[Resolved] Redirects

When i click links on google i am redirected.

Most of the time the first address will be directrdr.com then onto a site.


Used Malwarebytes, Spybot, Spyware doctor and found plenty of things through each but still have the problems, dont find anything recently when scanning but spyware doctor constantly stops things when i redirect.

I think it was originally causing Acer ePower Management to crash on startup until i uninstalled.


Acer Aspire Notebook
Windows Vista SP2



Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:24:08, on 12/12/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18865)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\agrsmsvc.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Users\Jack\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Cyberlink\Shared files\RichVideo.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\msiexec.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://forum.consolegaming.eu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…p;m=aspire_5735
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…p;m=aspire_5735
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: (no name) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O16 - DPF: Justin.tv Publisher - http://www.justin.tv/plugins/justintv_publisher.CAB
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0D7A7AB-BC77-4C25-870A-48AB928AC7E0}: NameServer = 192.168.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{B0D7A7AB-BC77-4C25-870A-48AB928AC7E0}: NameServer = 192.168.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{B0D7A7AB-BC77-4C25-870A-48AB928AC7E0}: NameServer = 192.168.0.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{B0D7A7AB-BC77-4C25-870A-48AB928AC7E0}: NameServer = 192.168.0.1
O17 - HKLM\System\CS4\Services\Tcpip\..\{B0D7A7AB-BC77-4C25-870A-48AB928AC7E0}: NameServer = 192.168.0.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Browser Defender Update Service - Threat Expert Ltd. - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c9e779192abe64) (gupdate1c9e779192abe64) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: TVersityMediaServer - Unknown owner - C:\Program Files\TVersity\Media Server\MediaServer.exe

–
End of file - 13678 bytes

GMER 1.0.15.15279 - http://www.gmer.net
Rootkit scan 2009-12-12 20:22:31
Windows 6.0.6002 Service Pack 2
Running: gmer.exe; Driver: C:\Users\Jack\AppData\Local\Temp\kwldypoc.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0x8270BCDE]
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0x8270BED0]
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwTerminateProcess [0x8270B984]
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateUserProcess [0x8270C0D8]

INT 0x72 ? 86976BF8
INT 0x72 ? 86976BF8
INT 0x72 ? 86976BF8
INT 0x72 ? 86976BF8
INT 0x72 ? 86976BF8
INT 0x82 ? 86976BF8
INT 0x92 ? 84AE8BF8
INT 0x92 ? 84AE8BF8
INT 0x92 ? 84AE8BF8
INT 0x92 ? 84AE8BF8
INT 0x92 ? 84AE8BF8
INT 0xA2 ? 86976BF8
INT 0xB2 ? 86976BF8

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!KeSetEvent + 209 820C194C 3 Bytes [DE, BC, 70]
.text ntkrnlpa.exe!KeSetEvent + 20D 820C1950 3 Bytes [D0, BE, 70]
.text ntkrnlpa.exe!KeSetEvent + 621 820C1D64 3 Bytes [84, B9, 70]
.text ntkrnlpa.exe!KeSetEvent + 6E5 820C1E28 3 Bytes [D8, C0, 70]
? System32\Drivers\spmf.sys The system cannot find the path specified. !
.text USBPORT.SYS!DllUnload 82F3B41B 5 Bytes JMP 869761D8
C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl entry point in "" section [0xAFB1A41C]
.clc C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl unknown last code section [0xAFB1B000, 0x1000, 0xE0000020]

