM-GenArts;RLM-GenArts;c:\program files (x86)\GenArts\rlm\rlm.exe [2010-06-03 1540096]

S2 tmpreflt;tmpreflt;c:\windows\system32\DRIVERS\tmpreflt.sys [x]

S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2009-09-28 251760]

S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [x]

S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2009-10-01 2314240]

S3 FwLnk;FwLnk Driver;c:\windows\system32\DRIVERS\FwLnk.sys [x]

S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]

S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [x]

S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-11-05 137560]

S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2009-11-10 824688]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Contents of the 'Scheduled Tasks' folder

.

2011-10-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cc6e8dbc908379.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-16 03:21]

.

2011-10-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA1cc8ba031373832.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-16 03:21]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ThpSrv"="c:\windows\system32\thpsrv" [X]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-11-03 8312352]

"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2009-11-05 709976]

"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2010-02-16 1022368]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-18 16414824]

"Logitech Download Assistant"="c:\windows\system32\rundll32.exe" [2009-07-14 45568]

"combofix"="c:\combofix\CF14750.3XE" [2009-07-14 344576]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA

mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA

mLocal Page = %SystemRoot%\system32\blank.htm

uInternet Settings,ProxyOverride = <local>

IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office14\EXCEL.EXE/3000

TCP: DhcpNameServer = 68.87.77.134 68.87.72.134

FF - ProfilePath - c:\users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\i5yauydc.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IPGTDF&PC=IPGTDF&q=

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IPGTDF&PC=IPGTDF&q=

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Xmarks: foxmarks@kei.com - %profile%\extensions\foxmarks@kei.com

FF - Ext: Qute: {36C13C8F-54F1-412e-8177-2E411719162D} - %profile%\extensions\{36C13C8F-54F1-412e-8177-2E411719162D}

FF - Ext: Qute 3++ (custom mod): {aa26583b-4c35-4729-913e-156956078824} - %profile%\extensions\{aa26583b-4c35-4729-913e-156956078824}

FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

FF - Ext: Apture: plugin@apture.com - %profile%\extensions\plugin@apture.com

FF - Ext: Move Media Player: moveplayer@movenetworks.com - c:\users\owner\AppData\Roaming\Move Networks

.

- - - - ORPHANS REMOVED - - - -

.

Wow6432Node-HKCU-Run-AdobeBridge - (no file)

Wow6432Node-HKLM-Run-TUSBSleepChargeSrv - %ProgramFiles(x86)%\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

HKLM-Run-(Default) - (no file)

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE

HKLM-Run-HSON - c:\program files (x86)\TOSHIBA\TBS\HSON.exe

HKLM-Run-SmoothView - c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe

HKLM-Run-00TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe

HKLM-Run-Teco - c:\program files (x86)\TOSHIBA\TECO\Teco.exe

HKLM-Run-TosWaitSrv - c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe

HKLM-Run-SmartFaceVWatcher - c:\program files (x86)\Toshiba\SmartFaceV\SmartFaceVWatcher.exe

HKLM-Run-TosNC - c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe

HKLM-Run-TosReelTimeMonitor - c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe

AddRemove-Athan - c:\windows\iun6002.exe

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10b.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10b.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]

@Denied: (A 2) (Everyone)

@="IFlashBroker2"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE

.

**************************************************************************

.

Completion time: 2011-10-18 23:12:30 - machine was rebooted

ComboFix-quarantined-files.txt 2011-10-19 03:12

.

Pre-Run: 21,712,900,096 bytes free

Post-Run: 41,124,376,576 bytes free

.

- - End Of File - - 5FE7501F84325E872994C0E8108C3530

sba6x · October 19, 2011

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

DDS logs:

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421

Run by owner at 19:17:28 on 2011-10-19

Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.3959.1978 [GMT -4:00]

.

AV: Trend Micro AntiVirus *Enabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}

SP: Trend Micro AntiVirus *Enabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\windows\system32\wininit.exe

C:\windows\system32\lsm.exe

C:\windows\system32\svchost.exe -k DcomLaunch

C:\windows\system32\nvvsvc.exe

C:\windows\system32\svchost.exe -k RPCSS

C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\windows\system32\svchost.exe -k netsvcs

C:\windows\system32\svchost.exe -k LocalService

C:\windows\system32\svchost.exe -k NetworkService

C:\windows\system32\nvvsvc.exe

C:\windows\System32\spoolsv.exe

C:\windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\windows\SysWOW64\svchost.exe -k hpdevmgmt

C:\windows\system32\taskhost.exe

C:\windows\system32\taskeng.exe

C:\windows\system32\Dwm.exe

C:\windows\Explorer.EXE

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files (x86)\GenArts\rlm\rlm.exe

C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE

C:\Program Files (x86)\GenArts\rlm\rlm.exe

C:\windows\system32\conhost.exe

C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe

C:\windows\system32\svchost.exe -k imgsvc

C:\windows\system32\ThpSrv.exe

C:\Windows\system32\TODDSrv.exe

C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

C:\Program Files\TOSHIBA\TECO\TecoService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\windows\system32\SearchIndexer.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe

C:\windows\system32\SearchProtocolHost.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Program Files\TOSHIBA\TECO\Teco.exe

C:\Windows\System32\ThpSrv.exe

C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe

C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe

C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe

C:\Program Files\TOSHIBA\FlashCards\Hotkey\TcrdKBB.exe

C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\windows\system32\svchost.exe -k HPService

C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe

C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe

C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

C:\windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe

C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe

C:\Program Files\Trend Micro\BM\TMBMSRV.exe

C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe

C:\windows\system32\DllHost.exe

C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe

C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Program Files\Trend Micro\Internet Security\UfNavi.exe

C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

C:\windows\system32\wuauclt.exe

C:\Program Files\Trend Micro\Internet Security\UfNavi.exe

C:\windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe