[Resolved] got rid of fake security updates...now running really slow

dwoods912 Topic Starter

Post #1December 13, 2009, 7:07 PM UTC last edited December 13, 2009, 7:23 PM UTC

Keep getting FAKE Security Center Alerts

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:43:30 PM, on 12/13/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16945)
Boot mode: Normal

Running processes:
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Toshiba\Utilities\KeNotify.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\McAfee\MSK\mskagent.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\SiteAdvisor\6261\SiteAdv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Users\DANIEL~1\AppData\Local\Temp\richtx64.exe
C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe
C:\Users\DANIEL~1\AppData\Local\Temp\wscsvc32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Internet Explorer\IEUser.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [HWSetup] \HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [SiteAdvisor] "C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [richtx64.exe] C:\Users\DANIEL~1\AppData\Local\Temp\richtx64.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo…toUploader5.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: pinger - Unknown owner - C:\Toshiba\IVP\ISM\pinger.exe
O23 - Service: Swupdtmr - Unknown owner - c:\Toshiba\IVP\swupdate\swupdtmr.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

–
End of file - 10738 bytes

oldman960

Post #2December 13, 2009, 7:53 PM UTC

Hi , welcome to the forum.

To make cleaning this machine easier

Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
Please do not run any scans other than those requested
Please follow all instructions in the order posted
All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
Do not attach any logs/reports, etc.. unless specifically requested to do so.
If you have problems with or do not understand the instructions, Please ask before continuing.
Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.

If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure the 'Show All' button is unticked.

Click the Scan button and let the program do its work. GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop

Download OTL to your desktop.

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
Check the boxes beside LOP Check and Purity Check.
Copy and paste the bold text into the window under Custom Scan
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
/md5stop
%systemroot%\*. /mp /s
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Please post back with

GMER log
both OTL logs

Thanks

dwoods912

Post #3December 13, 2009, 10:15 PM UTC

GMER caused bluescreen and system crash when I scanned couldnt catch what it said before it crashed… no offense but it causes a doubt on the legitimacy of these programs …??????????

oldman960

Post #4December 14, 2009, 1:39 AM UTC

Hi Whatever is infecting your computer may be the culprit that caused GMER to crash. Please run OTL by right clicking OTL.exe and choosing "Run as Administrator" These are non invasion tools, they just scan. Thanks

dwoods912

Post #5December 14, 2009, 1:00 PM UTC

Hi OldMan

OTL.txt

OTL logfile created on: 12/14/2009 6:36:56 AM - Run 1
OTL by OldTimer - Version 3.1.17.0 Folder = C:\***
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16945)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.87 Gb Total Physical Memory | 1.09 Gb Available Physical Memory | 58.16% Memory free
3.96 Gb Paging File | 2.95 Gb Available in Paging File | 74.38% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 231.42 Gb Total Space | 84.90 Gb Free Space | 36.69% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name:***
Current User Name: ***
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\***\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
PRC - C:\Program Files\Internet Explorer\ieuser.exe (Microsoft Corporation)
PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple, Inc.)
PRC - C:\Program Files\Windows Mail\WinMail.exe (Microsoft Corporation)
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - c:\Program Files\McAfee\MSC\mcuimgr.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
PRC - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
PRC - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Windows\System32\Ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\Program Files\McAfee\MPS\mpsevh.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MPS\mps.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe ()
PRC - C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
PRC - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Toshiba\SmoothView\SmoothView.exe (TOSHIBA Corporation)
PRC - c:\Program Files\Common Files\McAfee\RedirSvc\RedirSvc.exe (McAfee, Inc.)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe (McAfee, Inc.)
PRC - c:\Toshiba\IVP\swupdate\swupdtmr.exe ()
PRC - C:\Toshiba\IVP\ISM\pinger.exe ()
PRC - C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
PRC - C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
PRC - C:\Program Files\McAfee\MSK\msksrver.exe (McAfee Inc.)
PRC - C:\Program Files\McAfee\MSK\mskagent.exe (McAfee Inc.)
PRC - C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
PRC - C:\Program Files\Toshiba\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Toshiba\Utilities\KeNotify.exe ()
PRC - C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Program Files\SiteAdvisor\6261\SiteAdv.exe (McAfee, Inc.)
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (ATI Technologies Inc.)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.)
PRC - C:\Program Files\Apoint2K\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint2K\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint2K\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
PRC - C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.20533_none_4634c4a0218d65c1\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (gupdate) Google Update Service (gupdate) – C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (gusvc) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (GameConsoleService) – C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (McNASvc) – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple, Inc.)
SRV - (Emproxy) – C:\Program Files\Common Files\McAfee\EmProxy\emproxy.exe (McAfee, Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (McShield) – C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV - (MpfService) – C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (GoogleDesktopManager) – C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
SRV - (TNaviSrv) – C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
SRV - (Ati External Event Utility) – C:\Windows\System32\Ati2evxx.exe (ATI Technologies Inc.)
SRV - (MPS9) – C:\Program Files\McAfee\MPS\mps.exe (McAfee, Inc.)
SRV - (McProxy) – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (TosCoSrv) – C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV - (McRedirector) – c:\Program Files\Common Files\McAfee\RedirSvc\RedirSvc.exe (McAfee, Inc.)
SRV - (TOSHIBA Bluetooth Service) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (McAfee HackerWatch Service) – C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe (McAfee, Inc.)
SRV - (Swupdtmr) – c:\Toshiba\IVP\swupdate\swupdtmr.exe ()
SRV - (pinger) – C:\Toshiba\IVP\ISM\pinger.exe ()
SRV - (McSysmon) – C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (MSK80Service) – C:\Program Files\McAfee\MSK\MskSrver.exe (McAfee Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (CFSvcs) – C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (ehstart) – C:\Windows\ehome\ehstart.dll (Microsoft Corporation)
SRV - (odserv) – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (AgereModemAudio) – C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (UleadBurningHelper) – C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
SRV - (TODDSrv) – C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)

========== Driver Services (SafeList) ==========

DRV - (USBAAPL) – C:\Windows\System32\drivers\usbaapl.sys (Apple, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfesmfk) – C:\Windows\System32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (mfehidk) – C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (tos_sps32) – C:\Windows\system32\DRIVERS\tos_sps32.sys (TOSHIBA Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (UVCFTR) – C:\Windows\System32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.)
DRV - (PxHelp20) – C:\Windows\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (MPFP) – C:\Windows\System32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (athr) – C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (tifm21) – C:\Windows\System32\drivers\tifm21.sys (Texas Instruments)
DRV - (RTL8169) – C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (secdrv) – C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (tdcmdpst) – C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (TVALZ) – C:\Windows\system32\DRIVERS\TVALZ_O.SYS (TOSHIBA Corporation)
DRV - (KR3NPXP) – C:\Windows\system32\drivers\kr3npxp.sys (TOSHIBA CORPORATION)
DRV - (GEARAspiWDM) – C:\Windows\System32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (LPCFilter) – C:\Windows\system32\DRIVERS\LPCFilter.sys (COMPAL ELECTRONIC INC.)
DRV - (KR10I) – C:\Windows\system32\drivers\kr10i.sys (TOSHIBA CORPORATION)
DRV - (KR10N) – C:\Windows\system32\drivers\kr10n.sys (TOSHIBA CORPORATION)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[2009/01/31 18:59:09 | 00,000,000 | —D | M] – C:\Users\***\AppData\Roaming\Mozilla\Firefox\extensions <—–???? (don't think i ever installed Mozilla)
[2009/01/31 18:59:09 | 00,000,000 | —D | M] (No name found) – C:\Users\***\AppData\Roaming\Mozilla\Firefox\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}

O1 HOSTS File: (761 bytes) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\Program Files\McAfee\VirusScan\scriptcl.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll ()
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll File not found
O4 - HKLM..\Run: [00TCrdMain] C:\Program Files\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [HSON] C:\Program Files\Toshiba\TBS\HSON.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [HWSetup] File not found
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [KeNotify] C:\Program Files\Toshiba\Utilities\KeNotify.exe ()
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\mskagent.exe (McAfee Inc.)
O4 - HKLM..\Run: [NDSTray.exe] File not found
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6261\SiteAdv.exe (McAfee, Inc.)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\Toshiba\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe (TOSHIBA)
O4 - HKLM..\Run: [TPwrMain] C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [TOSCDSPD] C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/Facebo…toUploader5.cab (Facebook Photo Uploader 5)
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} http://lads.myspace.com/upload/MySpaceUploader1006.cab (MySpace Uploader Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\siteadvisor {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll ()
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 00,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias [2006/11/02 06:18:47 | 00,000,000 | —D | M]
NetSvcs: Irmon - C:\Windows\System32\irmon.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
OTL cannot create restorepoints on Vista OSs!

========== Files/Folders - Created Within 30 Days ==========

[2009/12/13 17:00:25 | 00,000,000 | —D | C] – C:\Users\***\Desktop\gmer
[2009/12/13 16:39:37 | 00,538,112 | —- | C] (OldTimer Tools) – C:\Users\***\Desktop\OTL.exe
[2009/12/10 03:08:54 | 00,024,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nshhttp.dll
[2009/12/10 03:08:28 | 00,031,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\httpapi.dll
[2009/12/09 12:17:25 | 00,389,120 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2009/12/09 12:17:22 | 00,671,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2009/12/09 12:17:21 | 00,380,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dll
[2009/12/09 12:17:19 | 00,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2009/12/09 12:17:18 | 00,347,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxtmsft.dll
[2009/12/09 12:17:17 | 00,459,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2009/12/09 12:17:16 | 00,230,400 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieaksie.dll
[2009/12/09 12:17:14 | 00,214,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxtrans.dll
[2009/12/09 12:17:13 | 01,830,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2009/12/09 12:17:13 | 00,078,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieencode.dll
[2009/12/09 12:17:12 | 00,072,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\admparse.dll
[2009/12/09 12:17:12 | 00,027,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2009/12/09 12:17:11 | 00,124,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\advpack.dll
[2009/12/09 12:17:10 | 00,180,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2009/12/09 12:17:10 | 00,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2009/12/09 12:17:09 | 00,070,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2009/12/09 12:17:09 | 00,056,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2009/12/09 12:17:09 | 00,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pngfilt.dll
[2009/12/09 12:17:09 | 00,026,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2009/12/09 12:17:04 | 01,383,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2009/12/09 12:17:04 | 00,161,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieakui.dll
[2009/12/09 12:17:04 | 00,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtmler.dll
[2009/12/09 12:15:30 | 00,232,960 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rastls.dll
[2009/12/09 12:15:29 | 00,274,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\raschap.dll
[2009/11/25 03:04:02 | 00,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2009/11/24 13:32:20 | 00,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msxml6r.dll
[2009/11/24 13:32:20 | 00,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msxml3r.dll
[2009/11/24 13:31:58 | 00,713,728 | —- | C] (Microsoft Corporation) – C:\Windows\System32\timedate.cpl
[2009/11/15 04:02:05 | 00,000,000 | —D | C] – C:\Users\***\Documents\notes
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2009/12/14 06:36:50 | 02,883,584 | -HS- | M] () – C:\Users\***\NTUSER.DAT
[2009/12/14 06:30:45 | 00,020,200 | —- | M] () – C:\Windows\System32\Config.MPF
[2009/12/14 06:22:07 | 00,325,760 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2009/12/14 06:22:07 | 00,300,640 | —- | M] () – C:\Windows\System32\perfh009.dat
[2009/12/14 06:22:07 | 00,035,276 | —- | M] () – C:\Windows\System32\perfc009.dat
[2009/12/14 06:20:46 | 00,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2009/12/14 06:20:43 | 00,003,456 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2009/12/14 06:20:43 | 00,003,456 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2009/12/13 18:52:07 | 00,000,904 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2009/12/13 17:05:00 | 00,000,900 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2009/12/13 17:04:56 | 00,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2009/12/13 17:04:23 | 20,112,17920 | -HS- | M] () – C:\hiberfil.sys
[2009/12/13 17:04:19 | 19,563,9512 | —- | M] () – C:\Windows\MEMORY.DMP
[2009/12/13 16:39:42 | 00,538,112 | —- | M] (OldTimer Tools) – C:\Users\***\Desktop\OTL.exe
[2009/12/13 16:39:09 | 00,284,610 | —- | M] () – C:\Users\***\Desktop\gmer.zip
[2009/12/13 14:40:51 | 04,572,678 | -H– | M] () – C:\Users\***\AppData\Local\IconCache.db
[2009/12/12 16:33:05 | 00,145,769 | —- | M] () – C:\Users\***\Desktop\dl2.jpg
[2009/12/11 16:51:54 | 00,002,084 | —- | M] () – C:\Users\Public\Desktop\Google Earth.lnk
[2009/12/10 19:35:18 | 00,148,444 | —- | M] () – C:\Users\***\Desktop\dl.jpg
[2009/12/10 19:34:02 | 00,088,576 | —- | M] () – C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/09 12:26:14 | 00,037,720 | —- | M] () – C:\Users\***\AppData\Roaming\wklnhst.dat
[2009/12/07 19:16:02 | 00,020,114 | —- | M] () – C:\Users\***\Documents\Maidy Lady Cleaning Services.docx
[2009/12/02 18:33:08 | 04,909,056 | —- | M] () – C:\Users\***\Desktop\painting colors.wps
[2009/11/19 13:32:03 | 00,352,237 | —- | M] () – C:\Users\***Desktop\defermentforms.pdf
[2009/11/15 01:20:01 | 00,000,342 | —- | M] () – C:\Windows\tasks\McDefragTask.job
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2009/12/13 16:39:06 | 00,284,610 | —- | C] () – C:\Users\***\Desktop\gmer.zip
[2009/12/12 15:39:54 | 00,145,769 | —- | C] () – C:\Users\***\Desktop\dl2.jpg
[2009/12/11 16:51:54 | 00,002,084 | —- | C] () – C:\Users\Public\Desktop\Google Earth.lnk
[2009/12/11 16:47:12 | 00,000,904 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2009/12/11 16:47:07 | 00,000,900 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2009/12/10 19:35:18 | 00,148,444 | —- | C] () – C:\Users\***\Desktop\dl.jpg
[2009/12/07 19:16:00 | 00,020,114 | —- | C] () – C:\Users\***\Documents\Maidy Lady Cleaning Services.docx
[2009/11/19 13:32:00 | 00,352,237 | —- | C] () – C:\Users\***\Desktop\defermentforms.pdf
[2008/12/25 12:37:22 | 00,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2008/11/19 16:36:53 | 00,021,840 | —- | C] () – C:\Windows\System32\SIntfNT.dll
[2008/11/19 16:36:53 | 00,017,212 | —- | C] () – C:\Windows\System32\SIntf32.dll
[2008/11/19 16:36:53 | 00,012,067 | —- | C] () – C:\Windows\System32\SIntf16.dll
[2008/07/23 11:50:52 | 03,596,288 | —- | C] () – C:\Windows\System32\qt-dx331.dll
[2008/07/23 11:47:34 | 00,000,416 | —- | C] () – C:\Windows\System32\dtu100.dll.manifest
[2008/07/23 11:47:34 | 00,000,416 | —- | C] () – C:\Windows\System32\dpl100.dll.manifest
[2008/07/23 11:46:38 | 00,012,288 | —- | C] () – C:\Windows\System32\DivXWMPExtType.dll
[2008/06/13 11:34:39 | 00,010,240 | —- | C] () – C:\Windows\System32\vidx16.dll
[2008/01/09 23:43:44 | 00,765,952 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2008/01/09 23:43:43 | 00,180,224 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2007/10/02 03:45:19 | 00,037,720 | —- | C] () – C:\Users\***\AppData\Roaming\wklnhst.dat
[2007/09/26 15:33:33 | 00,088,576 | —- | C] () – C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/05/16 20:46:23 | 00,524,288 | -HS- | C] () – C:\ProgramData\ntuser.dat{0a1e0bf4-0416-11dc-9bb7-0016d4f84854}.TMContainer00000000000000000002.regtrans-ms
[2007/05/16 20:46:23 | 00,524,288 | -HS- | C] () – C:\ProgramData\ntuser.dat{0a1e0bf4-0416-11dc-9bb7-0016d4f84854}.TMContainer00000000000000000001.regtrans-ms
[2007/05/16 20:46:23 | 00,065,536 | -HS- | C] () – C:\ProgramData\ntuser.dat{0a1e0bf4-0416-11dc-9bb7-0016d4f84854}.TM.blf
[2007/05/16 20:46:22 | 00,524,288 | -HS- | C] () – C:\ProgramData\ntuser.dat{0a1e0be4-0416-11dc-9bb7-0016d4f84854}.TMContainer00000000000000000002.regtrans-ms
[2007/05/16 20:46:22 | 00,524,288 | -HS- | C] () – C:\ProgramData\ntuser.dat{0a1e0be4-0416-11dc-9bb7-0016d4f84854}.TMContainer00000000000000000001.regtrans-ms
[2007/05/16 20:46:22 | 00,065,536 | -HS- | C] () – C:\ProgramData\ntuser.dat{0a1e0be4-0416-11dc-9bb7-0016d4f84854}.TM.blf
[2007/05/16 20:46:21 | 00,262,144 | —- | C] () – C:\ProgramData\ntuser.dat
[2007/05/16 20:46:21 | 00,005,120 | -H– | C] () – C:\ProgramData\ntuser.dat.LOG1
[2007/05/16 20:46:21 | 00,000,000 | -H– | C] () – C:\ProgramData\ntuser.dat.LOG2
[2007/05/16 20:40:56 | 00,204,800 | —- | C] () – C:\Windows\System32\IVIresizeW7.dll
[2007/05/16 20:40:55 | 00,200,704 | —- | C] () – C:\Windows\System32\IVIresizeA6.dll
[2007/05/16 20:40:55 | 00,192,512 | —- | C] () – C:\Windows\System32\IVIresizeP6.dll
[2007/05/16 20:40:55 | 00,192,512 | —- | C] () – C:\Windows\System32\IVIresizeM6.dll
[2007/05/16 20:40:55 | 00,188,416 | —- | C] () – C:\Windows\System32\IVIresizePX.dll
[2007/05/16 20:40:55 | 00,020,480 | —- | C] () – C:\Windows\System32\IVIresize.dll
[2007/05/16 19:46:42 | 00,000,000 | —- | C] () – C:\Windows\NDSTray.INI
[2007/05/16 19:30:13 | 00,036,864 | —- | C] () – C:\Windows\System32\HWS_Ctrl.dll
[2007/05/16 19:15:16 | 00,128,113 | —- | C] () – C:\Windows\System32\csellang.ini
[2007/05/16 19:15:16 | 00,045,056 | —- | C] () – C:\Windows\System32\csellang.dll
[2007/05/16 19:15:16 | 00,010,150 | —- | C] () – C:\Windows\System32\tosmreg.ini
[2007/05/16 19:15:16 | 00,007,671 | —- | C] () – C:\Windows\System32\cseltbl.ini
[2007/05/16 19:13:14 | 00,000,291 | —- | C] () – C:\Windows\RtDefLvl.ini
[2007/04/24 23:57:36 | 00,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/12/05 15:05:06 | 00,114,688 | —- | C] () – C:\Windows\System32\TosBtAcc.dll
[2006/11/02 07:35:32 | 00,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 02:40:29 | 00,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2005/11/23 16:55:42 | 00,024,576 | —- | C] () – C:\Windows\System32\SPCtl.dll
[2005/07/22 23:30:20 | 00,065,536 | —- | C] () – C:\Windows\System32\TosCommAPI.dll

========== LOP Check ==========

[2007/10/01 00:48:44 | 00,000,000 | —D | M] – C:\Users\***\AppData\Roaming\acccore
[2009/12/10 18:47:59 | 00,000,000 | —D | M] – C:\Users\***\AppData\Roaming\LimeWire
[2007/10/02 03:45:21 | 00,000,000 | —D | M] – C:\Users\***\AppData\Roaming\Template
[2007/10/24 12:56:29 | 00,000,000 | —D | M] – C:\Users\***\AppData\Roaming\TOSHIBA
[2007/12/18 08:48:09 | 00,000,000 | —D | M] – C:\Users\***\AppData\Roaming\Ulead Systems
[2009/12/07 19:17:41 | 00,000,000 | —D | M] – C:\Users\***\AppData\Roaming\uTorrent
[2007/09/27 14:17:51 | 00,000,000 | —D | M] – C:\Users\***\AppData\Roaming\WildTangent
[2009/11/15 01:20:01 | 00,000,342 | —- | M] () – C:\Windows\Tasks\McDefragTask.job
[2009/11/01 00:00:15 | 00,000,334 | —- | M] () – C:\Windows\Tasks\McQcTask.job
[2009/12/13 14:41:09 | 00,032,546 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2008/01/19 02:42:25 | 00,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2006/11/02 04:49:52 | 00,053,864 | —- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 – C:\Windows\System32\drivers\AGP440.sys
[2006/11/02 04:49:52 | 00,053,864 | —- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/01/19 02:41:30 | 00,021,560 | —- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 – C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/02 04:49:36 | 00,019,048 | —- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008/02/15 03:10:53 | 00,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\System32\drivers\atapi.sys
[2008/02/15 03:10:53 | 00,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008/02/15 03:10:53 | 00,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008/02/15 03:10:51 | 00,021,560 | —- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 04:46:03 | 00,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\System32\cngaudit.dll
[2006/11/02 04:46:03 | 00,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: IASTORV.SYS >
[2008/01/19 02:42:51 | 00,235,064 | —- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 – C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006/11/02 04:51:25 | 00,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\drivers\iaStorV.sys
[2006/11/02 04:51:25 | 00,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: KR10N.SYS >
[2005/09/27 18:57:00 | 00,207,104 | —- | M] (TOSHIBA CORPORATION) MD5=A1963360E74931222A67356C8AD48378 – C:\Windows\System32\drivers\KR10N.sys
[2005/09/27 18:57:00 | 00,207,104 | —- | M] (TOSHIBA CORPORATION) MD5=A1963360E74931222A67356C8AD48378 – C:\Windows\System32\DriverStore\FileRepository\kr10n.inf_f8c77270\KR10N.sys

< MD5 for: NETLOGON.DLL >
[2006/11/02 04:46:11 | 00,559,616 | —- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B – C:\Windows\System32\netlogon.dll
[2006/11/02 04:46:11 | 00,559,616 | —- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2008/01/19 02:35:36 | 00,592,384 | —- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F – C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2006/11/02 04:50:13 | 00,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\drivers\nvstor.sys
[2006/11/02 04:50:13 | 00,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008/01/19 02:42:09 | 00,045,112 | —- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 – C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: SCECLI.DLL >
[2008/01/19 02:36:19 | 00,177,152 | —- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 – C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006/11/02 04:46:12 | 00,176,640 | —- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 – C:\Windows\System32\scecli.dll
[2006/11/02 04:46:12 | 00,176,640 | —- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

< %systemroot%\*. /mp /s >
< End of report >

EXTRAS.txt

OTL Extras logfile created on: 12/14/2009 6:36:56 AM - Run 1
OTL by OldTimer - Version 3.1.17.0 Folder = C:\Users\*****\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16945)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.87 Gb Total Physical Memory | 1.09 Gb Available Physical Memory | 58.16% Memory free
3.96 Gb Paging File | 2.95 Gb Available in Paging File | 74.38% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 231.42 Gb Total Space | 84.90 Gb Free Space | 36.69% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: *****
Current User Name: *****
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.chm [@ = chm.file] – "%SystemRoot%\hh.exe" %1
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
chm.file [open] – "%SystemRoot%\hh.exe" %1
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\TOSHIBA\ivp\NetInt\Netint.exe" = C:\TOSHIBA\ivp\NetInt\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrades Engine – (TOSHIBA Corporation)
"C:\TOSHIBA\Ivp\ISM\pinger.exe" = C:\TOSHIBA\Ivp\ISM\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger – ()

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1AEC3FA4-CB04-4260-9B64-CB17B8817BE3}" = lport=137 | protocol=17 | dir=in | app=system |
"{1B293926-D0DF-4CBA-B122-828CCB7BA9E6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{2447CE34-A9CD-4317-A50A-A23B78858812}" = lport=139 | protocol=6 | dir=in | app=system |
"{27F7EA3E-C647-4042-A03D-CC607E7C4D31}" = rport=139 | protocol=6 | dir=out | app=system |
"{4B598F88-A0F8-42DD-87BB-608520B600D5}" = rport=138 | protocol=17 | dir=out | app=system |
"{9E4854CA-6260-424E-8508-98423501FEF9}" = lport=445 | protocol=6 | dir=in | app=system |
"{A0E554E8-50C6-4539-A949-50A545E07CC2}" = rport=137 | protocol=17 | dir=out | app=system |
"{B71E43FB-D7F6-4021-BB72-7FE82C65A278}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{E0D70346-5C14-4A01-93E2-21AC84EA4F72}" = rport=445 | protocol=6 | dir=out | app=system |
"{EF1D77E3-3CDF-451E-B3C1-04223DE779AD}" = lport=138 | protocol=17 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{18D7AF6A-359E-4D79-99AD-1599DB5966DC}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{1AEA795D-8A4F-4C2C-A77C-D6D67573C602}" = protocol=17 | dir=in | app=c:\program files\aim\aim.exe |
"{2A916E82-28F6-46F3-983C-CF43E2A47F69}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{2FD54F10-3F17-4F1E-866A-FA8B2FD5EE86}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{34DAE27D-5BEE-4897-ACC9-0826FBEE7547}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{46C9CC31-C938-4E74-9388-B3ECF158FFA3}" = protocol=6 | dir=in | app=c:\program files\aim\aim.exe |
"{4E16BF98-EB6F-46D1-940E-A0CCF332128F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{52753B68-597B-4637-A2DD-42E63E241A5B}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{7E450649-C4BE-436D-90BA-6C614FA2787E}" = protocol=17 | dir=in | app=c:\program files\dell video chat\dellvideochat.exe |
"{7F3441C5-2BD3-4689-AC0C-F6C1961D4F39}" = protocol=17 | dir=in | app=c:\program files\yahoo!\yahoo! music jukebox\yahoomusicengine.exe |
"{83B8F80A-29DC-4E20-B45D-E9BA1765F650}" = protocol=6 | dir=in | app=c:\program files\dell video chat\dellvideochat.exe |
"{8A39B429-F06C-40EC-BE30-C2063677A6E9}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{978A747E-6A58-4882-89B7-501C3B2CEB72}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{9ADF2303-FB65-4BA7-89C0-E41BAA6AC35D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{9B1420B6-BE91-448D-BC98-4C1B8B2F9009}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{9B554924-1BC8-4A66-8F06-4FBC073DD36C}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{B49D1C39-BA5D-46A3-ABCA-591A818072AB}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{B4E25103-7609-4C32-B6F2-180AD2D8F9C2}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{CBDC3CC0-9BF1-4F4D-9D9F-A9713FA85875}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{CE513C88-9A21-418B-AB73-04BFB2459BC3}" = protocol=6 | dir=in | app=c:\program files\yahoo!\yahoo! music jukebox\yahoomusicengine.exe |
"{DCFA7CB8-2EEF-4A7F-A6F0-A315339DA613}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{003B5184-F3DF-AF76-CB17-D35B7BB46B81}" = CCC Help Japanese
"{008D69EB-70FF-46AB-9C75-924620DF191A}" = TOSHIBA Speech System SR Engine(U.S.) Version1.0
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{0E9C4531-58C4-4349-AD2F-A4D999E451EC}" = TOSHIBA Music
"{0F6932CF-E642-5A7A-8194-3F7443188287}" = CCC Help Turkish
"{103A43D9-9ED8-E78D-7BF1-E536DFE6FC9F}" = Catalyst Control Center Localization Greek
"{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver
"{12887AF2-AE16-34CC-E85C-637DF6911C8C}" = Catalyst Control Center Localization Turkish
"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
"{13614186-B0A0-AA21-F75A-2097F9167DB8}" = CCC Help Portuguese
"{177B615E-47B1-C1C4-6F3B-7D6FEB8D4564}" = CCC Help Thai
"{18388EF8-E0A3-442B-8BFE-E2F1B3D05C91}" = iTunes
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26210745-925C-8AE4-F3B9-5FA737A1F6F2}" = CCC Help Russian
"{2768CDA5-57DA-59D4-884F-A0F8A5B36D3E}" = CCC Help Finnish
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Driver Installation Program
"{29DC966A-DA3E-3ED4-68E7-6D3D9A055B42}" = Catalyst Control Center Localization Korean
"{2E7A9DDC-E062-0074-08AB-DE7D1B431F75}" = Catalyst Control Center Localization Chinese Traditional
"{2FAE3800-CC47-C556-C57F-A91851BF7854}" = CCC Help French
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java™ SE Runtime Environment 6
"{33824DAC-3F98-0BB6-56D5-7DE1A3CCC068}" = Catalyst Control Center Localization German
"{3621A2DF-0870-FE7E-674F-1DBCB18C5D22}" = ccc-utility
"{37C866E4-AA67-4725-9E95-A39968DD7960}" = Camera Assistant Software for Toshiba
"{3F11CE8A-388B-0D3A-DF6F-061F23A13D26}" = CCC Help Korean
"{3FBF6F99-8EC6-41B4-8527-0A32241B5496}" = TOSHIBA Speech System TTS Engine(U.S.) Version1.0
"{4160DC5B-4C56-D0C3-C5FD-F5BDAD3C882B}" = ATI Catalyst Install Manager
"{41DD15BE-811D-7DEF-19A9-30AF18F75EFF}" = Catalyst Control Center Localization Thai
"{425A2BC2-AA64-4107-9C29-484245BBEA05}" = TOSHIBA Software Upgrades
"{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password
"{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"{52F368DE-06BD-E116-9233-D1DE207BDFE6}" = CCC Help Dutch
"{53BABC75-1DC1-479B-224B-1EB9E18A799B}" = CCC Help German
"{56797214-1A4C-052E-1ECE-B00308BF3362}" = CCC Help Chinese Standard
"{572D71E9-5102-74B3-5D22-DEDF911F7FE5}" = CCC Help Italian
"{5BA0C9F0-3B01-91A3-6922-4DCF943D9CBE}" = CCC Help English
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.8
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{6080CE3C-2CB3-2FA3-1CE2-3350B06664BC}" = CCC Help Swedish
"{611E35B8-7F46-DDBB-CC4F-FAAED6C054FF}" = Catalyst Control Center Localization Spanish
"{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{678F1F2D-F214-08D4-67FB-AC04316C4940}" = ccc-core-static
"{6A0B868C-89BE-ACF1-8C0A-CC88878A9E46}" = Catalyst Control Center Localization Russian
"{6C4734CF-A10C-DFF4-5565-457F33849862}" = Catalyst Control Center Localization Swedish
"{6C5F3BDC-0A1B-4436-A696-5939629D5C31}" = TOSHIBA DVD PLAYER
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{6DECCD60-782D-7B14-22DE-FB8D6EA46433}" = CCC Help Polish
"{715044AC-B95E-4CD0-9B0C-CEDDB422F93B}" = CCC Help Czech
"{724A8BEC-B350-1C76-C580-959AEA487108}" = Catalyst Control Center Localization Japanese
"{78C6A78A-8B03-48C8-A47C-78BA1FCA2307}" = TOSHIBA ConfigFree
"{7994AA46-4BA6-4349-1606-1DF4148CE05B}" = CCC Help Hungarian
"{7AFBAC39-F6A8-9F8D-6A6D-F134F7E34B6E}" = Catalyst Control Center Localization Danish
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{845D19A7-0BBF-12DF-87CF-F5D468930EA6}" = Catalyst Control Center Localization Czech
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
"{8DCE550C-CA43-4E82-92DF-FFC4A48F5BE1}" = Napster Burn Engine
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{9074AFC0-CFDA-11DE-B484-005056806466}" = Google Earth
"{90BF970B-3335-CFD5-711C-9FE0310A97C0}" = CCC Help Greek
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{926593ED-3962-4630-7CE3-34FF1B4ACCF3}" = Catalyst Control Center Localization Finnish
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9EB0D4D4-87A5-52F5-C59C-159F81BED0E6}" = Catalyst Control Center Graphics Previews Vista
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A91383E9-0311-DB40-6AF6-3F9E80F83E84}" = Catalyst Control Center Localization Portuguese
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{B1211E68-4DA2-7942-BE75-14272A8C1EA9}" = Catalyst Control Center Localization Dutch
"{B1F8FA80-EFA5-EC12-AD36-F5266EF90B61}" = CCC Help Danish
"{B4369E44-8703-E769-A711-40EE5000AC2C}" = Catalyst Control Center Core Implementation
"{B5C209B1-8DDB-4642-A573-375B951514CB}" = Apple Mobile Device Support
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}" = Apple Software Update
"{B7DE7B5E-4A2B-B709-E133-EC74C81E654A}" = Catalyst Control Center Graphics Full New
"{B87A3B9F-7632-E053-2148-8EDD1A787B78}" = Catalyst Control Center Localization Chinese Standard
"{BBBCAE4B-B416-4182-A6F2-438180894A81}" = Napster
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{C53D16CC-E56F-47B8-906E-70AAF8EABB4F}" = Toshiba Registration
"{C7EA6173-A2B8-D45E-A0EE-74F8D2C58D30}" = Catalyst Control Center Localization Hungarian
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D1C3920F-1DC3-A2FA-BF5E-7497B5EF072E}" = Catalyst Control Center Localization Norwegian
"{D95AAA04-9BEF-54B3-CD70-348AC1155DAB}" = Catalyst Control Center Graphics Full Existing
"{D9C7C58C-AC51-EDBF-CF22-E4E1B93ED50D}" = Skins
"{DB780B85-B4B5-4864-A49C-9B706B169C93}" = TIPCI
"{DDC4619D-1DC8-C2A7-4968-45586F237131}" = CCC Help Norwegian
"{E015B7D9-01AD-FE29-052A-489F4F29ED7F}" = Catalyst Control Center Graphics Light
"{E0D51394-1D45-460A-B62D-383BC4F8B335}" = QuickTime
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E7511B20-2857-3F50-1B84-F0F32C519FE1}" = CCC Help Chinese Traditional
"{EB5BE9DE-6025-6227-0C25-AE5C852EC479}" = Catalyst Control Center Localization Polish
"{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities
"{EC28331A-FF2B-6D66-D8A0-32C706AEA120}" = CCC Help Spanish
"{EC3B8CA2-49B8-4D38-BE9C-ABD0F6029168}" = Yahoo! Music Jukebox
"{EE033C1F-443E-41EC-A0E2-559B539A4E4D}" = TOSHIBA Speech System Applications
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}" = DVD MovieFactory for TOSHIBA
"{F2B27034-6059-0549-F01A-4BD9865521B1}" = Catalyst Control Center Localization French
"{FBE6B550-A93E-AA46-1DBB-421EC319E2DA}" = Catalyst Control Center Localization Italian
"{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player
"Age of Mythology 1.0" = Age of Mythology
"AIM_7" = AIM 7
"Ask Toolbar_is1" = Ask Toolbar
"ATI Uninstaller" = ATI Uninstaller
"Desktop Dialer" = Desktop Dialer
"Diablo II" = Diablo II
"Google Desktop" = Google Desktop
"HijackThis" = HijackThis 2.0.2
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password
"InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility
"InstallShield_{DB780B85-B4B5-4864-A49C-9B706B169C93}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"Internet Offers from Toshiba" = Internet Offers
"LimeWire" = LimeWire 4.18.8
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSC" = McAfee SecurityCenter
"oggcodecs" = oggcodecs 0.71.0946
"Picasa2" = Picasa 2
"SkypeMate" = SkypeMate
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"Tiberian Sun" = Command & Conquer Tiberian Sun
"TOSHIBA Software Modem" = TOSHIBA Software Modem
"uTorrent" = µTorrent
"ViewpointMediaPlayer" = Viewpoint Media Player
"WildTangent toshiba Master Uninstall" = TOSHIBA Games
"Winamp" = Winamp (remove only)
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"WinRAR archiver" = WinRAR archiver
"Xvid_is1" = Xvid 1.1.3 final uninstall