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Launch Manager\LManager.exe[896] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Launch Manager\LManager.exe[896] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Launch Manager\LManager.exe[896] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Program Files\Launch Manager\LManager.exe[896] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Launch Manager\LManager.exe[896] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Program Files\Launch Manager\LManager.exe[896] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Windows\system32\svchost.exe[900] ole32.dll!CoCreateInstance 77529EA6 5 Bytes JMP 00CC000A
.text C:\Windows\system32\taskeng.exe[916] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\taskeng.exe[916] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Windows\system32\taskeng.exe[916] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\taskeng.exe[916] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\taskeng.exe[916] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Windows\system32\taskeng.exe[916] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Windows\system32\wbem\unsecapp.exe[1708] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\wbem\unsecapp.exe[1708] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Windows\system32\wbem\unsecapp.exe[1708] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\wbem\unsecapp.exe[1708] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[1708] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Windows\system32\wbem\unsecapp.exe[1708] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe[1736] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe[1736] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe[1736] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe[1736] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe[1736] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe[1736] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Program Files\MagicDisc\MagicDisc.exe[1812] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Program Files\MagicDisc\MagicDisc.exe[1812] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\MagicDisc\MagicDisc.exe[1812] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Program Files\MagicDisc\MagicDisc.exe[1812] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\MagicDisc\MagicDisc.exe[1812] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Program Files\MagicDisc\MagicDisc.exe[1812] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[1832] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[1832] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[1832] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[1832] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[1832] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[1832] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Windows\system32\wbem\wmiprvse.exe[2388] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\wbem\wmiprvse.exe[2388] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Windows\system32\wbem\wmiprvse.exe[2388] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\wbem\wmiprvse.exe[2388] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[2388] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Windows\system32\wbem\wmiprvse.exe[2388] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[2520] kernel32.dll!CreateThread + 1A 7723C928 4 Bytes CALL 0044BC05 C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools Security Service/PC Tools)
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2596] kernel32.dll!CreateThread + 1A 7723C928 4 Bytes CALL 0044B8D9 C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools Tray Application/PC Tools)
.text C:\Users\Jack\Desktop\gmer.exe[2688] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Users\Jack\Desktop\gmer.exe[2688] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Users\Jack\Desktop\gmer.exe[2688] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Users\Jack\Desktop\gmer.exe[2688] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Users\Jack\Desktop\gmer.exe[2688] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Users\Jack\Desktop\gmer.exe[2688] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Program Files\RocketDock\RocketDock.exe[2812] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Program Files\RocketDock\RocketDock.exe[2812] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\RocketDock\RocketDock.exe[2812] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Program Files\RocketDock\RocketDock.exe[2812] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\RocketDock\RocketDock.exe[2812] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Program Files\RocketDock\RocketDock.exe[2812] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe[2856] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe[2856] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe[2856] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe[2856] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe[2856] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe[2856] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2920] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2920] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2920] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2920] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2920] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2920] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Windows\RtHDVCpl.exe[2928] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Windows\RtHDVCpl.exe[2928] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Windows\RtHDVCpl.exe[2928] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Windows\RtHDVCpl.exe[2928] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Windows\RtHDVCpl.exe[2928] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Windows\RtHDVCpl.exe[2928] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Windows\system32\igfxext.exe[2976] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\igfxext.exe[2976] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Windows\system32\igfxext.exe[2976] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\igfxext.exe[2976] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxext.exe[2976] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Windows\system32\igfxext.exe[2976] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Windows\system32\igfxsrvc.exe[2996] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\igfxsrvc.exe[2996] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Windows\system32\igfxsrvc.exe[2996] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\igfxsrvc.exe[2996] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2996] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Windows\system32\igfxsrvc.exe[2996] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Program Files\iTunes\iTunesHelper.exe[3100] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Program Files\iTunes\iTunesHelper.exe[3100] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\iTunes\iTunesHelper.exe[3100] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Program Files\iTunes\iTunesHelper.exe[3100] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[3100] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Program Files\iTunes\iTunesHelper.exe[3100] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe[3456] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe[3456] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe[3456] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe[3456] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe[3456] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe[3456] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Program Files\iPod\bin\iPodService.exe[3484] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Program Files\iPod\bin\iPodService.exe[3484] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\iPod\bin\iPodService.exe[3484] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Program Files\iPod\bin\iPodService.exe[3484] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[3484] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Program Files\iPod\bin\iPodService.exe[3484] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Users\Jack\AppData\Local\Temp\RtkBtMnt.exe[3504] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Users\Jack\AppData\Local\Temp\RtkBtMnt.exe[3504] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Users\Jack\AppData\Local\Temp\RtkBtMnt.exe[3504] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Users\Jack\AppData\Local\Temp\RtkBtMnt.exe[3504] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Users\Jack\AppData\Local\Temp\RtkBtMnt.exe[3504] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Users\Jack\AppData\Local\Temp\RtkBtMnt.exe[3504] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Program Files\Alwil Software\Avast4\ashWebSv.exe[3508] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Alwil Software\Avast4\ashWebSv.exe[3508] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Alwil Software\Avast4\ashWebSv.exe[3508] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Program Files\Alwil Software\Avast4\ashWebSv.exe[3508] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Alwil Software\Avast4\ashWebSv.exe[3508] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Program Files\Alwil Software\Avast4\ashWebSv.exe[3508] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3688] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3688] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3688] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3688] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3688] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3688] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[3876] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[3876] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[3876] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[3876] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[3876] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[3876] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Windows\system32\igfxsrvc.exe[3996] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\igfxsrvc.exe[3996] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Windows\system32\igfxsrvc.exe[3996] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\igfxsrvc.exe[3996] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[3996] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Windows\system32\igfxsrvc.exe[3996] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[4052] kernel32.dll!LoadLibraryExW 77219109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[4052] USER32.dll!ChangeDisplaySettingsExA 77436FE7 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[4052] USER32.dll!SetForegroundWindow 7743B8A6 6 Bytes JMP 5F040F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[4052] USER32.dll!SetWindowPos 774435E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[4052] USER32.dll!SetWindowPos + 4 774435E7 2 Bytes [0B, 5F]
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[4052] USER32.dll!ChangeDisplaySettingsExW 7747A9E4 6 Bytes JMP 5F100F5A

—- Kernel IAT/EAT - GMER 1.0.15 —-

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [806936D6] \SystemRoot\System32\Drivers\spmf.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [80693042] \SystemRoot\System32\Drivers\spmf.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [80693800] \SystemRoot\System32\Drivers\spmf.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort] [806930C0] \SystemRoot\System32\Drivers\spmf.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [8069313E] \SystemRoot\System32\Drivers\spmf.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [806A2E9C] \SystemRoot\System32\Drivers\spmf.sys