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/9/2009 12:19:13 AM | Computer Name = ***** | Source = Application Error | ID = 1000
Description = Faulting application WinMail.exe, version 6.0.6000.16480, time stamp
0x4638f473, faulting module RptSpam.dll_unloaded, version 0.0.0.0, time stamp 0x45aea315,
exception code 0xc0000005, fault offset 0x0429f3b4, process id 0xf88, application
start time 0x01ca7886b2915460.

Error - 12/9/2009 2:34:27 AM | Computer Name =***** | Source = EventSystem | ID = 4621
Description =

Error - 12/11/2009 10:52:06 PM | Computer Name = ***** | Source = Google Update | ID = 20
Description =

Error - 12/11/2009 11:52:06 PM | Computer Name = ***** | Source = Google Update | ID = 20
Description =

Error - 12/12/2009 12:52:06 AM | Computer Name = ***** | Source = Google Update | ID = 20
Description =

Error - 12/12/2009 1:52:05 AM | Computer Name = ***** | Source = Google Update | ID = 20
Description =

Error - 12/12/2009 2:52:06 AM | Computer Name = ***** | Source = Google Update | ID = 20
Description =

Error - 12/12/2009 3:52:05 AM | Computer Name = ***** | Source = Google Update | ID = 20
Description =

Error - 12/12/2009 6:36:28 PM | Computer Name = ***** | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 7.0.6000.16945 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 1f44 Start Time: 01ca7b58ee6dc430 Termination Time: 640

Error - 12/13/2009 7:52:05 PM | Computer Name = ***** | Source = Google Update | ID = 20
Description =

[ System Events ]
Error - 12/12/2009 2:27:00 PM | Computer Name = ***** | Source = Service Control Manager | ID = 7011
Description =

Error - 12/13/2009 4:34:39 AM | Computer Name = ***** | Source = ACPI | ID = 327686
Description = IRQARB: ACPI BIOS does not contain an IRQ for the device in PCI slot
6, function 0. Please contact your system vendor for technical assistance.

Error - 12/13/2009 4:34:39 AM | Computer Name = ***** | Source = ACPI | ID = 327686
Description = IRQARB: ACPI BIOS does not contain an IRQ for the device in PCI slot
7, function 0. Please contact your system vendor for technical assistance.

Error - 12/13/2009 4:34:39 AM | Computer Name = ***** | Source = ACPI | ID = 327686
Description = IRQARB: ACPI BIOS does not contain an IRQ for the device in PCI slot
5, function 0. Please contact your system vendor for technical assistance.

Error - 12/13/2009 4:36:39 AM | Computer Name = ***** | Source = Service Control Manager | ID = 7000
Description =

Error - 12/13/2009 5:31:03 PM | Computer Name = ***** | Source = Microsoft-Windows-Kernel-WHEA | ID = 2
Description =

Error - 12/13/2009 5:32:48 PM | Computer Name = ***** | Source = Service Control Manager | ID = 7000
Description =

Error - 12/13/2009 6:04:39 PM | Computer Name = ***** | Source = EventLog | ID = 6008
Description = The previous system shutdown at 5:03:02 PM on 12/13/2009 was unexpected.

Error - 12/13/2009 6:06:16 PM | Computer Name = ***** | Source = Service Control Manager | ID = 7000
Description =

Error - 12/14/2009 7:30:11 AM | Computer Name = ***** | Source = Dhcp | ID = 1000
Description = Your computer has lost the lease to its IP address *****
on the Network Card with network address *****.

< End of report >

I know it's unrelated, but what's with all the google update errors?
I wouldn't mind getting rid of some unnecessary, unwanted but not quite so malicious apps…like the ask toolbar and sun java console if i don't really need it.

Thanks for the help. I really appreciate it.

oldman960

Post #6December 14, 2009, 8:14 PM UTC last edited December 14, 2009, 8:15 PM UTC

Hi dwoods912,

The java console comes with Sun Java and is installed when java is installed.

The Ask Toolbar can be uninstalled.

Click on the Start button > Control Panel

Depending on your setings, either

click on the Uninstall a program option under the Programs category.
If you are using the Classic View of the Control Panel, then you would double-click on the Programs and Features icon instead.

Uninstall the following program

Ask Toolbar

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Right click SystemLook.exe and select Run as Administrator to run it.
Copy the content of the following codebox into the main textfield

Do not copy the word CODE , please note the script starts with the :

:reg
HKEY_CURRENT_USER\Software\Mozilla 
HKEY_LOCAL_MACHINE\Software\Mozilla

Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Next, Right click on OTL.exe and chose Run as Administrator to run it

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Reg
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"richtx64.exe"=-

:Files
C:\Users\DANIEL~1\AppData\Local\Temp\richtx64.exe
C:\Users\DANIEL~1\AppData\Local\Temp\wscsvc32.exe 

:Commands
[emptytemp]
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post back with

SystemLook log
OTL fix log

Fake alert still there?

Besides the google update errors are you experiencing any redirects?

Thanks

dwoods912

Post #7December 14, 2009, 11:16 PM UTC

I ran both scans. I probably should have said earlier that I already clicked "Fix" on HijackThis on the richtx64. I havent been getting any more fake security center alerts SystemLook v1.0 by jpshortstuff (29.08.09) Log created at 17:31 on 14/12/2009 by ***** (Administrator - Elevation successful) ========== reg ========== [HKEY_CURRENT_USER\Software\Mozilla] "affid"="216" "itime"=90 f0 33 24 f8 7b ca 01 (REG_BINARY) "subid"="new" "ver"="1.0" [HKEY_CURRENT_USER\Software\Mozilla\Firefox] [HKEY_LOCAL_MACHINE\Software\Mozilla] (No values found) [HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox] -=End Of File=- OLT log All processes killed ========== REGISTRY ========== Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\richtx64.exe not found. ========== FILES ========== File\Folder C:\Users\***\AppData\Local\Temp\richtx64.exe not found. C:\Users\*****\AppData\Local\Temp\wscsvc32.exe moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: ******* ->Temp folder emptied: 350735446 bytes ->Temporary Internet Files folder emptied: 117938895 bytes ->Java cache emptied: 3532837 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes Windows Temp folder emptied: 422900 bytes RecycleBin emptied: 211 bytes Total Files Cleaned = 450.77 mb OTL by OldTimer - Version 3.1.17.0 log created on 12142009_173659 Files\Folders moved on Reboot… File\Folder C:\Windows\temp\mcafee_AKGU0ixQaxD4pdx not found! File\Folder C:\Windows\temp\mcafee_ZU0lgf3o5fhUiV7 not found! File\Folder C:\Windows\temp\mcmsc_AAxnfYiP58aI5e8 not found! File\Folder C:\Windows\temp\mcmsc_AEfUDEfLM9mPsBb not found! File\Folder C:\Windows\temp\mcmsc_DNUjWVAdM0RmlYy not found! File\Folder C:\Windows\temp\mcmsc_R3n2mjiTXq122NG not found! C:\Windows\temp\sqlite_1E2PkTbmhoN3R7V moved successfully. File\Folder C:\Windows\temp\sqlite_6litoevv2y4rL42 not found! File\Folder C:\Windows\temp\sqlite_td5pTXEZNYvSdtg not found! C:\Windows\temp\sqlite_Vmxx0CWRgBC3waH moved successfully. Registry entries deleted on Reboot…

oldman960

Post #8December 15, 2009, 12:48 AM UTC

Hi dwoods912,

I was going to ask about that registry entry, so that would explain why it wasn't in the OTL log.

Everything indicates a possible rootkit. Please try running GMER again but this time rename it to MERG.exe Then run it by right clicking it and selecting "Run as Adminstrator".

Thanks

dwoods912

Post #9December 15, 2009, 3:19 AM UTC

No bluescreen this time!!

GMER 1.0.15.15279 - http://www.gmer.net
Rootkit scan 2009-12-14 22:08:39
Windows 6.0.6000
Running: merg.exe; Driver: C:\Users\***\AppData\Local\Temp\pgrdapoc.sys

—- System - GMER 1.0.15 —-

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0x9AC8974B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0x9AC89775]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0x9AC8979D]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0x9AC8975F]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0x9AC89737]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0x9AC897B3]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0x9AC89789]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwYieldExecution 81CB5AC6 5 Bytes JMP 9AC8978D \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtCreateFile 81D8EC4E 5 Bytes JMP 9AC8974F \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtMapViewOfSection 81DD01E6 7 Bytes JMP 9AC897A1 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwUnmapViewOfSection 81DE0BD8 5 Bytes JMP 9AC897B7 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwProtectVirtualMemory 81DE875B 7 Bytes JMP 9AC89763 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwCreateProcess 81E12452 5 Bytes JMP 9AC89779 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwTerminateProcess 81E1B0F3 5 Bytes JMP 9AC8973B \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
.text C:\Windows\system32\DRIVERS\tos_sps32.sys section is writeable [0x87406000, 0x4036D, 0xE8000020]
.dsrt C:\Windows\system32\DRIVERS\tos_sps32.sys unknown last section [0x8744F000, 0x510, 0x40000040]