—- User IAT/EAT - GMER 1.0.15 —-

IAT C:\Windows\system32\services.exe[680] @ C:\Windows\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00020002
IAT C:\Windows\system32\services.exe[680] @ C:\Windows\system32\services.exe [KERNEL32.dll!CreateProcessW] 00020000
IAT C:\Windows\Explorer.EXE[1820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [74507817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [7455A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7450BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [744FF695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [745075E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [744FE7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [74538395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [7450DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [744FFFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [744FFF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [744F71CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [7458CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [7452C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [744FD968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [744F6853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [744F687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [74502AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Program Files\Spyware Doctor\pctsSvc.exe[2520] @ C:\Windows\system32\shell32.dll [KERNEL32.dll!QueueUserWorkItem] [0044BD5C] C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools Security Service/PC Tools)
IAT C:\Program Files\Spyware Doctor\pctsSvc.exe[2520] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!QueueUserWorkItem] [0044BD5C] C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools Security Service/PC Tools)
IAT C:\Program Files\Spyware Doctor\pctsTray.exe[2596] @ C:\Windows\system32\shell32.dll [KERNEL32.dll!QueueUserWorkItem] [0044BA30] C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools Tray Application/PC Tools)
IAT C:\Program Files\Spyware Doctor\pctsTray.exe[2596] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!QueueUserWorkItem] [0044BA30] C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools Tray Application/PC Tools)

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 858AE1F8
Device \FileSystem\fastfat \FatCdrom 874D21F8
Device \FileSystem\udfs \UdfsCdRom 869AA1F8
Device \FileSystem\udfs \UdfsDisk 869AA1F8

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

Device \Driver\netbt \Device\NetBT_Tcpip_{B2F92526-DE9F-495F-A294-3A52887162C2} 85915500

AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

Device \Driver\volmgr \Device\VolMgrControl 84AEA1F8
Device \Driver\usbuhci \Device\USBPDO-0 8698E1F8
Device \Driver\netbt \Device\NetBT_Tcpip_{B0D7A7AB-BC77-4C25-870A-48AB928AC7E0} 85915500
Device \Driver\usbuhci \Device\USBPDO-1 8698E1F8
Device \Driver\usbuhci \Device\USBPDO-2 8698E1F8
Device \Driver\usbehci \Device\USBPDO-3 8698F1F8
Device \Driver\usbuhci \Device\USBPDO-4 8698E1F8

AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\usbuhci \Device\USBPDO-5 8698E1F8
Device \Driver\usbuhci \Device\USBPDO-6 8698E1F8
Device \Driver\volmgr \Device\HarddiskVolume1 84AEA1F8
Device \Driver\usbehci \Device\USBPDO-7 8698F1F8
Device \Driver\volmgr \Device\HarddiskVolume2 84AEA1F8
Device \Driver\cdrom \Device\CdRom0 8698C1F8
Device \Driver\volmgr \Device\HarddiskVolume3 84AEA1F8
Device \Driver\cdrom \Device\CdRom1 8698C1F8
Device \Driver\atapi \Device\Ide\IdePort0 84AEC1F8
Device \Driver\atapi \Device\Ide\IdePort1 84AEC1F8
Device \Driver\atapi \Device\Ide\IdePort2 84AEC1F8
Device \Driver\atapi \Device\Ide\IdePort3 84AEC1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1 84AEC1F8
Device \Driver\msahci \Device\Ide\PciIde0Channel0 858AD1F8
Device \Driver\msahci \Device\Ide\PciIde0Channel1 858AD1F8
Device \Driver\msahci \Device\Ide\PciIde0Channel4 858AD1F8
Device \Driver\msahci \Device\Ide\PciIde0Channel5 858AD1F8
Device \Driver\PCTSDInjDriver32 \Device\PCTSDInjDriver32 PCTSDInj32.sys
Device \Driver\netbt \Device\NetBt_Wins_Export 85915500
Device \Driver\Smb \Device\NetbiosSmb 872EE1F8
Device \Driver\iScsiPrt \Device\RaidPort0 86BB61F8

AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\usbuhci \Device\USBFDO-0 8698E1F8
Device \Driver\usbuhci \Device\USBFDO-1 8698E1F8
Device \Driver\usbuhci \Device\USBFDO-2 8698E1F8
Device \Driver\usbehci \Device\USBFDO-3 8698F1F8
Device \Driver\usbuhci \Device\USBFDO-4 8698E1F8
Device \Driver\usbuhci \Device\USBFDO-5 8698E1F8
Device \Driver\usbuhci \Device\USBFDO-6 8698E1F8
Device \Driver\usbehci \Device\USBFDO-7 8698F1F8
Device \FileSystem\fastfat \Fat 874D21F8

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\cdfs \Cdfs 8845C1F8

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{7A7FFD93-A4A6-DBC6-498D-4E6ECA6B2EED}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{7A7FFD93-A4A6-DBC6-498D-4E6ECA6B2EED}@hachehgiclgmhnno 0x69 0x61 0x63 0x6F …
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{7A7FFD93-A4A6-DBC6-498D-4E6ECA6B2EED}@iaaimjfkoaalmcgggh 0x63 0x61 0x64 0x6F …
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{7A7FFD93-A4A6-DBC6-498D-4E6ECA6B2EED}@jalhpjhllhiklpjleapb 0x63 0x61 0x65 0x6F …

—- EOF - GMER 1.0.15 —-

Finally done it.

ComboFix 09-12-11.05 - Jack 13/12/2009 16:06:17.8.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.44.1033.18.3000.2049 [GMT 0:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2479007779-4041249233-1858324917-500
c:\users\Jack\AppData\Roaming\.#
c:\users\Jack\AppData\Roaming\inst.exe
c:\windows\system32\twain_32.dll
D:\install.exe

.
((((((((((((((((((((((((( Files Created from 2009-11-13 to 2009-12-13 )))))))))))))))))))))))))))))))
.

2009-12-13 16:20 . 2009-12-13 16:20 ——– d—–w- c:\users\Jack\AppData\Local\temp
2009-12-13 16:20 . 2009-12-13 16:20 ——– d—–w- c:\users\Default\AppData\Local\temp
2009-12-13 15:07 . 2009-12-13 15:07 ——– d—–w- c:\users\Jack\AppData\Local\Apple
2009-12-13 13:55 . 2009-10-27 14:11 834048 —-a-w- c:\windows\system32\wininet.dll
2009-12-13 13:55 . 2009-10-27 13:16 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-12-13 00:14 . 2009-12-13 00:14 247296 —-a-w- c:\users\Jack\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_4_0_11_0_d_ind.dll
2009-12-13 00:14 . 2009-12-13 00:14 247296 —-a-w- c:\users\Jack\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_4_0_11_0_c_ind.dll
2009-12-13 00:14 . 2009-12-13 00:14 247296 —-a-w- c:\users\Jack\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_4_0_11_0_b_ind.dll
2009-12-13 00:14 . 2009-12-13 00:14 247296 —-a-w- c:\users\Jack\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_4_0_11_0_a_ind.dll
2009-12-13 00:14 . 2009-12-13 00:14 ——– d—–w- c:\users\Jack\AppData\Roaming\SystemRequirementsLab
2009-12-13 00:01 . 2009-07-14 17:45 445008 —-a-w- c:\windows\system32\drivers\Wdf01000.sys
2009-12-13 00:01 . 2009-07-14 17:45 38480 —-a-w- c:\windows\system32\drivers\WdfLdr.sys
2009-12-13 00:00 . 2009-08-28 09:32 120104 —-a-w- c:\windows\system32\SynTPCo4.dll
2009-12-13 00:00 . 2009-08-28 09:32 206120 —-a-w- c:\windows\system32\SynCtrl.dll
2009-12-13 00:00 . 2009-08-07 08:49 1461992 —-a-w- c:\windows\system32\WdfCoInstaller01009.dll
2009-12-13 00:00 . 2009-08-28 09:33 228784 —-a-w- c:\windows\system32\drivers\SynTP.sys
2009-12-12 23:13 . 2008-09-22 10:53 61440 —-a-w- c:\windows\system32\MCEPlugin.dll
2009-12-12 23:13 . 2008-09-22 10:53 208896 —-a-w- c:\windows\system32\SysHook.dll
2009-12-12 22:02 . 2009-12-12 22:02 ——– d—–w- c:\users\Jack\AppData\Local\Adobe
2009-12-12 20:39 . 2009-12-12 20:39 ——– d—–w- c:\program files\ESET
2009-12-11 16:24 . 2009-12-11 16:24 4593468 —-a-w- c:\users\Jack\AppData\Roaming\TVU networks\AutoUpgrade\TVUPlayer2.4.9.1.exe
2009-12-10 20:07 . 2009-11-03 21:42 30720 —-a-w- c:\windows\system32\httpapi.dll
2009-12-10 20:07 . 2009-11-03 19:41 411648 —-a-w- c:\windows\system32\drivers\http.sys
2009-12-10 20:07 . 2009-11-03 21:43 24064 —-a-w- c:\windows\system32\nshhttp.dll
2009-12-10 20:06 . 2009-08-24 11:36 377344 —-a-w- c:\windows\system32\winhttp.dll
2009-12-10 20:06 . 2009-10-07 11:36 243712 —-a-w- c:\windows\system32\rastls.dll
2009-12-09 17:58 . 2009-12-09 17:58 4844296 —-a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-12-07 21:17 . 2009-12-11 20:13 ——– d—–w- c:\programdata\Vso
2009-12-07 21:15 . 2009-12-07 21:15 47360 —-a-w- c:\windows\system32\drivers\pcouffin.sys
2009-12-07 21:15 . 2009-12-07 21:15 47360 —-a-w- c:\users\Jack\AppData\Roaming\pcouffin.sys
2009-12-07 21:15 . 2009-12-11 20:13 ——– d—–w- c:\users\Jack\AppData\Roaming\Vso
2009-12-07 19:47 . 2009-12-07 19:47 ——– d—–w- c:\users\Jack\AppData\Local\Threat Expert
2009-12-07 19:17 . 2009-12-07 19:19 ——– d—–w- c:\programdata\NtiDvdCopy
2009-12-07 16:16 . 2009-12-07 21:14 ——– d—–w- c:\program files\vso
2009-12-02 21:04 . 2008-11-06 02:03 ——– d—–w- C:\SDFix
2009-12-02 18:25 . 2009-12-02 18:25 ——– d—–w- c:\program files\iPod
2009-12-02 18:25 . 2009-12-02 18:26 ——– d—–w- c:\program files\iTunes
2009-12-02 18:17 . 2009-12-02 18:18 ——– d—–w- c:\program files\QuickTime
2009-12-02 18:09 . 2009-12-02 18:09 79144 —-a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-30 17:46 . 2009-11-30 17:46 ——– d—–w- c:\users\Jack\AppData\Roaming\PC Tools
2009-11-30 17:46 . 2009-11-30 17:46 ——– d—–w- c:\programdata\PC Tools
2009-11-30 17:13 . 2009-11-30 19:29 ——– d-sh–w- c:\users\Jack\AppData\Roaming\lowsec
2009-11-29 15:11 . 2008-08-19 14:27 487424 —-a-w- c:\windows\system32\INT15.dll
2009-11-29 15:11 . 2008-08-19 14:23 17952 —-a-w- c:\windows\system32\drivers\int15_64.sys
2009-11-29 15:11 . 2008-08-19 14:23 15392 —-a-w- c:\windows\system32\drivers\int15.sys
2009-11-29 13:42 . 2009-11-29 13:42 ——– d—–w- c:\program files\Trend Micro
2009-11-28 20:44 . 2009-11-30 19:25 ——– d—–w- c:\programdata\Spybot - Search & Destroy
2009-11-28 20:44 . 2009-11-28 20:47 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-11-28 13:03 . 2009-11-28 13:03 ——– d—–w- c:\users\Jack\AppData\Roaming\Malwarebytes
2009-11-28 13:02 . 2009-12-03 16:14 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-28 13:02 . 2009-12-09 17:59 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-11-28 13:02 . 2009-12-03 16:13 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-11-28 13:02 . 2009-11-28 13:02 ——– d—–w- c:\programdata\Malwarebytes
2009-11-27 23:01 . 2009-11-27 23:21 ——– d—–w- c:\users\Jack\AppData\Roaming\Pamela
2009-11-25 16:52 . 2009-10-29 09:17 2048 —-a-w- c:\windows\system32\tzres.dll
2009-11-25 13:24 . 2009-08-11 16:44 1401856 —-a-w- c:\windows\system32\msxml6.dll
2009-11-25 13:24 . 2009-08-11 16:44 1248768 —-a-w- c:\windows\system32\msxml3.dll
2009-11-24 18:15 . 2009-11-19 11:48 872960 —-a-w- c:\users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2009-11-24 18:15 . 2009-11-19 11:48 43008 —-a-w- c:\users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-11-24 18:15 . 2009-11-19 11:48 340480 —-a-w- c:\users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-11-24 18:15 . 2009-11-19 11:48 346624 —-a-w- c:\users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-11-18 03:24 . 2009-11-18 03:24 ——– d—–w- c:\program files\Windows Portable Devices