—- User code sections - GMER 1.0.15 —-

.text C:\Windows\system32\services.exe[632] kernel32.dll!VirtualProtect 770C18BF 5 Bytes JMP 009D0F72
.text C:\Windows\system32\services.exe[632] kernel32.dll!GetStartupInfoW 770C191A 5 Bytes JMP 009D0F21
.text C:\Windows\system32\services.exe[632] kernel32.dll!GetStartupInfoA 770C19B8 5 Bytes JMP 009D0F32
.text C:\Windows\system32\services.exe[632] kernel32.dll!CreateProcessW 770C1D27 5 Bytes JMP 009D0EFC
.text C:\Windows\system32\services.exe[632] kernel32.dll!CreateProcessA 770C1D5C 5 Bytes JMP 009D0093
.text C:\Windows\system32\services.exe[632] kernel32.dll!CreateNamedPipeA 770C2484 5 Bytes JMP 009D001B
.text C:\Windows\system32\services.exe[632] kernel32.dll!WinExec 770C32DF 5 Bytes JMP 009D0082
.text C:\Windows\system32\services.exe[632] kernel32.dll!CreateNamedPipeW 770CEDFE 5 Bytes JMP 009D0FC0
.text C:\Windows\system32\services.exe[632] kernel32.dll!CreatePipe 770DB0AF 5 Bytes JMP 009D0067
.text C:\Windows\system32\services.exe[632] kernel32.dll!VirtualProtectEx 770E60AB 5 Bytes JMP 009D0F61
.text C:\Windows\system32\services.exe[632] kernel32.dll!LoadLibraryExW 770E95A7 5 Bytes JMP 009D004A
.text C:\Windows\system32\services.exe[632] kernel32.dll!LoadLibraryW 770E971F 5 Bytes JMP 009D0F9E
.text C:\Windows\system32\services.exe[632] kernel32.dll!LoadLibraryExA 770E9A6E 5 Bytes JMP 009D0F8D
.text C:\Windows\system32\services.exe[632] kernel32.dll!LoadLibraryA 770E9A96 5 Bytes JMP 009D0FAF
.text C:\Windows\system32\services.exe[632] kernel32.dll!GetProcAddress 77104110 5 Bytes JMP 009D0EEB
.text C:\Windows\system32\services.exe[632] kernel32.dll!CreateFileW 7710866C 5 Bytes JMP 009D0FE5
.text C:\Windows\system32\services.exe[632] kernel32.dll!CreateFileA 77108CA4 5 Bytes JMP 009D0000
.text C:\Windows\system32\services.exe[632] ADVAPI32.dll!RegCreateKeyW 76EF8229 5 Bytes JMP 00830FCD
.text C:\Windows\system32\services.exe[632] ADVAPI32.dll!RegCreateKeyExA 76F03941 5 Bytes JMP 00830069
.text C:\Windows\system32\services.exe[632] ADVAPI32.dll!RegCreateKeyA 76F03B9F 5 Bytes JMP 00830FDE
.text C:\Windows\system32\services.exe[632] ADVAPI32.dll!RegCreateKeyExW 76F104A2 5 Bytes JMP 0083007A
.text C:\Windows\system32\services.exe[632] ADVAPI32.dll!RegOpenKeyExA 76F10DDF 5 Bytes JMP 00830036
.text C:\Windows\system32\services.exe[632] ADVAPI32.dll!RegOpenKeyW 76F17B8D 5 Bytes JMP 0083001B
.text C:\Windows\system32\services.exe[632] ADVAPI32.dll!RegOpenKeyA 76F1EAEA 5 Bytes JMP 00830000
.text C:\Windows\system32\services.exe[632] ADVAPI32.dll!RegOpenKeyExW 76F25ECD 5 Bytes JMP 00830FEF
.text C:\Windows\system32\services.exe[632] msvcrt.dll!_open 7672A890 5 Bytes JMP 00820000
.text C:\Windows\system32\services.exe[632] msvcrt.dll!_wsystem 7675AA4F 5 Bytes JMP 00820FA6
.text C:\Windows\system32\services.exe[632] msvcrt.dll!system 7675AB6B 5 Bytes JMP 00820FB7
.text C:\Windows\system32\services.exe[632] msvcrt.dll!_creat 7675E711 5 Bytes JMP 0082001D
.text C:\Windows\system32\services.exe[632] msvcrt.dll!_wcreat 7675F9C6 5 Bytes JMP 00820FC8
.text C:\Windows\system32\services.exe[632] msvcrt.dll!_wopen 7675FBA1 5 Bytes JMP 00820FE3
.text C:\Windows\system32\services.exe[632] WS2_32.dll!socket 766D4358 5 Bytes JMP 00170000
.text C:\Windows\system32\lsass.exe[648] kernel32.dll!VirtualProtect 770C18BF 5 Bytes JMP 00510F92
.text C:\Windows\system32\lsass.exe[648] kernel32.dll!GetStartupInfoW 770C191A 5 Bytes JMP 005100AC
.text C:\Windows\system32\lsass.exe[648] kernel32.dll!GetStartupInfoA 770C19B8 5 Bytes JMP 00510F66
.text C:\Windows\system32\lsass.exe[648] kernel32.dll!CreateProcessW 770C1D27 5 Bytes JMP 00510F3A
.text C:\Windows\system32\lsass.exe[648] kernel32.dll!CreateProcessA 770C1D5C 5 Bytes JMP 005100D1
.text C:\Windows\system32\lsass.exe[648] kernel32.dll!CreateNamedPipeA 770C2484 5 Bytes JMP 0051001B
.text C:\Windows\system32\lsass.exe[648] kernel32.dll!WinExec 770C32DF 5 Bytes JMP 00510F55
.text C:\Windows\system32\lsass.exe[648] kernel32.dll!CreateNamedPipeW 770CEDFE 5 Bytes JMP 0051002C
.text C:\Windows\system32\lsass.exe[648] kernel32.dll!CreatePipe 770DB0AF 5 Bytes JMP 00510F77
.text C:\Windows\system32\lsass.exe[648] kernel32.dll!VirtualProtectEx 770E60AB 5 Bytes JMP 0051007D
.text C:\Windows\system32\lsass.exe[648] kernel32.dll!LoadLibraryExW 770E95A7 5 Bytes JMP 00510FAF
.text C:\Windows\system32\lsass.exe[648] kernel32.dll!LoadLibraryW 770E971F 5 Bytes JMP 00510062
.text C:\Windows\system32\lsass.exe[648] kernel32.dll!LoadLibraryExA 770E9A6E 5 Bytes JMP 00510FC0
.text C:\Windows\system32\lsass.exe[648] kernel32.dll!LoadLibraryA 770E9A96 5 Bytes JMP 00510047
.text C:\Windows\system32\lsass.exe[648] kernel32.dll!GetProcAddress 77104110 5 Bytes JMP 005100F6
.text C:\Windows\system32\lsass.exe[648] kernel32.dll!CreateFileW 7710866C 5 Bytes JMP 00510FE5
.text C:\Windows\system32\lsass.exe[648] kernel32.dll!CreateFileA 77108CA4 5 Bytes JMP 0051000A
.text C:\Windows\system32\lsass.exe[648] ADVAPI32.dll!RegCreateKeyW 76EF8229 5 Bytes JMP 000E0FAB
.text C:\Windows\system32\lsass.exe[648] ADVAPI32.dll!RegCreateKeyExA 76F03941 5 Bytes JMP 000E0051
.text C:\Windows\system32\lsass.exe[648] ADVAPI32.dll!RegCreateKeyA 76F03B9F 5 Bytes JMP 000E0FBC
.text C:\Windows\system32\lsass.exe[648] ADVAPI32.dll!RegCreateKeyExW 76F104A2 5 Bytes JMP 000E007A
.text C:\Windows\system32\lsass.exe[648] ADVAPI32.dll!RegOpenKeyExA 76F10DDF 5 Bytes JMP 000E002C
.text C:\Windows\system32\lsass.exe[648] ADVAPI32.dll!RegOpenKeyW 76F17B8D 5 Bytes JMP 000E0011
.text C:\Windows\system32\lsass.exe[648] ADVAPI32.dll!RegOpenKeyA 76F1EAEA 5 Bytes JMP 000E0000
.text C:\Windows\system32\lsass.exe[648] ADVAPI32.dll!RegOpenKeyExW 76F25ECD 5 Bytes JMP 000E0FCD
.text C:\Windows\system32\lsass.exe[648] msvcrt.dll!_open 7672A890 5 Bytes JMP 000D0FEF
.text C:\Windows\system32\lsass.exe[648] msvcrt.dll!_wsystem 7675AA4F 2 Bytes JMP 000D003D
.text C:\Windows\system32\lsass.exe[648] msvcrt.dll!_wsystem + 3 7675AA52 2 Bytes JMP F9FF41AC
.text C:\Windows\system32\lsass.exe[648] msvcrt.dll!system 7675AB6B 5 Bytes JMP 000D0FBC
.text C:\Windows\system32\lsass.exe[648] msvcrt.dll!_creat 7675E711 5 Bytes JMP 000D0FCD
.text C:\Windows\system32\lsass.exe[648] msvcrt.dll!_wcreat 7675F9C6 5 Bytes JMP 000D0022
.text C:\Windows\system32\lsass.exe[648] msvcrt.dll!_wopen 7675FBA1 5 Bytes JMP 000D0FDE
.text C:\Windows\system32\lsass.exe[648] WS2_32.dll!socket 766D4358 5 Bytes JMP 000C000A
.text C:\Windows\system32\svchost.exe[840] kernel32.dll!VirtualProtect 770C18BF 5 Bytes JMP 00750F5C
.text C:\Windows\system32\svchost.exe[840] kernel32.dll!GetStartupInfoW 770C191A 5 Bytes JMP 0075006C
.text C:\Windows\system32\svchost.exe[840] kernel32.dll!GetStartupInfoA 770C19B8 5 Bytes JMP 0075005B
.text C:\Windows\system32\svchost.exe[840] kernel32.dll!CreateProcessW 770C1D27 5 Bytes JMP 00750091
.text C:\Windows\system32\svchost.exe[840] kernel32.dll!CreateProcessA 770C1D5C 5 Bytes JMP 00750EF0
.text C:\Windows\system32\svchost.exe[840] kernel32.dll!CreateNamedPipeA 770C2484 5 Bytes JMP 0075001B
.text C:\Windows\system32\svchost.exe[840] kernel32.dll!WinExec 770C32DF 5 Bytes JMP 00750F0B
.text C:\Windows\system32\svchost.exe[840] kernel32.dll!CreateNamedPipeW 770CEDFE 5 Bytes JMP 00750FCA
.text C:\Windows\system32\svchost.exe[840] kernel32.dll!CreatePipe 770DB0AF 5 Bytes JMP 00750F26
.text C:\Windows\system32\svchost.exe[840] kernel32.dll!VirtualProtectEx 770E60AB 5 Bytes JMP 00750F41
.text C:\Windows\system32\svchost.exe[840] kernel32.dll!LoadLibraryExW 770E95A7 5 Bytes JMP 00750F83
.text C:\Windows\system32\svchost.exe[840] kernel32.dll!LoadLibraryW 770E971F 5 Bytes JMP 00750F94
.text C:\Windows\system32\svchost.exe[840] kernel32.dll!LoadLibraryExA 770E9A6E 5 Bytes JMP 00750036
.text C:\Windows\system32\svchost.exe[840] kernel32.dll!LoadLibraryA 770E9A96 5 Bytes JMP 00750FB9
.text C:\Windows\system32\svchost.exe[840] kernel32.dll!GetProcAddress 77104110 5 Bytes JMP 007500A2
.text C:\Windows\system32\svchost.exe[840] kernel32.dll!CreateFileW 7710866C 5 Bytes JMP 00750FDB
.text C:\Windows\system32\svchost.exe[840] kernel32.dll!CreateFileA 77108CA4 5 Bytes JMP 00750000
.text C:\Windows\system32\svchost.exe[840] msvcrt.dll!_open 7672A890 5 Bytes JMP 006F0FEF
.text C:\Windows\system32\svchost.exe[840] msvcrt.dll!_wsystem 7675AA4F 5 Bytes JMP 006F0FB7
.text C:\Windows\system32\svchost.exe[840] msvcrt.dll!system 7675AB6B 5 Bytes JMP 006F0042
.text C:\Windows\system32\svchost.exe[840] msvcrt.dll!_creat 7675E711 5 Bytes JMP 006F001D
.text C:\Windows\system32\svchost.exe[840] msvcrt.dll!_wcreat 7675F9C6 5 Bytes JMP 006F0FC8
.text C:\Windows\system32\svchost.exe[840] msvcrt.dll!_wopen 7675FBA1 5 Bytes JMP 006F000C
.text C:\Windows\system32\svchost.exe[840] ADVAPI32.dll!RegCreateKeyW 76EF8229 5 Bytes JMP 00740042
.text C:\Windows\system32\svchost.exe[840] ADVAPI32.dll!RegCreateKeyExA 76F03941 5 Bytes JMP 00740053
.text C:\Windows\system32\svchost.exe[840] ADVAPI32.dll!RegCreateKeyA 76F03B9F 5 Bytes JMP 00740FB7
.text C:\Windows\system32\svchost.exe[840] ADVAPI32.dll!RegCreateKeyExW 76F104A2 5 Bytes JMP 00740F90
.text C:\Windows\system32\svchost.exe[840] ADVAPI32.dll!RegOpenKeyExA 76F10DDF 5 Bytes JMP 0074000A
.text C:\Windows\system32\svchost.exe[840] ADVAPI32.dll!RegOpenKeyW 76F17B8D 5 Bytes JMP 00740FD4
.text C:\Windows\system32\svchost.exe[840] ADVAPI32.dll!RegOpenKeyA 76F1EAEA 5 Bytes JMP 00740FEF
.text C:\Windows\system32\svchost.exe[840] ADVAPI32.dll!RegOpenKeyExW 76F25ECD 5 Bytes JMP 00740027
.text C:\Windows\system32\svchost.exe[840] WS2_32.dll!socket 766D4358 5 Bytes JMP 00260FE5
.text C:\Windows\system32\svchost.exe[924] kernel32.dll!VirtualProtect 770C18BF 5 Bytes JMP 00940051
.text C:\Windows\system32\svchost.exe[924] kernel32.dll!GetStartupInfoW 770C191A 5 Bytes JMP 0094009B
.text C:\Windows\system32\svchost.exe[924] kernel32.dll!GetStartupInfoA 770C19B8 5 Bytes JMP 00940076
.text C:\Windows\system32\svchost.exe[924] kernel32.dll!CreateProcessW 770C1D27 5 Bytes JMP 00940F1F
.text C:\Windows\system32\svchost.exe[924] kernel32.dll!CreateProcessA 770C1D5C 5 Bytes JMP 009400B6
.text C:\Windows\system32\svchost.exe[924] kernel32.dll!CreateNamedPipeA 770C2484 5 Bytes JMP 00940014
.text C:\Windows\system32\svchost.exe[924] kernel32.dll!WinExec 770C32DF 5 Bytes JMP 00940F3A
.text C:\Windows\system32\svchost.exe[924] kernel32.dll!CreateNamedPipeW 770CEDFE 5 Bytes JMP 00940025
.text C:\Windows\system32\svchost.exe[924] kernel32.dll!CreatePipe 770DB0AF 5 Bytes JMP 00940F4B
.text C:\Windows\system32\svchost.exe[924] kernel32.dll!VirtualProtectEx 770E60AB 5 Bytes JMP 00940F5C
.text C:\Windows\system32\svchost.exe[924] kernel32.dll!LoadLibraryExW 770E95A7 5 Bytes JMP 00940040
.text C:\Windows\system32\svchost.exe[924] kernel32.dll!LoadLibraryW 770E971F 5 Bytes JMP 00940F9E
.text C:\Windows\system32\svchost.exe[924] kernel32.dll!LoadLibraryExA 770E9A6E 5 Bytes JMP 00940F83
.text C:\Windows\system32\svchost.exe[924] kernel32.dll!LoadLibraryA 770E9A96 5 Bytes JMP 00940FB9
.text C:\Windows\system32\svchost.exe[924] kernel32.dll!GetProcAddress 77104110 5 Bytes JMP 009400D1
.text C:\Windows\system32\svchost.exe[924] kernel32.dll!CreateFileW 7710866C 5 Bytes JMP 00940FDE
.text C:\Windows\system32\svchost.exe[924] kernel32.dll!CreateFileA 77108CA4 5 Bytes JMP 00940FEF
.text C:\Windows\system32\svchost.exe[924] msvcrt.dll!_open 7672A890 5 Bytes JMP 00910FEF
.text C:\Windows\system32\svchost.exe[924] msvcrt.dll!_wsystem 7675AA4F 2 Bytes JMP 00910047
.text C:\Windows\system32\svchost.exe[924] msvcrt.dll!_wsystem + 3 7675AA52 2 Bytes [1B, 8A]
.text C:\Windows\system32\svchost.exe[924] msvcrt.dll!system 7675AB6B 5 Bytes JMP 00910022
.text C:\Windows\system32\svchost.exe[924] msvcrt.dll!_creat 7675E711 5 Bytes JMP 00910011
.text C:\Windows\system32\svchost.exe[924] msvcrt.dll!_wcreat 7675F9C6 5 Bytes JMP 00910FB2
.text C:\Windows\system32\svchost.exe[924] msvcrt.dll!_wopen 7675FBA1 5 Bytes JMP 00910000
.text C:\Windows\system32\svchost.exe[924] ADVAPI32.dll!RegCreateKeyW 76EF8229 5 Bytes JMP 00920FA3
.text C:\Windows\system32\svchost.exe[924] ADVAPI32.dll!RegCreateKeyExA 76F03941 5 Bytes JMP 00920F92
.text C:\Windows\system32\svchost.exe[924] ADVAPI32.dll!RegCreateKeyA 76F03B9F 5 Bytes JMP 00920038
.text C:\Windows\system32\svchost.exe[924] ADVAPI32.dll!RegCreateKeyExW 76F104A2 5 Bytes JMP 00920F81
.text C:\Windows\system32\svchost.exe[924] ADVAPI32.dll!RegOpenKeyExA 76F10DDF 5 Bytes JMP 0092000A
.text C:\Windows\system32\svchost.exe[924] ADVAPI32.dll!RegOpenKeyW 76F17B8D 5 Bytes JMP 00920FDE
.text C:\Windows\system32\svchost.exe[924] ADVAPI32.dll!RegOpenKeyA 76F1EAEA 5 Bytes JMP 00920FEF
.text C:\Windows\system32\svchost.exe[924] ADVAPI32.dll!RegOpenKeyExW 76F25ECD 5 Bytes JMP 00920027
.text C:\Windows\system32\svchost.exe[924] WS2_32.dll!socket 766D4358 5 Bytes JMP 00660000
.text C:\Windows\System32\svchost.exe[1068] kernel32.dll!VirtualProtect 770C18BF 5 Bytes JMP 00920093
.text C:\Windows\System32\svchost.exe[1068] kernel32.dll!GetStartupInfoW 770C191A 5 Bytes JMP 00920F68
.text C:\Windows\System32\svchost.exe[1068] kernel32.dll!GetStartupInfoA 770C19B8 5 Bytes JMP 00920F79
.text C:\Windows\System32\svchost.exe[1068] kernel32.dll!CreateProcessW 770C1D27 5 Bytes JMP 00920F32
.text C:\Windows\System32\svchost.exe[1068] kernel32.dll!CreateProcessA 770C1D5C 5 Bytes JMP 009200C9
.text C:\Windows\System32\svchost.exe[1068] kernel32.dll!CreateNamedPipeA 770C2484 5 Bytes JMP 0092001B
.text C:\Windows\System32\svchost.exe[1068] kernel32.dll!WinExec 770C32DF 5 Bytes JMP 00920F43
.text C:\Windows\System32\svchost.exe[1068] kernel32.dll!CreateNamedPipeW 770CEDFE 5 Bytes JMP 00920040
.text C:\Windows\System32\svchost.exe[1068] kernel32.dll!CreatePipe 770DB0AF 5 Bytes JMP 00920F94
.text C:\Windows\System32\svchost.exe[1068] kernel32.dll!VirtualProtectEx 770E60AB 5 Bytes JMP 009200A4
.text C:\Windows\System32\svchost.exe[1068] kernel32.dll!LoadLibraryExW 770E95A7 5 Bytes JMP 00920FB9
.text C:\Windows\System32\svchost.exe[1068] kernel32.dll!LoadLibraryW 770E971F 5 Bytes JMP 00920076
.text C:\Windows\System32\svchost.exe[1068] kernel32.dll!LoadLibraryExA 770E9A6E 5 Bytes JMP 00920FD4
.text C:\Windows\System32\svchost.exe[1068] kernel32.dll!LoadLibraryA 770E9A96 5 Bytes JMP 00920051
.text C:\Windows\System32\svchost.exe[1068] kernel32.dll!GetProcAddress 77104110 5 Bytes JMP 00920F21
.text C:\Windows\System32\svchost.exe[1068] kernel32.dll!CreateFileW 7710866C 5 Bytes JMP 00920FEF
.text C:\Windows\System32\svchost.exe[1068] kernel32.dll!CreateFileA 77108CA4 5 Bytes JMP 0092000A
.text C:\Windows\System32\svchost.exe[1068] msvcrt.dll!_open 7672A890 5 Bytes JMP 00870000
.text C:\Windows\System32\svchost.exe[1068] msvcrt.dll!_wsystem 7675AA4F 2 Bytes JMP 0087002C
.text C:\Windows\System32\svchost.exe[1068] msvcrt.dll!_wsystem + 3 7675AA52 2 Bytes [11, 8A]
.text C:\Windows\System32\svchost.exe[1068] msvcrt.dll!system 7675AB6B 5 Bytes JMP 00870011
.text C:\Windows\System32\svchost.exe[1068] msvcrt.dll!_creat 7675E711 5 Bytes JMP 00870FBC
.text C:\Windows\System32\svchost.exe[1068] msvcrt.dll!_wcreat 7675F9C6 5 Bytes JMP 00870FA1
.text C:\Windows\System32\svchost.exe[1068] msvcrt.dll!_wopen 7675FBA1 5 Bytes JMP 00870FE3
.text C:\Windows\System32\svchost.exe[1068] ADVAPI32.dll!RegCreateKeyW 76EF8229 5 Bytes JMP 008C0040
.text C:\Windows\System32\svchost.exe[1068] ADVAPI32.dll!RegCreateKeyExA 76F03941 5 Bytes JMP 008C005D
.text C:\Windows\System32\svchost.exe[1068] ADVAPI32.dll!RegCreateKeyA 76F03B9F 5 Bytes JMP 008C002F
.text C:\Windows\System32\svchost.exe[1068] ADVAPI32.dll!RegCreateKeyExW 76F104A2 5 Bytes JMP 008C0F9A
.text C:\Windows\System32\svchost.exe[1068] ADVAPI32.dll!RegOpenKeyExA 76F10DDF 5 Bytes JMP 008C0FD2
.text C:\Windows\System32\svchost.exe[1068] ADVAPI32.dll!RegOpenKeyW 76F17B8D 5 Bytes JMP 008C0FEF
.text C:\Windows\System32\svchost.exe[1068] ADVAPI32.dll!RegOpenKeyA 76F1EAEA 5 Bytes JMP 008C0000
.text C:\Windows\System32\svchost.exe[1068] ADVAPI32.dll!RegOpenKeyExW 76F25ECD 5 Bytes JMP 008C0FC1
.text C:\Windows\System32\svchost.exe[1068] WS2_32.dll!socket 766D4358 5 Bytes JMP 00280FE5
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!VirtualProtect 770C18BF 5 Bytes JMP 00DE0049