2009-11-18 03:01 . 2009-10-01 01:01 60928 —-a-w- c:\windows\system32\PortableDeviceConnectApi.dll
2009-11-18 03:01 . 2009-10-01 01:02 2537472 —-a-w- c:\windows\system32\wpdshext.dll
2009-11-18 03:01 . 2009-10-01 01:02 334848 —-a-w- c:\windows\system32\PortableDeviceApi.dll
2009-11-18 03:01 . 2009-10-01 01:02 87552 —-a-w- c:\windows\system32\WPDShServiceObj.dll
2009-11-18 03:01 . 2009-10-01 01:01 546816 —-a-w- c:\windows\system32\wpd_ci.dll
2009-11-18 03:01 . 2009-10-01 01:01 160256 —-a-w- c:\windows\system32\PortableDeviceTypes.dll
2009-11-18 03:01 . 2009-10-01 01:01 350208 —-a-w- c:\windows\system32\WPDSp.dll
2009-11-18 03:01 . 2009-10-01 01:01 196608 —-a-w- c:\windows\system32\PortableDeviceWMDRM.dll
2009-11-18 03:01 . 2009-10-01 01:01 100864 —-a-w- c:\windows\system32\PortableDeviceClassExtension.dll
2009-11-18 03:00 . 2009-10-08 21:08 555520 —-a-w- c:\windows\system32\UIAutomationCore.dll
2009-11-18 03:00 . 2009-10-08 21:08 234496 —-a-w- c:\windows\system32\oleacc.dll
2009-11-18 03:00 . 2009-10-08 21:07 4096 —-a-w- c:\windows\system32\oleaccrc.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-13 16:02 . 2009-11-30 17:46 ——– d—–w- c:\program files\Spyware Doctor
2009-12-13 00:14 . 2009-04-25 21:04 ——– d—–w- c:\program files\SystemRequirementsLab
2009-12-13 00:03 . 2009-12-13 00:03 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_SynTP_01009.Wdf
2009-12-13 00:02 . 2009-12-13 00:02 0 —ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2009-12-12 23:27 . 2009-05-26 15:40 ——– d—–w- c:\programdata\FLEXnet
2009-12-12 23:13 . 2008-05-15 05:26 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-12-12 00:02 . 2009-04-14 16:54 ——– d—–w- c:\users\Jack\AppData\Roaming\Skype
2009-12-12 00:01 . 2009-04-14 16:55 ——– d—–w- c:\users\Jack\AppData\Roaming\skypePM
2009-12-11 16:24 . 2009-08-13 20:21 ——– d—–w- c:\users\Jack\AppData\Roaming\TVU networks
2009-12-10 23:30 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2009-12-08 21:13 . 2009-06-11 21:50 ——– d—–w- c:\users\Jack\AppData\Roaming\Spotify
2009-12-08 15:33 . 2009-06-13 19:31 ——– d—–w- c:\program files\Super_DVD_Creator_9.8
2009-12-02 18:25 . 2009-04-14 18:01 ——– d—–w- c:\program files\Common Files\Apple
2009-11-30 17:51 . 2009-11-30 17:46 ——– d—–w- c:\program files\Common Files\PC Tools
2009-11-29 15:08 . 2009-04-17 21:09 6080 —-a-w- c:\users\Jack\AppData\Local\d3d9caps.dat
2009-11-28 20:07 . 2009-09-17 12:13 19944 —-a-w- c:\windows\system32\drivers\atapi.sys
2009-11-27 23:49 . 2008-05-15 05:47 ——– d—–w- c:\program files\Common Files\LightScribe
2009-11-27 23:46 . 2009-07-29 22:16 ——– d—–w- c:\program files\MagicDisc
2009-11-27 23:46 . 2009-05-20 19:43 ——– d—–w- c:\program files\RocketDock
2009-11-27 23:46 . 2009-05-06 20:34 ——– d—–w- c:\program files\SopCast
2009-11-26 14:22 . 2009-11-26 14:22 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_xusb21_01007.Wdf
2009-11-24 23:54 . 2009-04-15 16:02 1280480 —-a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:50 . 2009-04-15 16:02 114768 —-a-w- c:\windows\system32\drivers\aswSP.sys
2009-11-24 23:50 . 2009-04-15 16:02 20560 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-11-24 23:49 . 2009-04-15 16:02 53328 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2009-11-24 23:49 . 2009-04-15 16:02 48560 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2009-04-15 16:02 23120 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2009-04-15 16:02 97480 —-a-w- c:\windows\system32\AvastSS.scr
2009-11-18 03:24 . 2006-11-02 10:25 665600 —-a-w- c:\windows\inf\drvindex.dat
2009-11-18 03:24 . 2009-11-18 03:24 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2009-11-16 21:38 . 2008-12-20 20:20 ——– d—–w- c:\program files\Common Files\Adobe
2009-11-10 10:28 . 2009-11-30 17:51 149456 —-a-w- c:\windows\SGDetectionTool.dll
2009-11-10 10:28 . 2009-11-30 17:51 165840 —-a-w- c:\windows\PCTBDRes.dll
2009-11-10 10:28 . 2009-11-30 17:51 1640400 —-a-w- c:\windows\PCTBDCore.dll
2009-11-10 10:26 . 2009-11-30 17:51 767952 —-a-w- c:\windows\BDTSupport.dll
2009-11-09 11:20 . 2009-11-30 17:46 207792 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2009-11-04 15:13 . 2009-04-14 15:34 ——– d—–r- c:\program files\Skype
2009-11-04 15:13 . 2009-11-04 15:13 ——– d—–w- c:\program files\Common Files\Skype
2009-11-04 15:13 . 2009-04-14 15:34 ——– d—–w- c:\programdata\Skype
2009-11-03 21:05 . 2009-04-14 15:46 ——– d—–w- c:\program files\Messenger Plus! Live
2009-11-02 20:42 . 2009-10-02 19:21 195456 ——w- c:\windows\system32\MpSigStub.exe
2009-11-02 13:28 . 2009-10-14 16:53 ——– d—–w- c:\program files\Steam
2009-10-30 21:23 . 2009-08-28 14:16 ——– d—–w- c:\program files\Common Files\Steam
2009-10-30 20:11 . 2009-04-14 19:01 ——– d—–w- c:\users\Jack\AppData\Roaming\Sports Interactive
2009-10-30 18:34 . 2009-04-14 19:43 ——– d—–w- c:\program files\Sports Interactive
2009-10-30 17:47 . 2009-10-14 17:02 ——– d—–w- c:\programdata\Media Center Programs
2009-10-30 11:11 . 2009-11-30 17:46 233136 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-10-30 11:09 . 2009-11-30 17:46 98600 —-a-w- c:\windows\system32\drivers\pctwfpfilter.sys
2009-10-28 01:36 . 2009-11-30 17:51 1152444 —-a-w- c:\windows\UDB.zip
2009-10-22 13:52 . 2009-10-22 13:52 ——– d—–w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-10-21 12:45 . 2009-10-21 12:45 ——– d—–w- c:\program files\WinPcap
2009-10-21 12:45 . 2009-10-21 12:45 ——– d—–w- c:\program files\StreamingStar
2009-10-17 11:02 . 2008-05-15 05:33 ——– d—–w- c:\program files\Microsoft Works
2009-10-16 15:50 . 2009-11-10 11:43 2520888 —-a-w- c:\users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\extensions\[removed]\plugins\npTVUAx.dll
2009-10-14 19:59 . 2009-04-14 19:36 ——– d—–w- c:\programdata\Sports Interactive
2009-10-11 22:03 . 2009-10-11 22:03 175616 —-a-w- c:\users\Jack\AppData\Roaming\EA\EASW\GameFace\unrar64_nocrypt.dll
2009-10-11 22:03 . 2009-10-11 22:03 150528 —-a-w- c:\users\Jack\AppData\Roaming\EA\EASW\GameFace\unrar_nocrypt.dll
2009-10-11 22:03 . 2009-10-11 22:03 30208 —-a-w- c:\users\Jack\AppData\Roaming\EA\EASW\GameFace\FileDownloadConsole.exe
2009-10-06 16:31 . 2009-11-30 17:46 87784 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-10-01 01:02 . 2009-11-18 03:02 30208 —-a-w- c:\windows\system32\WPDShextAutoplay.exe
2009-10-01 01:02 . 2009-11-18 03:02 31232 —-a-w- c:\windows\system32\BthMtpContextHandler.dll
2009-10-01 01:01 . 2009-11-18 03:02 81920 —-a-w- c:\windows\system32\wpdbusenum.dll
2009-09-30 18:15 . 2009-10-11 22:04 13312 —-a-w- c:\users\Jack\AppData\Roaming\EA\EASW\GameFace\PhotoFaceConsole.exe
2009-09-30 18:14 . 2009-10-11 22:04 15872 —-a-w- c:\users\Jack\AppData\Roaming\EA\EASW\GameFace\PhotoFaceConsole.XmlSerializers.dll
2009-09-30 09:41 . 2009-10-11 22:04 361472 —-a-r- c:\users\Jack\AppData\Roaming\EA\EASW\GameFace\FgPhotofitDll.dll
2009-09-29 19:57 . 2009-09-29 19:57 25280 —-a-w- c:\windows\system32\drivers\hamachi.sys
2009-09-29 19:29 . 2009-10-11 22:04 6144 —-a-w- c:\users\Jack\AppData\Roaming\EA\EASW\GameFace\DetectOpenGLConsole.exe
2009-09-29 19:29 . 2009-10-11 22:04 5120 —-a-w- c:\users\Jack\AppData\Roaming\EA\EASW\GameFace\DownloadSourcePhotoConsole.exe
2009-09-29 19:29 . 2009-10-11 22:04 9216 —-a-w- c:\users\Jack\AppData\Roaming\EA\EASW\GameFace\UploadPhotofitConsole.exe
2009-09-28 12:12 . 2009-09-27 23:25 5 —-a-w- c:\windows\sbacknt.bin
2009-09-28 11:17 . 2009-09-27 23:25 152904 —-a-w- c:\windows\system32\vghd.scr
2009-09-28 09:59 . 2008-12-20 20:07 1002008 —-a-w- c:\windows\system32\igxpun.exe
2009-09-27 23:26 . 2009-07-12 18:04 177024 —-a-w- c:\users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\FlashGot.exe
2009-09-25 02:10 . 2009-11-18 03:02 974848 —-a-w- c:\windows\system32\WindowsCodecs.dll
2009-09-25 02:07 . 2009-11-18 03:02 189440 —-a-w- c:\windows\system32\WindowsCodecsExt.dll
2009-09-25 02:04 . 2009-11-18 03:02 321024 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll
2009-09-25 01:49 . 2009-11-18 03:02 1554432 —-a-w- c:\windows\system32\xpsservices.dll
2009-09-25 01:48 . 2009-11-18 03:02 351232 —-a-w- c:\windows\system32\XpsPrint.dll
2009-09-25 01:38 . 2009-11-18 03:02 847360 —-a-w- c:\windows\system32\OpcServices.dll
2009-09-25 01:36 . 2009-11-18 03:02 280064 —-a-w- c:\windows\system32\XpsGdiConverter.dll
2009-09-25 01:35 . 2009-11-18 03:02 135680 —-a-w- c:\windows\system32\XpsRasterService.dll
2009-09-25 01:33 . 2009-11-18 03:02 195584 —-a-w- c:\windows\system32\dxdiagn.dll
2009-09-25 01:33 . 2009-11-18 03:02 829440 —-a-w- c:\windows\system32\d3d10warp.dll
2009-09-25 01:33 . 2009-11-18 03:02 369664 —-a-w- c:\windows\system32\WMPhoto.dll
2009-09-25 01:32 . 2009-11-18 03:02 252928 —-a-w- c:\windows\system32\dxdiag.exe
2009-09-25 01:31 . 2009-11-18 03:02 519680 —-a-w- c:\windows\system32\d3d11.dll
2009-09-25 01:31 . 2009-11-18 03:02 486912 —-a-w- c:\windows\system32\d3d10level9.dll
2009-09-25 01:31 . 2009-11-18 03:02 161280 —-a-w- c:\windows\system32\d3d10_1.dll
2009-09-25 01:31 . 2009-11-18 03:02 218112 —-a-w- c:\windows\system32\d3d10_1core.dll
2009-09-25 01:31 . 2009-11-18 03:02 1030144 —-a-w- c:\windows\system32\d3d10.dll
2009-09-25 01:31 . 2009-11-18 03:02 828928 —-a-w- c:\windows\system32\d2d1.dll
2009-09-25 01:30 . 2009-11-18 03:02 481792 —-a-w- c:\windows\system32\dxgi.dll
2009-09-25 01:30 . 2009-11-18 03:02 190464 —-a-w- c:\windows\system32\d3d10core.dll
2009-09-25 01:27 . 2009-11-18 03:02 634880 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys
2009-09-25 01:27 . 2009-11-18 03:02 37888 —-a-w- c:\windows\system32\cdd.dll
2009-09-25 01:27 . 2009-11-18 03:02 793088 —-a-w- c:\windows\system32\FntCache.dll
2009-09-25 01:27 . 2009-11-18 03:02 1064448 —-a-w- c:\windows\system32\DWrite.dll
2009-09-24 22:54 . 2009-11-18 03:02 258048 —-a-w- c:\windows\system32\winspool.drv
2009-09-24 22:54 . 2009-11-18 03:02 667648 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe
2009-09-24 22:54 . 2009-11-18 03:02 26112 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2008-12-20 20:47 . 2008-12-20 20:45 8192 –sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-08-28 1557800]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-04-18 167936]
"RtHDVCpl"="RtHDVCpl.exe" [2008-06-13 6183456]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-09-10 809480]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-04-10 147456]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-29 185896]
"Skytel"="Skytel.exe" [2007-11-21 1826816]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-09 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-09 175128]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-09 153624]