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!GetStartupInfoW 770C191A 5 Bytes JMP 00DE0097
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!GetStartupInfoA 770C19B8 5 Bytes JMP 00DE0086
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!CreateProcessW 770C1D27 5 Bytes JMP 00DE0F14
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!CreateProcessA 770C1D5C 5 Bytes JMP 00DE0F25
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!CreateNamedPipeA 770C2484 5 Bytes JMP 00DE000A
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!WinExec 770C32DF 5 Bytes JMP 00DE0F36
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!CreateNamedPipeW 770CEDFE 5 Bytes JMP 00DE0FB9
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!CreatePipe 770DB0AF 5 Bytes JMP 00DE0075
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!VirtualProtectEx 770E60AB 5 Bytes JMP 00DE0064
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!LoadLibraryExW 770E95A7 5 Bytes JMP 00DE0F6F
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!LoadLibraryW 770E971F 5 Bytes JMP 00DE002C
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!LoadLibraryExA 770E9A6E 5 Bytes JMP 00DE0F8A
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!LoadLibraryA 770E9A96 5 Bytes JMP 00DE001B
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!GetProcAddress 77104110 5 Bytes JMP 00DE00D0
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!CreateFileW 7710866C 5 Bytes JMP 00DE0FD4
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!CreateFileA 77108CA4 5 Bytes JMP 00DE0FEF
.text C:\Windows\System32\svchost.exe[1108] msvcrt.dll!_open 7672A890 5 Bytes JMP 00D80000
.text C:\Windows\System32\svchost.exe[1108] msvcrt.dll!_wsystem 7675AA4F 5 Bytes JMP 00D80FBE
.text C:\Windows\System32\svchost.exe[1108] msvcrt.dll!system 7675AB6B 5 Bytes JMP 00D80049
.text C:\Windows\System32\svchost.exe[1108] msvcrt.dll!_creat 7675E711 5 Bytes JMP 00D80FE3
.text C:\Windows\System32\svchost.exe[1108] msvcrt.dll!_wcreat 7675F9C6 5 Bytes JMP 00D8002E
.text C:\Windows\System32\svchost.exe[1108] msvcrt.dll!_wopen 7675FBA1 5 Bytes JMP 00D8001D
.text C:\Windows\System32\svchost.exe[1108] ADVAPI32.dll!RegCreateKeyW 76EF8229 5 Bytes JMP 00DD0FA1
.text C:\Windows\System32\svchost.exe[1108] ADVAPI32.dll!RegCreateKeyExA 76F03941 5 Bytes JMP 00DD0F7A
.text C:\Windows\System32\svchost.exe[1108] ADVAPI32.dll!RegCreateKeyA 76F03B9F 5 Bytes JMP 00DD002C
.text C:\Windows\System32\svchost.exe[1108] ADVAPI32.dll!RegCreateKeyExW 76F104A2 5 Bytes JMP 00DD0F69
.text C:\Windows\System32\svchost.exe[1108] ADVAPI32.dll!RegOpenKeyExA 76F10DDF 5 Bytes JMP 00DD0FCD
.text C:\Windows\System32\svchost.exe[1108] ADVAPI32.dll!RegOpenKeyW 76F17B8D 5 Bytes JMP 00DD0FDE
.text C:\Windows\System32\svchost.exe[1108] ADVAPI32.dll!RegOpenKeyA 76F1EAEA 5 Bytes JMP 00DD0FEF
.text C:\Windows\System32\svchost.exe[1108] ADVAPI32.dll!RegOpenKeyExW 76F25ECD 5 Bytes JMP 00DD0FBC
.text C:\Windows\System32\svchost.exe[1108] WS2_32.dll!socket 766D4358 5 Bytes JMP 00D70FEF
.text C:\Windows\system32\svchost.exe[1120] kernel32.dll!VirtualProtect 770C18BF 5 Bytes JMP 00AE0078
.text C:\Windows\system32\svchost.exe[1120] kernel32.dll!GetStartupInfoW 770C191A 5 Bytes JMP 00AE00B5
.text C:\Windows\system32\svchost.exe[1120] kernel32.dll!GetStartupInfoA 770C19B8 5 Bytes JMP 00AE0F6F
.text C:\Windows\system32\svchost.exe[1120] kernel32.dll!CreateProcessW 770C1D27 5 Bytes JMP 00AE0F39
.text C:\Windows\system32\svchost.exe[1120] kernel32.dll!CreateProcessA 770C1D5C 5 Bytes JMP 00AE0F54
.text C:\Windows\system32\svchost.exe[1120] kernel32.dll!CreateNamedPipeA 770C2484 5 Bytes JMP 00AE0FE5
.text C:\Windows\system32\svchost.exe[1120] kernel32.dll!WinExec 770C32DF 5 Bytes JMP 00AE00D0
.text C:\Windows\system32\svchost.exe[1120] kernel32.dll!CreateNamedPipeW 770CEDFE 5 Bytes JMP 00AE0036
.text C:\Windows\system32\svchost.exe[1120] kernel32.dll!CreatePipe 770DB0AF 5 Bytes JMP 00AE00A4
.text C:\Windows\system32\svchost.exe[1120] kernel32.dll!VirtualProtectEx 770E60AB 5 Bytes JMP 00AE0093
.text C:\Windows\system32\svchost.exe[1120] kernel32.dll!LoadLibraryExW 770E95A7 5 Bytes JMP 00AE0F9E
.text C:\Windows\system32\svchost.exe[1120] kernel32.dll!LoadLibraryW 770E971F 5 Bytes JMP 00AE0FAF
.text C:\Windows\system32\svchost.exe[1120] kernel32.dll!LoadLibraryExA 770E9A6E 5 Bytes JMP 00AE0051
.text C:\Windows\system32\svchost.exe[1120] kernel32.dll!LoadLibraryA 770E9A96 5 Bytes JMP 00AE0FCA
.text C:\Windows\system32\svchost.exe[1120] kernel32.dll!GetProcAddress 77104110 5 Bytes JMP 00AE0F28
.text C:\Windows\system32\svchost.exe[1120] kernel32.dll!CreateFileW 7710866C 5 Bytes JMP 00AE001B
.text C:\Windows\system32\svchost.exe[1120] kernel32.dll!CreateFileA 77108CA4 5 Bytes JMP 00AE0000
.text C:\Windows\system32\svchost.exe[1120] msvcrt.dll!_open 7672A890 5 Bytes JMP 00A80000
.text C:\Windows\system32\svchost.exe[1120] msvcrt.dll!_wsystem 7675AA4F 5 Bytes JMP 00A80084
.text C:\Windows\system32\svchost.exe[1120] msvcrt.dll!system 7675AB6B 5 Bytes JMP 00A8005F
.text C:\Windows\system32\svchost.exe[1120] msvcrt.dll!_creat 7675E711 5 Bytes JMP 00A80044
.text C:\Windows\system32\svchost.exe[1120] msvcrt.dll!_wcreat 7675F9C6 5 Bytes JMP 00A80FEF
.text C:\Windows\system32\svchost.exe[1120] msvcrt.dll!_wopen 7675FBA1 5 Bytes JMP 00A8001D
.text C:\Windows\system32\svchost.exe[1120] ADVAPI32.dll!RegCreateKeyW 76EF8229 5 Bytes JMP 00A90FC0
.text C:\Windows\system32\svchost.exe[1120] ADVAPI32.dll!RegCreateKeyExA 76F03941 5 Bytes JMP 00A90FAF
.text C:\Windows\system32\svchost.exe[1120] ADVAPI32.dll!RegCreateKeyA 76F03B9F 5 Bytes JMP 00A9004B
.text C:\Windows\system32\svchost.exe[1120] ADVAPI32.dll!RegCreateKeyExW 76F104A2 5 Bytes JMP 00A90072
.text C:\Windows\system32\svchost.exe[1120] ADVAPI32.dll!RegOpenKeyExA 76F10DDF 5 Bytes JMP 00A9001D
.text C:\Windows\system32\svchost.exe[1120] ADVAPI32.dll!RegOpenKeyW 76F17B8D 5 Bytes JMP 00A90000
.text C:\Windows\system32\svchost.exe[1120] ADVAPI32.dll!RegOpenKeyA 76F1EAEA 5 Bytes JMP 00A90FE5
.text C:\Windows\system32\svchost.exe[1120] ADVAPI32.dll!RegOpenKeyExW 76F25ECD 5 Bytes JMP 00A9003A
.text C:\Windows\system32\svchost.exe[1120] WS2_32.dll!socket 766D4358 5 Bytes JMP 00A30FE5
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!VirtualProtect 770C18BF 5 Bytes JMP 00AB0040
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!GetStartupInfoW 770C191A 5 Bytes JMP 00AB0098
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!GetStartupInfoA 770C19B8 5 Bytes JMP 00AB0087
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!CreateProcessW 770C1D27 5 Bytes JMP 00AB0F1F
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!CreateProcessA 770C1D5C 5 Bytes JMP 00AB0F30
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!CreateNamedPipeA 770C2484 5 Bytes JMP 00AB0014
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!WinExec 770C32DF 5 Bytes JMP 00AB0F41
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!CreateNamedPipeW 770CEDFE 5 Bytes JMP 00AB0025
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!CreatePipe 770DB0AF 5 Bytes JMP 00AB006C
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!VirtualProtectEx 770E60AB 5 Bytes JMP 00AB005B
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!LoadLibraryExW 770E95A7 5 Bytes JMP 00AB0F66
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!LoadLibraryW 770E971F 5 Bytes JMP 00AB0F9E
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!LoadLibraryExA 770E9A6E 5 Bytes JMP 00AB0F8D
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!LoadLibraryA 770E9A96 5 Bytes JMP 00AB0FB9
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!GetProcAddress 77104110 5 Bytes JMP 00AB0F04
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!CreateFileW 7710866C 5 Bytes JMP 00AB0FDE
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!CreateFileA 77108CA4 5 Bytes JMP 00AB0FEF
.text C:\Windows\system32\svchost.exe[1308] msvcrt.dll!_open 7672A890 5 Bytes JMP 00A40000
.text C:\Windows\system32\svchost.exe[1308] msvcrt.dll!_wsystem 7675AA4F 5 Bytes JMP 00A40FB2
.text C:\Windows\system32\svchost.exe[1308] msvcrt.dll!system 7675AB6B 5 Bytes JMP 00A40033
.text C:\Windows\system32\svchost.exe[1308] msvcrt.dll!_creat 7675E711 5 Bytes JMP 00A40FD7
.text C:\Windows\system32\svchost.exe[1308] msvcrt.dll!_wcreat 7675F9C6 5 Bytes JMP 00A40022
.text C:\Windows\system32\svchost.exe[1308] msvcrt.dll!_wopen 7675FBA1 5 Bytes JMP 00A40011
.text C:\Windows\system32\svchost.exe[1308] ADVAPI32.dll!RegCreateKeyW 76EF8229 5 Bytes JMP 00AA0F9C
.text C:\Windows\system32\svchost.exe[1308] ADVAPI32.dll!RegCreateKeyExA 76F03941 5 Bytes JMP 00AA004E
.text C:\Windows\system32\svchost.exe[1308] ADVAPI32.dll!RegCreateKeyA 76F03B9F 5 Bytes JMP 00AA0FAD
.text C:\Windows\system32\svchost.exe[1308] ADVAPI32.dll!RegCreateKeyExW 76F104A2 5 Bytes JMP 00AA006B
.text C:\Windows\system32\svchost.exe[1308] ADVAPI32.dll!RegOpenKeyExA 76F10DDF 5 Bytes JMP 00AA0FE5
.text C:\Windows\system32\svchost.exe[1308] ADVAPI32.dll!RegOpenKeyW 76F17B8D 5 Bytes JMP 00AA001B
.text C:\Windows\system32\svchost.exe[1308] ADVAPI32.dll!RegOpenKeyA 76F1EAEA 5 Bytes JMP 00AA0000
.text C:\Windows\system32\svchost.exe[1308] ADVAPI32.dll!RegOpenKeyExW 76F25ECD 5 Bytes JMP 00AA0FD4
.text C:\Windows\system32\svchost.exe[1308] WS2_32.dll!socket 766D4358 5 Bytes JMP 00610FEF
.text C:\Windows\system32\svchost.exe[1308] WinInet.dll!InternetOpenA 76A43081 5 Bytes JMP 00A50FE5
.text C:\Windows\system32\svchost.exe[1308] WinInet.dll!InternetOpenW 76A436B1 5 Bytes JMP 00A50FD4
.text C:\Windows\system32\svchost.exe[1308] WinInet.dll!InternetOpenUrlA 76A46F5A 5 Bytes JMP 00A50FB9
.text C:\Windows\system32\svchost.exe[1308] WinInet.dll!InternetOpenUrlW 76A88439 5 Bytes JMP 00A50FA8
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!VirtualProtect 770C18BF 5 Bytes JMP 00360098
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!GetStartupInfoW 770C191A 5 Bytes JMP 00360F7E
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!GetStartupInfoA 770C19B8 5 Bytes JMP 003600C4
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreateProcessW 770C1D27 5 Bytes JMP 00360F37
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreateProcessA 770C1D5C 5 Bytes JMP 00360F52
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreateNamedPipeA 770C2484 5 Bytes JMP 00360040
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!WinExec 770C32DF 5 Bytes JMP 00360F6D
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreateNamedPipeW 770CEDFE 5 Bytes JMP 00360051
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreatePipe 770DB0AF 5 Bytes JMP 00360FA3
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!VirtualProtectEx 770E60AB 5 Bytes JMP 003600B3
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!LoadLibraryExW 770E95A7 5 Bytes JMP 00360FBE
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!LoadLibraryW 770E971F 5 Bytes JMP 00360076
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!LoadLibraryExA 770E9A6E 5 Bytes JMP 00360087
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!LoadLibraryA 770E9A96 5 Bytes JMP 00360FE5
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!GetProcAddress 77104110 5 Bytes JMP 003600E9
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreateFileW 7710866C 5 Bytes JMP 0036001B
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreateFileA 77108CA4 5 Bytes JMP 00360000
.text C:\Windows\system32\svchost.exe[1468] msvcrt.dll!_open 7672A890 5 Bytes JMP 0034000C
.text C:\Windows\system32\svchost.exe[1468] msvcrt.dll!_wsystem 7675AA4F 2 Bytes JMP 0034003B
.text C:\Windows\system32\svchost.exe[1468] msvcrt.dll!_wsystem + 3 7675AA52 2 Bytes [BE, 89]
.text C:\Windows\system32\svchost.exe[1468] msvcrt.dll!system 7675AB6B 5 Bytes JMP 00340FB0
.text C:\Windows\system32\svchost.exe[1468] msvcrt.dll!_creat 7675E711 5 Bytes JMP 00340FD2
.text C:\Windows\system32\svchost.exe[1468] msvcrt.dll!_wcreat 7675F9C6 5 Bytes JMP 00340FC1
.text C:\Windows\system32\svchost.exe[1468] msvcrt.dll!_wopen 7675FBA1 5 Bytes JMP 00340FEF
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegCreateKeyW 76EF8229 5 Bytes JMP 0035005A
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegCreateKeyExA 76F03941 5 Bytes JMP 00350081
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegCreateKeyA 76F03B9F 5 Bytes JMP 00350049
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegCreateKeyExW 76F104A2 5 Bytes JMP 00350092
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegOpenKeyExA 76F10DDF 5 Bytes JMP 0035001B
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegOpenKeyW 76F17B8D 5 Bytes JMP 00350FE5
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegOpenKeyA 76F1EAEA 5 Bytes JMP 00350000
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegOpenKeyExW 76F25ECD 5 Bytes JMP 00350038
.text C:\Windows\system32\svchost.exe[1468] WS2_32.dll!socket 766D4358 5 Bytes JMP 0033000A
.text C:\Windows\system32\svchost.exe[1764] kernel32.dll!VirtualProtect 770C18BF 5 Bytes JMP 01490F83
.text C:\Windows\system32\svchost.exe[1764] kernel32.dll!GetStartupInfoW 770C191A 5 Bytes JMP 01490F72
.text C:\Windows\system32\svchost.exe[1764] kernel32.dll!GetStartupInfoA 770C19B8 5 Bytes JMP 014900B8
.text C:\Windows\system32\svchost.exe[1764] kernel32.dll!CreateProcessW 770C1D27 5 Bytes JMP 014900E4
.text C:\Windows\system32\svchost.exe[1764] kernel32.dll!CreateProcessA 770C1D5C 5 Bytes JMP 014900C9
.text C:\Windows\system32\svchost.exe[1764] kernel32.dll!CreateNamedPipeA 770C2484 5 Bytes JMP 0149002C
.text C:\Windows\system32\svchost.exe[1764] kernel32.dll!WinExec 770C32DF 5 Bytes JMP 01490F57
.text C:\Windows\system32\svchost.exe[1764] kernel32.dll!CreateNamedPipeW 770CEDFE 5 Bytes JMP 01490FDB
.text C:\Windows\system32\svchost.exe[1764] kernel32.dll!CreatePipe 770DB0AF 5 Bytes JMP 0149009D
.text C:\Windows\system32\svchost.exe[1764] kernel32.dll!VirtualProtectEx 770E60AB 5 Bytes JMP 01490078
.text C:\Windows\system32\svchost.exe[1764] kernel32.dll!LoadLibraryExW 770E95A7 5 Bytes JMP 01490F94
.text C:\Windows\system32\svchost.exe[1764] kernel32.dll!LoadLibraryW 770E971F 5 Bytes JMP 01490FAF
.text C:\Windows\system32\svchost.exe[1764] kernel32.dll!LoadLibraryExA 770E9A6E 5 Bytes JMP 01490051
.text C:\Windows\system32\svchost.exe[1764] kernel32.dll!LoadLibraryA 770E9A96 5 Bytes JMP 01490FC0
.text C:\Windows\system32\svchost.exe[1764] kernel32.dll!GetProcAddress 77104110 5 Bytes JMP 01490F28
.text C:\Windows\system32\svchost.exe[1764] kernel32.dll!CreateFileW 7710866C 5 Bytes JMP 01490011
.text C:\Windows\system32\svchost.exe[1764] kernel32.dll!CreateFileA 77108CA4 5 Bytes JMP 01490000
.text C:\Windows\system32\svchost.exe[1764] msvcrt.dll!_open 7672A890 5 Bytes JMP 0143000C
.text C:\Windows\system32\svchost.exe[1764] msvcrt.dll!_wsystem 7675AA4F 5 Bytes JMP 0143005D
.text C:\Windows\system32\svchost.exe[1764] msvcrt.dll!system 7675AB6B 5 Bytes JMP 01430FD2
.text C:\Windows\system32\svchost.exe[1764] msvcrt.dll!_creat 7675E711 5 Bytes JMP 0143002E
.text C:\Windows\system32\svchost.exe[1764] msvcrt.dll!_wcreat 7675F9C6 5 Bytes JMP 01430FE3
.text C:\Windows\system32\svchost.exe[1764] msvcrt.dll!_wopen 7675FBA1 5 Bytes JMP 0143001D
.text C:\Windows\system32\svchost.exe[1764] ADVAPI32.dll!RegCreateKeyW 76EF8229 5 Bytes JMP 0148003D
.text C:\Windows\system32\svchost.exe[1764] ADVAPI32.dll!RegCreateKeyExA 76F03941 5 Bytes JMP 01480058
.text C:\Windows\system32\svchost.exe[1764] ADVAPI32.dll!RegCreateKeyA 76F03B9F 5 Bytes JMP 0148002C
.text C:\Windows\system32\svchost.exe[1764] ADVAPI32.dll!RegCreateKeyExW 76F104A2 5 Bytes JMP 01480069
.text C:\Windows\system32\svchost.exe[1764] ADVAPI32.dll!RegOpenKeyExA 76F10DDF 5 Bytes JMP 01480FE5
.text C:\Windows\system32\svchost.exe[1764] ADVAPI32.dll!RegOpenKeyW 76F17B8D 5 Bytes JMP 01480011
.text C:\Windows\system32\svchost.exe[1764] ADVAPI32.dll!RegOpenKeyA 76F1EAEA 5 Bytes JMP 01480000
.text C:\Windows\system32\svchost.exe[1764] ADVAPI32.dll!RegOpenKeyExW 76F25ECD 5 Bytes JMP 01480FC8
.text C:\Windows\system32\svchost.exe[1764] WS2_32.dll!socket 766D4358 5 Bytes JMP 013E0FEF
.text C:\Windows\system32\wuauclt.exe[2184] kernel32.dll!VirtualProtect 770C18BF 5 Bytes JMP 00010F97