c:\users\Jack\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2009-7-29 576000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Privoxy.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Privoxy.lnk
backup=c:\windows\pss\Privoxy.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcadeDeluxeAgent]
2008-04-10 23:30 147456 —-a-w- c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BkupTray]
2008-04-07 05:42 34040 —-a-w- c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer]
2009-03-18 09:43 173352 ——w- c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ePower_DMC]
2008-09-23 09:40 413696 —-a-w- c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-09-09 09:09 175128 —-a-w- c:\windows\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-09-09 09:09 141848 —-a-w- c:\windows\System32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2009-12-03 16:14 1394000 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-09-09 09:09 153624 —-a-w- c:\windows\System32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-07-01 14:49 148888 —-a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
2003-08-19 00:01 110592 —-a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-21 02:33 1008184 —-a-w- c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(:ba,1b,5a,51,f6,37,ca,01

R0 PCTCore;PCTools KDS;c:\windows\System32\drivers\PCTCore.sys [30/11/2009 17:46 207792]
R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [15/04/2009 16:02 114768]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl [15/05/2008 05:52 61424]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [15/04/2009 16:02 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [15/04/2009 16:02 53328]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [30/11/2009 17:51 112592]
R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [03/03/2008 20:11 16384]
R2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [15/05/2008 05:53 81504]
R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [07/04/2008 05:42 50424]
R2 NTIPPKernel;NTIPPKernel;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [15/05/2008 05:53 122368]
R2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [24/08/2009 14:51 185640]
R3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\System32\drivers\netr28.sys [03/08/2009 13:54 569856]
S2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [29/11/2009 15:11 24576]
S2 gupdate1c9e779192abe64;Google Update Service (gupdate1c9e779192abe64);c:\program files\Google\Update\GoogleUpdate.exe [07/06/2009 14:06 133104]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [04/04/2008 10:03 131072]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [21/01/2008 02:32 179712]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [21/01/2008 02:33 21504]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\System32\drivers\npf.sys [06/11/2007 20:22 34064]
S3 NuVision;Hauppauge WinTV USB Pro (PAL I,D/K);c:\windows\System32\drivers\Nuvision.sys [17/05/2009 16:56 260144]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [30/11/2009 17:46 359624]

— Other Services/Drivers In Memory —

*Deregistered* - PCTSDInjDriver32

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
——- Supplementary Scan ——-
.
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l;=0809&s;=2&o;=vb32&d;=1208&m;=aspire_5735
uInternet Settings,ProxyOverride = *.local
IE: &D;&ownload; &with; BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D;&ownload; all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D;&ownload; all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {B0D7A7AB-BC77-4C25-870A-48AB928AC7E0} = 192.168.0.1
DPF: Justin.tv Publisher - hxxp://www.justin.tv/plugins/justintv_publisher.CAB
FF - ProfilePath - c:\users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\
FF - prefs.js: browser.startup.homepage - hxxp://forum.consolegaming.eu/
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
FF - plugin: c:\users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\extensions\[removed]\plugins\npTVUAx.dll
FF - plugin: c:\users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\imrwxte5.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npjustintvpublish.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
HKCU-Run-Sonic RecordNow! - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-13 16:20
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys PCTCore.sys >>UNKNOWN [0x85D13687]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x833a7d24
\Driver\ACPI -> acpi.sys @ 0x806bbd68
\Driver\atapi -> ataport.SYS @ 0x807caa2c
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->user & kernel MBR OK
copy of MBR has been found in sector 0x01D1C5000
malicious code @ sector 0x01D1C5003 !
PE file found in sector at 0x01D1C5019 !

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-2479007779-4041249233-1858324917-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{7A7FFD93-A4A6-DBC6-498D-4E6ECA6B2EED}*]
"hachehgiclgmhnno"=hex:69,61,63,6f,61,6b,70,6b,62,68,63,6c,66,6a,65,6f,68,65,
00,00
"iaaimjfkoaalmcgggh"=hex:63,61,64,6f,6a,6c,00,77
"jalhpjhllhiklpjleapb"=hex:63,61,65,6f,69,6c,00,00

[HKEY_USERS\S-1-5-21-2479007779-4041249233-1858324917-1000\Software\SecuROM\License information*]
"datasecu"=hex:30,c3,a2,32,17,6c,4a,35,f6,df,b5,e9,c6,80,13,f4,73,df,e1,de,fc,
b0,db,31,63,5e,b5,25,90,10,bd,33,af,04,09,31,8b,8c,a5,0e,75,b7,ac,75,bb,7b,\
"rkeysecu"=hex:cb,10,f7,8f,90,21,e1,b7,a2,8c,f9,9f,9a,d8,bf,98

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2009-12-13 16:25:58
ComboFix-quarantined-files.txt 2009-12-13 16:25

Pre-Run: 20,617,228,288 bytes free
Post-Run: 20,634,714,112 bytes free

Current=1 Default=1 Failed=0 LastKnownGood=10 Sets=1,2,3,4,5,6,7,8,9,10
- - End Of File - - BA5B8C3A41770DD2C3DF842A95670285