.text C:\Windows\system32\wuauclt.exe[2184] kernel32.dll!GetStartupInfoW 770C191A 5 Bytes JMP 00010F61
.text C:\Windows\system32\wuauclt.exe[2184] kernel32.dll!GetStartupInfoA 770C19B8 5 Bytes JMP 000100A7
.text C:\Windows\system32\wuauclt.exe[2184] kernel32.dll!CreateProcessW 770C1D27 5 Bytes JMP 00010F1A
.text C:\Windows\system32\wuauclt.exe[2184] kernel32.dll!CreateProcessA 770C1D5C 5 Bytes JMP 00010F35
.text C:\Windows\system32\wuauclt.exe[2184] kernel32.dll!CreateNamedPipeA 770C2484 5 Bytes JMP 00010FD4
.text C:\Windows\system32\wuauclt.exe[2184] kernel32.dll!WinExec 770C32DF 5 Bytes JMP 00010F50
.text C:\Windows\system32\wuauclt.exe[2184] kernel32.dll!CreateNamedPipeW 770CEDFE 5 Bytes JMP 00010025
.text C:\Windows\system32\wuauclt.exe[2184] kernel32.dll!CreatePipe 770DB0AF 5 Bytes JMP 0001008C
.text C:\Windows\system32\wuauclt.exe[2184] kernel32.dll!VirtualProtectEx 770E60AB 5 Bytes JMP 00010F7C
.text C:\Windows\system32\wuauclt.exe[2184] kernel32.dll!LoadLibraryExW 770E95A7 5 Bytes JMP 00010071
.text C:\Windows\system32\wuauclt.exe[2184] kernel32.dll!LoadLibraryW 770E971F 5 Bytes JMP 0001004A
.text C:\Windows\system32\wuauclt.exe[2184] kernel32.dll!LoadLibraryExA 770E9A6E 5 Bytes JMP 00010FA8
.text C:\Windows\system32\wuauclt.exe[2184] kernel32.dll!LoadLibraryA 770E9A96 5 Bytes JMP 00010FC3
.text C:\Windows\system32\wuauclt.exe[2184] kernel32.dll!GetProcAddress 77104110 5 Bytes JMP 000100CC
.text C:\Windows\system32\wuauclt.exe[2184] kernel32.dll!CreateFileW 7710866C 5 Bytes JMP 0001000A
.text C:\Windows\system32\wuauclt.exe[2184] kernel32.dll!CreateFileA 77108CA4 5 Bytes JMP 00010FEF
.text C:\Windows\system32\wuauclt.exe[2184] msvcrt.dll!_open 7672A890 5 Bytes JMP 00060000
.text C:\Windows\system32\wuauclt.exe[2184] msvcrt.dll!_wsystem 7675AA4F 5 Bytes JMP 00060FC3
.text C:\Windows\system32\wuauclt.exe[2184] msvcrt.dll!system 7675AB6B 5 Bytes JMP 00060FD4
.text C:\Windows\system32\wuauclt.exe[2184] msvcrt.dll!_creat 7675E711 5 Bytes JMP 00060029
.text C:\Windows\system32\wuauclt.exe[2184] msvcrt.dll!_wcreat 7675F9C6 5 Bytes JMP 00060044
.text C:\Windows\system32\wuauclt.exe[2184] msvcrt.dll!_wopen 7675FBA1 5 Bytes JMP 00060FEF
.text C:\Windows\system32\wuauclt.exe[2184] ADVAPI32.dll!RegCreateKeyW 76EF8229 5 Bytes JMP 0007004E
.text C:\Windows\system32\wuauclt.exe[2184] ADVAPI32.dll!RegCreateKeyExA 76F03941 5 Bytes JMP 0007005F
.text C:\Windows\system32\wuauclt.exe[2184] ADVAPI32.dll!RegCreateKeyA 76F03B9F 5 Bytes JMP 00070FB9
.text C:\Windows\system32\wuauclt.exe[2184] ADVAPI32.dll!RegCreateKeyExW 76F104A2 5 Bytes JMP 00070FA8
.text C:\Windows\system32\wuauclt.exe[2184] ADVAPI32.dll!RegOpenKeyExA 76F10DDF 5 Bytes JMP 0007001B
.text C:\Windows\system32\wuauclt.exe[2184] ADVAPI32.dll!RegOpenKeyW 76F17B8D 5 Bytes JMP 0007000A
.text C:\Windows\system32\wuauclt.exe[2184] ADVAPI32.dll!RegOpenKeyA 76F1EAEA 5 Bytes JMP 00070FE5
.text C:\Windows\system32\wuauclt.exe[2184] ADVAPI32.dll!RegOpenKeyExW 76F25ECD 5 Bytes JMP 00070FD4
.text C:\Windows\system32\wuauclt.exe[2184] WS2_32.dll!socket 766D4358 5 Bytes JMP 00090FE5
.text C:\Windows\system32\svchost.exe[2420] kernel32.dll!VirtualProtect 770C18BF 5 Bytes JMP 00190F9E
.text C:\Windows\system32\svchost.exe[2420] kernel32.dll!GetStartupInfoW 770C191A 5 Bytes JMP 00190F83
.text C:\Windows\system32\svchost.exe[2420] kernel32.dll!GetStartupInfoA 770C19B8 5 Bytes JMP 001900D3
.text C:\Windows\system32\svchost.exe[2420] kernel32.dll!CreateProcessW 770C1D27 5 Bytes JMP 00190F46
.text C:\Windows\system32\svchost.exe[2420] kernel32.dll!CreateProcessA 770C1D5C 5 Bytes JMP 00190F61
.text C:\Windows\system32\svchost.exe[2420] kernel32.dll!CreateNamedPipeA 770C2484 5 Bytes JMP 0019000A
.text C:\Windows\system32\svchost.exe[2420] kernel32.dll!WinExec 770C32DF 5 Bytes JMP 00190F72
.text C:\Windows\system32\svchost.exe[2420] kernel32.dll!CreateNamedPipeW 770CEDFE 5 Bytes JMP 0019001B
.text C:\Windows\system32\svchost.exe[2420] kernel32.dll!CreatePipe 770DB0AF 5 Bytes JMP 001900AE
.text C:\Windows\system32\svchost.exe[2420] kernel32.dll!VirtualProtectEx 770E60AB 5 Bytes JMP 0019009D
.text C:\Windows\system32\svchost.exe[2420] kernel32.dll!LoadLibraryExW 770E95A7 5 Bytes JMP 00190076
.text C:\Windows\system32\svchost.exe[2420] kernel32.dll!LoadLibraryW 770E971F 5 Bytes JMP 0019004A
.text C:\Windows\system32\svchost.exe[2420] kernel32.dll!LoadLibraryExA 770E9A6E 5 Bytes JMP 00190065
.text C:\Windows\system32\svchost.exe[2420] kernel32.dll!LoadLibraryA 770E9A96 5 Bytes JMP 00190FB9
.text C:\Windows\system32\svchost.exe[2420] kernel32.dll!GetProcAddress 77104110 5 Bytes JMP 001900F8
.text C:\Windows\system32\svchost.exe[2420] kernel32.dll!CreateFileW 7710866C 5 Bytes JMP 00190FD4
.text C:\Windows\system32\svchost.exe[2420] kernel32.dll!CreateFileA 77108CA4 5 Bytes JMP 00190FEF
.text C:\Windows\system32\svchost.exe[2420] msvcrt.dll!_open 7672A890 5 Bytes JMP 000F0FE3
.text C:\Windows\system32\svchost.exe[2420] msvcrt.dll!_wsystem 7675AA4F 5 Bytes JMP 000F0F9A
.text C:\Windows\system32\svchost.exe[2420] msvcrt.dll!system 7675AB6B 5 Bytes JMP 000F0FB5
.text C:\Windows\system32\svchost.exe[2420] msvcrt.dll!_creat 7675E711 5 Bytes JMP 000F0011
.text C:\Windows\system32\svchost.exe[2420] msvcrt.dll!_wcreat 7675F9C6 5 Bytes JMP 000F0FC6
.text C:\Windows\system32\svchost.exe[2420] msvcrt.dll!_wopen 7675FBA1 5 Bytes JMP 000F0000
.text C:\Windows\system32\svchost.exe[2420] ADVAPI32.dll!RegCreateKeyW 76EF8229 5 Bytes JMP 00180036
.text C:\Windows\system32\svchost.exe[2420] ADVAPI32.dll!RegCreateKeyExA 76F03941 5 Bytes JMP 00180047
.text C:\Windows\system32\svchost.exe[2420] ADVAPI32.dll!RegCreateKeyA 76F03B9F 5 Bytes JMP 00180FAB
.text C:\Windows\system32\svchost.exe[2420] ADVAPI32.dll!RegCreateKeyExW 76F104A2 5 Bytes JMP 00180070
.text C:\Windows\system32\svchost.exe[2420] ADVAPI32.dll!RegOpenKeyExA 76F10DDF 5 Bytes JMP 0018001B
.text C:\Windows\system32\svchost.exe[2420] ADVAPI32.dll!RegOpenKeyW 76F17B8D 5 Bytes JMP 00180FE5
.text C:\Windows\system32\svchost.exe[2420] ADVAPI32.dll!RegOpenKeyA 76F1EAEA 5 Bytes JMP 00180000
.text C:\Windows\system32\svchost.exe[2420] ADVAPI32.dll!RegOpenKeyExW 76F25ECD 5 Bytes JMP 00180FBC
.text C:\Windows\system32\svchost.exe[2420] WS2_32.dll!socket 766D4358 5 Bytes JMP 000A000A
.text C:\Windows\system32\svchost.exe[2588] kernel32.dll!VirtualProtect 770C18BF 5 Bytes JMP 00350045
.text C:\Windows\system32\svchost.exe[2588] kernel32.dll!GetStartupInfoW 770C191A 5 Bytes JMP 00350F3C
.text C:\Windows\system32\svchost.exe[2588] kernel32.dll!GetStartupInfoA 770C19B8 5 Bytes JMP 00350078
.text C:\Windows\system32\svchost.exe[2588] kernel32.dll!CreateProcessW 770C1D27 5 Bytes JMP 00350F17
.text C:\Windows\system32\svchost.exe[2588] kernel32.dll!CreateProcessA 770C1D5C 5 Bytes JMP 003500AE
.text C:\Windows\system32\svchost.exe[2588] kernel32.dll!CreateNamedPipeA 770C2484 5 Bytes JMP 00350FDE
.text C:\Windows\system32\svchost.exe[2588] kernel32.dll!WinExec 770C32DF 5 Bytes JMP 0035009D
.text C:\Windows\system32\svchost.exe[2588] kernel32.dll!CreateNamedPipeW 770CEDFE 5 Bytes JMP 00350FCD
.text C:\Windows\system32\svchost.exe[2588] kernel32.dll!CreatePipe 770DB0AF 5 Bytes JMP 00350067
.text C:\Windows\system32\svchost.exe[2588] kernel32.dll!VirtualProtectEx 770E60AB 5 Bytes JMP 00350056
.text C:\Windows\system32\svchost.exe[2588] kernel32.dll!LoadLibraryExW 770E95A7 5 Bytes JMP 00350F6B
.text C:\Windows\system32\svchost.exe[2588] kernel32.dll!LoadLibraryW 770E971F 5 Bytes JMP 00350F97
.text C:\Windows\system32\svchost.exe[2588] kernel32.dll!LoadLibraryExA 770E9A6E 5 Bytes JMP 00350F86
.text C:\Windows\system32\svchost.exe[2588] kernel32.dll!LoadLibraryA 770E9A96 5 Bytes JMP 00350FB2
.text C:\Windows\system32\svchost.exe[2588] kernel32.dll!GetProcAddress 77104110 5 Bytes JMP 00350F06
.text C:\Windows\system32\svchost.exe[2588] kernel32.dll!CreateFileW 7710866C 5 Bytes JMP 0035000A
.text C:\Windows\system32\svchost.exe[2588] kernel32.dll!CreateFileA 77108CA4 5 Bytes JMP 00350FEF
.text C:\Windows\system32\svchost.exe[2588] msvcrt.dll!_open 7672A890 5 Bytes JMP 0033000C
.text C:\Windows\system32\svchost.exe[2588] msvcrt.dll!_wsystem 7675AA4F 2 Bytes JMP 00330044
.text C:\Windows\system32\svchost.exe[2588] msvcrt.dll!_wsystem + 3 7675AA52 2 Bytes [BD, 89]
.text C:\Windows\system32\svchost.exe[2588] msvcrt.dll!system 7675AB6B 5 Bytes JMP 00330FC3
.text C:\Windows\system32\svchost.exe[2588] msvcrt.dll!_creat 7675E711 5 Bytes JMP 00330FEF
.text C:\Windows\system32\svchost.exe[2588] msvcrt.dll!_wcreat 7675F9C6 5 Bytes JMP 00330FDE
.text C:\Windows\system32\svchost.exe[2588] msvcrt.dll!_wopen 7675FBA1 5 Bytes JMP 00330029
.text C:\Windows\system32\svchost.exe[2588] ADVAPI32.dll!RegCreateKeyW 76EF8229 5 Bytes JMP 00340FAD
.text C:\Windows\system32\svchost.exe[2588] ADVAPI32.dll!RegCreateKeyExA 76F03941 5 Bytes JMP 00340F92
.text C:\Windows\system32\svchost.exe[2588] ADVAPI32.dll!RegCreateKeyA 76F03B9F 5 Bytes JMP 00340038
.text C:\Windows\system32\svchost.exe[2588] ADVAPI32.dll!RegCreateKeyExW 76F104A2 5 Bytes JMP 00340F81
.text C:\Windows\system32\svchost.exe[2588] ADVAPI32.dll!RegOpenKeyExA 76F10DDF 5 Bytes JMP 00340FC8
.text C:\Windows\system32\svchost.exe[2588] ADVAPI32.dll!RegOpenKeyW 76F17B8D 5 Bytes JMP 00340FE5
.text C:\Windows\system32\svchost.exe[2588] ADVAPI32.dll!RegOpenKeyA 76F1EAEA 5 Bytes JMP 00340000
.text C:\Windows\system32\svchost.exe[2588] ADVAPI32.dll!RegOpenKeyExW 76F25ECD 5 Bytes JMP 0034001B
.text C:\Windows\system32\svchost.exe[2588] WS2_32.dll!socket 766D4358 5 Bytes JMP 0032000A
.text C:\Windows\System32\svchost.exe[2872] kernel32.dll!VirtualProtect 770C18BF 5 Bytes JMP 00070F77
.text C:\Windows\System32\svchost.exe[2872] kernel32.dll!GetStartupInfoW 770C191A 5 Bytes JMP 00070F26
.text C:\Windows\System32\svchost.exe[2872] kernel32.dll!GetStartupInfoA 770C19B8 5 Bytes JMP 0007006C
.text C:\Windows\System32\svchost.exe[2872] kernel32.dll!CreateProcessW 770C1D27 5 Bytes JMP 00070EF0
.text C:\Windows\System32\svchost.exe[2872] kernel32.dll!CreateProcessA 770C1D5C 5 Bytes JMP 00070F01
.text C:\Windows\System32\svchost.exe[2872] kernel32.dll!CreateNamedPipeA 770C2484 5 Bytes JMP 00070FDE
.text C:\Windows\System32\svchost.exe[2872] kernel32.dll!WinExec 770C32DF 5 Bytes JMP 0007007D
.text C:\Windows\System32\svchost.exe[2872] kernel32.dll!CreateNamedPipeW 770CEDFE 5 Bytes JMP 00070FC3
.text C:\Windows\System32\svchost.exe[2872] kernel32.dll!CreatePipe 770DB0AF 5 Bytes JMP 00070F41
.text C:\Windows\System32\svchost.exe[2872] kernel32.dll!VirtualProtectEx 770E60AB 5 Bytes JMP 00070F5C
.text C:\Windows\System32\svchost.exe[2872] kernel32.dll!LoadLibraryExW 770E95A7 5 Bytes JMP 0007005B
.text C:\Windows\System32\svchost.exe[2872] kernel32.dll!LoadLibraryW 770E971F 5 Bytes JMP 00070FA8
.text C:\Windows\System32\svchost.exe[2872] kernel32.dll!LoadLibraryExA 770E9A6E 5 Bytes JMP 0007004A
.text C:\Windows\System32\svchost.exe[2872] kernel32.dll!LoadLibraryA 770E9A96 5 Bytes JMP 00070039
.text C:\Windows\System32\svchost.exe[2872] kernel32.dll!GetProcAddress 77104110 5 Bytes JMP 00070ED5
.text C:\Windows\System32\svchost.exe[2872] kernel32.dll!CreateFileW 7710866C 5 Bytes JMP 0007000A
.text C:\Windows\System32\svchost.exe[2872] kernel32.dll!CreateFileA 77108CA4 5 Bytes JMP 00070FEF
.text C:\Windows\System32\svchost.exe[2872] msvcrt.dll!_open 7672A890 5 Bytes JMP 00050FEF
.text C:\Windows\System32\svchost.exe[2872] msvcrt.dll!_wsystem 7675AA4F 2 Bytes JMP 00050033
.text C:\Windows\System32\svchost.exe[2872] msvcrt.dll!_wsystem + 3 7675AA52 2 Bytes [8F, 89]
.text C:\Windows\System32\svchost.exe[2872] msvcrt.dll!system 7675AB6B 5 Bytes JMP 00050FA8
.text C:\Windows\System32\svchost.exe[2872] msvcrt.dll!_creat 7675E711 5 Bytes JMP 00050022
.text C:\Windows\System32\svchost.exe[2872] msvcrt.dll!_wcreat 7675F9C6 5 Bytes JMP 00050FC3
.text C:\Windows\System32\svchost.exe[2872] msvcrt.dll!_wopen 7675FBA1 5 Bytes JMP 00050FDE
.text C:\Windows\System32\svchost.exe[2872] ADVAPI32.dll!RegCreateKeyW 76EF8229 5 Bytes JMP 00060FBC
.text C:\Windows\System32\svchost.exe[2872] ADVAPI32.dll!RegCreateKeyExA 76F03941 5 Bytes JMP 00060F9F
.text C:\Windows\System32\svchost.exe[2872] ADVAPI32.dll!RegCreateKeyA 76F03B9F 5 Bytes JMP 00060FCD
.text C:\Windows\System32\svchost.exe[2872] ADVAPI32.dll!RegCreateKeyExW 76F104A2 5 Bytes JMP 00060F8E
.text C:\Windows\System32\svchost.exe[2872] ADVAPI32.dll!RegOpenKeyExA 76F10DDF 5 Bytes JMP 00060031
.text C:\Windows\System32\svchost.exe[2872] ADVAPI32.dll!RegOpenKeyW 76F17B8D 5 Bytes JMP 0006000A
.text C:\Windows\System32\svchost.exe[2872] ADVAPI32.dll!RegOpenKeyA 76F1EAEA 5 Bytes JMP 00060FEF
.text C:\Windows\System32\svchost.exe[2872] ADVAPI32.dll!RegOpenKeyExW 76F25ECD 5 Bytes JMP 00060FDE
.text C:\Windows\Explorer.EXE[3416] kernel32.dll!VirtualProtect 770C18BF 5 Bytes JMP 00E1007D
.text C:\Windows\Explorer.EXE[3416] kernel32.dll!GetStartupInfoW 770C191A 5 Bytes JMP 00E10F48
.text C:\Windows\Explorer.EXE[3416] kernel32.dll!GetStartupInfoA 770C19B8 5 Bytes JMP 00E10F63
.text C:\Windows\Explorer.EXE[3416] kernel32.dll!CreateProcessW 770C1D27 5 Bytes JMP 00E10F01
.text C:\Windows\Explorer.EXE[3416] kernel32.dll!CreateProcessA 770C1D5C 5 Bytes JMP 00E10F12
.text C:\Windows\Explorer.EXE[3416] kernel32.dll!CreateNamedPipeA 770C2484 5 Bytes JMP 00E1002F
.text C:\Windows\Explorer.EXE[3416] kernel32.dll!WinExec 770C32DF 5 Bytes JMP 00E10F37
.text C:\Windows\Explorer.EXE[3416] kernel32.dll!CreateNamedPipeW 770CEDFE 5 Bytes JMP 00E10FDE
.text C:\Windows\Explorer.EXE[3416] kernel32.dll!CreatePipe 770DB0AF 5 Bytes JMP 00E1008E
.text C:\Windows\Explorer.EXE[3416] kernel32.dll!VirtualProtectEx 770E60AB 5 Bytes JMP 00E10F88
.text C:\Windows\Explorer.EXE[3416] kernel32.dll!LoadLibraryExW 770E95A7 5 Bytes JMP 00E1006C
.text C:\Windows\Explorer.EXE[3416] kernel32.dll!LoadLibraryW 770E971F 5 Bytes JMP 00E10040
.text C:\Windows\Explorer.EXE[3416] kernel32.dll!LoadLibraryExA 770E9A6E 5 Bytes JMP 00E1005B
.text C:\Windows\Explorer.EXE[3416] kernel32.dll!LoadLibraryA 770E9A96 5 Bytes JMP 00E10FC3
.text C:\Windows\Explorer.EXE[3416] kernel32.dll!GetProcAddress 77104110 5 Bytes JMP 00E10EF0
.text C:\Windows\Explorer.EXE[3416] kernel32.dll!CreateFileW 7710866C 5 Bytes JMP 00E10014
.text C:\Windows\Explorer.EXE[3416] kernel32.dll!CreateFileA 77108CA4 5 Bytes JMP 00E10FEF
.text C:\Windows\Explorer.EXE[3416] ADVAPI32.dll!RegCreateKeyW 76EF8229 5 Bytes JMP 00E00F90
.text C:\Windows\Explorer.EXE[3416] ADVAPI32.dll!RegCreateKeyExA 76F03941 5 Bytes JMP 00E00F7F
.text C:\Windows\Explorer.EXE[3416] ADVAPI32.dll!RegCreateKeyA 76F03B9F 5 Bytes JMP 00E00FAB
.text C:\Windows\Explorer.EXE[3416] ADVAPI32.dll!RegCreateKeyExW 76F104A2 5 Bytes JMP 00E00042
.text C:\Windows\Explorer.EXE[3416] ADVAPI32.dll!RegOpenKeyExA 76F10DDF 5 Bytes JMP 00E00FCD
.text C:\Windows\Explorer.EXE[3416] ADVAPI32.dll!RegOpenKeyW 76F17B8D 5 Bytes JMP 00E00FDE
.text C:\Windows\Explorer.EXE[3416] ADVAPI32.dll!RegOpenKeyA 76F1EAEA 5 Bytes JMP 00E00FEF
.text C:\Windows\Explorer.EXE[3416] ADVAPI32.dll!RegOpenKeyExW 76F25ECD 5 Bytes JMP 00E00FBC
.text C:\Windows\Explorer.EXE[3416] msvcrt.dll!_open 7672A890 5 Bytes JMP 00DF000C
.text C:\Windows\Explorer.EXE[3416] msvcrt.dll!_wsystem 7675AA4F 5 Bytes JMP 00DF0F9C
.text C:\Windows\Explorer.EXE[3416] msvcrt.dll!system 7675AB6B 5 Bytes JMP 00DF0FB7
.text C:\Windows\Explorer.EXE[3416] msvcrt.dll!_creat 7675E711 5 Bytes JMP 00DF0FE3
.text C:\Windows\Explorer.EXE[3416] msvcrt.dll!_wcreat 7675F9C6 5 Bytes JMP 00DF0FC8
.text C:\Windows\Explorer.EXE[3416] msvcrt.dll!_wopen 7675FBA1 5 Bytes JMP 00DF001D
.text C:\Windows\Explorer.EXE[3416] WS2_32.dll!socket 766D4358 5 Bytes JMP 004D0000
.text C:\Windows\Explorer.EXE[3416] WININET.dll!InternetOpenA 76A43081 5 Bytes JMP 02B6000A
.text C:\Windows\Explorer.EXE[3416] WININET.dll!InternetOpenW 76A436B1 5 Bytes JMP 02B6001B
.text C:\Windows\Explorer.EXE[3416] WININET.dll!InternetOpenUrlA 76A46F5A 5 Bytes JMP 02B60FEF
.text C:\Windows\Explorer.EXE[3416] WININET.dll!InternetOpenUrlW 76A88439 5 Bytes JMP 02B60FD4
.text C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe[3484] ntdll.dll!DbgBreakPoint 77D32EA8 1 Byte [90]

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \Driver\tdx \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\tdx \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\tdx \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

—- EOF - GMER 1.0.15 —-

oldman960

Post #10December 15, 2009, 7:29 AM UTC

Hi dwoods912,

Good and even better, no rootkit.

[2009/01/31 18:59:09 | 00,000,000 | —D | M] – C:\Users\***\AppData\Roaming\Mozilla\Firefox\extensions <—–???? (don't think i ever installed Mozilla)
[2009/01/31 18:59:09 | 00,000,000 | —D | M] (No name found) – C:\Users\***\AppData\Roaming\Mozilla\Firefox\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}

Meant to comment on your comment earlier,
{E9A1DEE0-C623-4439-8932-001E7D17607D} - for Firefox as extension (whether FF is installed or not, this key will be created and the installer with Ask will create Mozilla Firefox folder if Firefox is not installed) ajtoolbar.jar

After this next scan I'll have you post a new OTL log and see if the uninstaller removed this along with the Ask Toolbar if you have uninstalled it.

Download and save to your desktop Malwarebytes Anti-Malware

Right Click mbam-setup.exe and select "Run as Adminisrator" to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Next

Right click on OTL.exe and select "Run as Administrator" to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
UNcheck the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

Please post back with

MBAM log
new OTL log

Thanks

oldman960

Post #11December 18, 2009, 11:35 PM UTC

Hi dwoods912, You still wiith us? Thanks

oldman960

Post #12December 20, 2009, 10:56 AM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread.

dwoods912

Post #13January 15, 2010, 7:17 PM UTC

i had a thread going with oldtimer but i left for christmas vacation and came back to diferent issues
thought it best to post new

THANK YOU FOR YOUR HELP

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:57:41 PM, on 1/15/2010
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16945)
Boot mode: Normal

Running processes:
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\McAfee\MPS\mpsevh.exe
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Toshiba\Utilities\KeNotify.exe
C:\Program Files\McAfee\MSK\mskagent.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\SiteAdvisor\6261\SiteAdv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [HWSetup] \HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [SiteAdvisor] "C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [MRT] "C:\Windows\system32\MRT.exe" /R
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo…toUploader5.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: pinger - Unknown owner - C:\Toshiba\IVP\ISM\pinger.exe
O23 - Service: Swupdtmr - Unknown owner - c:\Toshiba\IVP\swupdate\swupdtmr.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

–
End of file - 10541 bytes

oldman960

Post #14January 15, 2010, 8:47 PM UTC

Hi dwoods912,

Please descibe the problems you are having.

Download OTL to your desktop.

Right click on OTL.exe and click "Run as Adminstrator" to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
Check the boxes beside LOP Check and Purity Check.
Copy and paste the bold text into the window under Custom Scan
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
/md5stop
%systemroot%\*. /mp /s
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Please post back with

both OTL logs

Thanks

dwoods912

Post #15January 15, 2010, 10:43 PM UTC

lot of things were changed before…windows looked like older version…different colors, etc.
I ran Malwarebytes and removed 3 things and I also removed the spyware program someone else downloaded (pctools spyware doctor or something like that)
Only problem its having lately is running slow…I want to make sure there's not any hidden surprises for me later.

Thanks for helping again Oldman

Only the OTL logfile came up after the scan

OTL logfile created on: 1/15/2010 4:29:11 PM - Run 2
OTL by OldTimer - Version 3.1.17.0 Folder = C:\Users\XXXXX\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16945)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.87 Gb Total Physical Memory | 1.06 Gb Available Physical Memory | 56.46% Memory free
3.96 Gb Paging File | 2.86 Gb Available in Paging File | 72.19% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 231.42 Gb Total Space | 108.11 Gb Free Space | 46.72% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: XXXXX
Current User Name: XXXXX
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\XXXXX\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
PRC - C:\Program Files\Internet Explorer\ieuser.exe (Microsoft Corporation)
PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple, Inc.)
PRC - C:\Program Files\Windows Mail\WinMail.exe (Microsoft Corporation)
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - c:\Program Files\McAfee\MSC\mcuimgr.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
PRC - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
PRC - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Windows\System32\Ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\Program Files\McAfee\MPS\mpsevh.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MPS\mps.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe ()
PRC - C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
PRC - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Toshiba\SmoothView\SmoothView.exe (TOSHIBA Corporation)
PRC - c:\Program Files\Common Files\McAfee\RedirSvc\RedirSvc.exe (McAfee, Inc.)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe (McAfee, Inc.)
PRC - c:\Toshiba\IVP\swupdate\swupdtmr.exe ()
PRC - C:\Toshiba\IVP\ISM\pinger.exe ()
PRC - C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
PRC - C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
PRC - C:\Program Files\McAfee\MSK\msksrver.exe (McAfee Inc.)
PRC - C:\Program Files\McAfee\MSK\mskagent.exe (McAfee Inc.)
PRC - C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
PRC - c:\Program Files\McAfee\VirusScan\mcvsshld.exe (McAfee, Inc.)
PRC - C:\Program Files\Toshiba\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Toshiba\Utilities\KeNotify.exe ()
PRC - C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Program Files\SiteAdvisor\6261\SiteAdv.exe (McAfee, Inc.)
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (ATI Technologies Inc.)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.)
PRC - C:\Program Files\Apoint2K\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint2K\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint2K\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
PRC - C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\XXXXX\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.20533_none_4634c4a0218d65c1\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (gupdate) Google Update Service (gupdate) – C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (gusvc) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (GameConsoleService) – C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (McNASvc) – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple, Inc.)
SRV - (Emproxy) – C:\Program Files\Common Files\McAfee\EmProxy\emproxy.exe (McAfee, Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (McShield) – C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV - (MpfService) – C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (GoogleDesktopManager) – C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
SRV - (TNaviSrv) – C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
SRV - (Ati External Event Utility) – C:\Windows\System32\Ati2evxx.exe (ATI Technologies Inc.)
SRV - (MPS9) – C:\Program Files\McAfee\MPS\mps.exe (McAfee, Inc.)
SRV - (McProxy) – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (TosCoSrv) – C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV - (McRedirector) – c:\Program Files\Common Files\McAfee\RedirSvc\RedirSvc.exe (McAfee, Inc.)
SRV - (TOSHIBA Bluetooth Service) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (McAfee HackerWatch Service) – C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe (McAfee, Inc.)
SRV - (Swupdtmr) – c:\Toshiba\IVP\swupdate\swupdtmr.exe ()
SRV - (pinger) – C:\Toshiba\IVP\ISM\pinger.exe ()
SRV - (McSysmon) – C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (MSK80Service) – C:\Program Files\McAfee\MSK\MskSrver.exe (McAfee Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (CFSvcs) – C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (ehstart) – C:\Windows\ehome\ehstart.dll (Microsoft Corporation)
SRV - (odserv) – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (AgereModemAudio) – C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (UleadBurningHelper) – C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
SRV - (TODDSrv) – C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)

========== Driver Services (SafeList) ==========

DRV - (USBAAPL) – C:\Windows\System32\drivers\usbaapl.sys (Apple, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfesmfk) – C:\Windows\System32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (mfehidk) – C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (tos_sps32) – C:\Windows\system32\DRIVERS\tos_sps32.sys (TOSHIBA Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (UVCFTR) – C:\Windows\System32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.)
DRV - (PxHelp20) – C:\Windows\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (MPFP) – C:\Windows\System32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (athr) – C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (tifm21) – C:\Windows\System32\drivers\tifm21.sys (Texas Instruments)
DRV - (RTL8169) – C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (secdrv) – C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (tdcmdpst) – C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (TVALZ) – C:\Windows\system32\DRIVERS\TVALZ_O.SYS (TOSHIBA Corporation)
DRV - (KR3NPXP) – C:\Windows\system32\drivers\kr3npxp.sys (TOSHIBA CORPORATION)
DRV - (GEARAspiWDM) – C:\Windows\System32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (LPCFilter) – C:\Windows\system32\DRIVERS\LPCFilter.sys (COMPAL ELECTRONIC INC.)
DRV - (KR10I) – C:\Windows\system32\drivers\kr10i.sys (TOSHIBA CORPORATION)
DRV - (KR10N) – C:\Windows\system32\drivers\kr10n.sys (TOSHIBA CORPORATION)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1

O1 HOSTS File: (761 bytes) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\Program Files\McAfee\VirusScan\scriptcl.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll ()
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll File not found
O4 - HKLM..\Run: [00TCrdMain] C:\Program Files\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [HSON] C:\Program Files\Toshiba\TBS\HSON.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [HWSetup] File not found
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [KeNotify] C:\Program Files\Toshiba\Utilities\KeNotify.exe ()
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\mskagent.exe (McAfee Inc.)
O4 - HKLM..\Run: [NDSTray.exe] File not found
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6261\SiteAdv.exe (McAfee, Inc.)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\Toshiba\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe (TOSHIBA)
O4 - HKLM..\Run: [TPwrMain] C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [TOSCDSPD] C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - Startup: C:\Users\XXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/Facebo…toUploader5.cab (Facebook Photo Uploader 5)
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} http://lads.myspace.com/upload/MySpaceUploader1006.cab (MySpace Uploader Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\siteadvisor {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll ()
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 00,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias [2006/11/02 06:18:47 | 00,000,000 | —D | M]
NetSvcs: Irmon - C:\Windows\System32\irmon.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/01/14 12:42:08 | 00,156,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\t2embed.dll
[2010/01/14 12:42:08 | 00,072,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fontsub.dll
[2010/01/14 12:42:05 | 00,289,792 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2010/01/14 12:42:05 | 00,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dciman32.dll
[2010/01/14 12:42:04 | 00,034,304 | —- | C] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2010/01/01 05:33:28 | 00,000,000 | —D | C] – C:\ProgramData\WindowsSearch
[2009/12/30 09:00:07 | 00,000,000 | —D | C] – C:\PerfLogs
[2009/12/30 07:26:38 | 00,000,000 | —D | C] – C:\5e458679a476cfb4e49c269a628439
[2009/12/30 01:21:56 | 00,000,000 | —D | C] – C:\Users\XXXXX\AppData\Local\Threat Expert
[2009/12/29 16:43:22 | 00,000,000 | —D | C] – C:\ProgramData\TEMP
[2009/12/25 22:28:35 | 00,000,000 | —D | C] – C:\Users\XXXXX\AppData\Local\igpayd

========== Files - Modified Within 30 Days ==========

[2010/01/15 16:29:02 | 02,883,584 | -HS- | M] () – C:\Users\XXXXX\ntuser.dat
[2010/01/15 16:10:57 | 00,003,456 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/01/15 16:10:57 | 00,003,456 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/01/15 15:52:11 | 00,000,904 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/01/15 13:15:17 | 00,000,900 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/01/15 13:14:18 | 00,021,232 | —- | M] () – C:\Windows\System32\Config.MPF
[2010/01/15 13:10:57 | 00,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/01/15 13:10:32 | 00,316,856 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/01/15 13:10:23 | 00,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/01/15 13:09:47 | 20,112,17920 | -HS- | M] () – C:\hiberfil.sys
[2010/01/15 13:05:05 | 04,064,876 | -H– | M] () – C:\Users\XXXXX\AppData\Local\IconCache.db
[2010/01/15 12:56:39 | 00,000,118 | —- | M] () – C:\Windows\System32\MRT.INI
[2010/01/15 12:48:13 | 00,300,640 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/01/15 12:48:13 | 00,035,276 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/01/15 12:48:10 | 00,325,760 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2009/12/30 23:08:10 | 00,524,288 | -HS- | M] () – C:\Users\XXXXX\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2009/12/30 23:08:10 | 00,065,536 | -HS- | M] () – C:\Users\XXXXX\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2009/12/29 16:42:31 | 00,092,160 | —- | M] () – C:\Users\XXXXX\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/22 05:05:18 | 00,000,008 | —- | M] () – C:\ProgramData\sysReserve.ini
[2009/12/20 05:00:31 | 00,002,084 | —- | M] () – C:\Users\Public\Desktop\Google Earth.lnk

========== Files Created - No Company Name ==========

[2010/01/15 12:56:39 | 00,000,118 | —- | C] () – C:\Windows\System32\MRT.INI
[2009/12/29 22:07:34 | 20,112,17920 | -HS- | C] () – C:\hiberfil.sys
[2009/12/22 05:05:18 | 00,000,008 | —- | C] () – C:\ProgramData\sysReserve.ini
[2009/12/20 05:00:31 | 00,002,084 | —- | C] () – C:\Users\Public\Desktop\Google Earth.lnk
[2008/12/25 12:37:22 | 00,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2008/11/19 16:36:53 | 00,021,840 | —- | C] () – C:\Windows\System32\SIntfNT.dll
[2008/11/19 16:36:53 | 00,017,212 | —- | C] () – C:\Windows\System32\SIntf32.dll
[2008/11/19 16:36:53 | 00,012,067 | —- | C] () – C:\Windows\System32\SIntf16.dll
[2008/07/23 11:50:52 | 03,596,288 | —- | C] () – C:\Windows\System32\qt-dx331.dll
[2008/07/23 11:47:34 | 00,000,416 | —- | C] () – C:\Windows\System32\dtu100.dll.manifest
[2008/07/23 11:47:34 | 00,000,416 | —- | C] () – C:\Windows\System32\dpl100.dll.manifest
[2008/07/23 11:46:38 | 00,012,288 | —- | C] () – C:\Windows\System32\DivXWMPExtType.dll
[2008/06/13 11:34:39 | 00,010,240 | —- | C] () – C:\Windows\System32\vidx16.dll
[2008/01/09 23:43:44 | 00,765,952 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2008/01/09 23:43:43 | 00,180,224 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2007/10/02 03:45:19 | 00,037,720 | —- | C] () – C:\Users\XXXXX\AppData\Roaming\wklnhst.dat
[2007/09/26 15:33:33 | 00,092,160 | —- | C] () – C:\Users\XXXXX\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/05/16 20:46:23 | 00,524,288 | -HS- | C] () – C:\ProgramData\ntuser.dat{0a1e0bf4-0416-11dc-9bb7-0016d4f84854}.TMContainer00000000000000000002.regtrans-ms
[2007/05/16 20:46:23 | 00,524,288 | -HS- | C] () – C:\ProgramData\ntuser.dat{0a1e0bf4-0416-11dc-9bb7-0016d4f84854}.TMContainer00000000000000000001.regtrans-ms
[2007/05/16 20:46:23 | 00,065,536 | -HS- | C] () – C:\ProgramData\ntuser.dat{0a1e0bf4-0416-11dc-9bb7-0016d4f84854}.TM.blf
[2007/05/16 20:46:22 | 00,524,288 | -HS- | C] () – C:\ProgramData\ntuser.dat{0a1e0be4-0416-11dc-9bb7-0016d4f84854}.TMContainer00000000000000000002.regtrans-ms
[2007/05/16 20:46:22 | 00,524,288 | -HS- | C] () – C:\ProgramData\ntuser.dat{0a1e0be4-0416-11dc-9bb7-0016d4f84854}.TMContainer00000000000000000001.regtrans-ms
[2007/05/16 20:46:22 | 00,065,536 | -HS- | C] () – C:\ProgramData\ntuser.dat{0a1e0be4-0416-11dc-9bb7-0016d4f84854}.TM.blf
[2007/05/16 20:46:21 | 00,262,144 | —- | C] () – C:\ProgramData\ntuser.dat
[2007/05/16 20:46:21 | 00,005,120 | -H– | C] () – C:\ProgramData\ntuser.dat.LOG1
[2007/05/16 20:46:21 | 00,000,000 | -H– | C] () – C:\ProgramData\ntuser.dat.LOG2
[2007/05/16 20:40:56 | 00,204,800 | —- | C] () – C:\Windows\System32\IVIresizeW7.dll
[2007/05/16 20:40:55 | 00,200,704 | —- | C] () – C:\Windows\System32\IVIresizeA6.dll
[2007/05/16 20:40:55 | 00,192,512 | —- | C] () – C:\Windows\System32\IVIresizeP6.dll
[2007/05/16 20:40:55 | 00,192,512 | —- | C] () – C:\Windows\System32\IVIresizeM6.dll
[2007/05/16 20:40:55 | 00,188,416 | —- | C] () – C:\Windows\System32\IVIresizePX.dll
[2007/05/16 20:40:55 | 00,020,480 | —- | C] () – C:\Windows\System32\IVIresize.dll
[2007/05/16 19:46:42 | 00,000,000 | —- | C] () – C:\Windows\NDSTray.INI
[2007/05/16 19:30:13 | 00,036,864 | —- | C] () – C:\Windows\System32\HWS_Ctrl.dll
[2007/05/16 19:15:16 | 00,128,113 | —- | C] () – C:\Windows\System32\csellang.ini
[2007/05/16 19:15:16 | 00,045,056 | —- | C] () – C:\Windows\System32\csellang.dll
[2007/05/16 19:15:16 | 00,010,150 | —- | C] () – C:\Windows\System32\tosmreg.ini
[2007/05/16 19:15:16 | 00,007,671 | —- | C] () – C:\Windows\System32\cseltbl.ini
[2007/05/16 19:13:14 | 00,000,291 | —- | C] () – C:\Windows\RtDefLvl.ini
[2007/04/24 23:57:36 | 00,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/12/05 15:05:06 | 00,114,688 | —- | C] () – C:\Windows\System32\TosBtAcc.dll
[2006/11/02 07:35:32 | 00,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 02:40:29 | 00,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2005/11/23 16:55:42 | 00,024,576 | —- | C] () – C:\Windows\System32\SPCtl.dll
[2005/07/22 23:30:20 | 00,065,536 | —- | C] () – C:\Windows\System32\TosCommAPI.dll

========== LOP Check ==========

[2007/10/01 00:48:44 | 00,000,000 | —D | M] – C:\Users\XXXXX\AppData\Roaming\acccore
[2009/12/20 21:49:13 | 00,000,000 | —D | M] – C:\Users\XXXXX\AppData\Roaming\LimeWire
[2007/10/02 03:45:21 | 00,000,000 | —D | M] – C:\Users\XXXXX\AppData\Roaming\Template
[2007/10/24 12:56:29 | 00,000,000 | —D | M] – C:\Users\XXXXX\AppData\Roaming\TOSHIBA
[2007/12/18 08:48:09 | 00,000,000 | —D | M] – C:\Users\XXXXX\AppData\Roaming\Ulead Systems
[2009/12/07 19:17:41 | 00,000,000 | —D | M] – C:\Users\XXXXX\AppData\Roaming\uTorrent
[2007/09/27 14:17:51 | 00,000,000 | —D | M] – C:\Users\XXXXX\AppData\Roaming\WildTangent
[2009/12/15 12:47:23 | 00,000,342 | —- | M] () – C:\Windows\Tasks\McDefragTask.job
[2009/11/01 00:00:15 | 00,000,334 | —- | M] () – C:\Windows\Tasks\McQcTask.job
[2010/01/15 13:05:26 | 00,032,546 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2008/01/19 02:42:25 | 00,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2006/11/02 04:49:52 | 00,053,864 | —- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 – C:\Windows\System32\drivers\AGP440.sys
[2006/11/02 04:49:52 | 00,053,864 | —- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009/04/11 01:32:26 | 00,019,944 | —- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 – C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008/01/19 02:41:30 | 00,021,560 | —- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 – C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/02 04:49:36 | 00,019,048 | —- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008/02/15 03:10:53 | 00,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\System32\drivers\atapi.sys
[2008/02/15 03:10:53 | 00,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008/02/15 03:10:53 | 00,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008/02/15 03:10:51 | 00,021,560 | —- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 04:46:03 | 00,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\System32\cngaudit.dll
[2006/11/02 04:46:03 | 00,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: IASTORV.SYS >
[2008/01/19 02:42:51 | 00,235,064 | —- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 – C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006/11/02 04:51:25 | 00,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\drivers\iaStorV.sys
[2006/11/02 04:51:25 | 00,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: KR10N.SYS >
[2005/09/27 18:57:00 | 00,207,104 | —- | M] (TOSHIBA CORPORATION) MD5=A1963360E74931222A67356C8AD48378 – C:\Windows\System32\drivers\KR10N.sys
[2005/09/27 18:57:00 | 00,207,104 | —- | M] (TOSHIBA CORPORATION) MD5=A1963360E74931222A67356C8AD48378 – C:\Windows\System32\DriverStore\FileRepository\kr10n.inf_f8c77270\KR10N.sys

< MD5 for: NETLOGON.DLL >
[2006/11/02 04:46:11 | 00,559,616 | —- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B – C:\Windows\System32\netlogon.dll
[2006/11/02 04:46:11 | 00,559,616 | —- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009/04/11 01:28:23 | 00,592,896 | —- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE – C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008/01/19 02:35:36 | 00,592,384 | —- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F – C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2006/11/02 04:50:13 | 00,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\drivers\nvstor.sys
[2006/11/02 04:50:13 | 00,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008/01/19 02:42:09 | 00,045,112 | —- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 – C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: SCECLI.DLL >
[2008/01/19 02:36:19 | 00,177,152 | —- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 – C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006/11/02 04:46:12 | 00,176,640 | —- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 – C:\Windows\System32\scecli.dll
[2006/11/02 04:46:12 | 00,176,640 | —- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009/04/11 01:28:24 | 00,177,152 | —- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 – C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

< %systemroot%\*. /mp /s >

========== Alternate Data Streams ==========

@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:A8ADE5D8
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:DFC5A2B2
< End of report >

[Resolved] got rid of fake security updates...now running really slow

✨ Ask AI

Ask AI