What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Infection?

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi,

The infections found by ESET is a false positive.

Let's try this:
Please download mbr.exe and save it to your root directory, usually C:\ <- (Important!).

  • Go to Start > Run and type: cmd.exe
  • press Ok.
  • At the command prompt type: c:\mbr.exe -t >>"C:\mbr.log"
  • press Enter.
  • A "DOS" box will open and quickly disappear. That is normal.
  • A log file named mbr.log will be created and saved to the root of the system drive (usually C:\).
  • Copy and paste the results of the mbr.log in your next reply.
Post #17
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: error reading MBR

I got "Access is denied" after I pressed Enter in the command box.


-Michael-
Post #18
Hi, It seems that there are no more malware showing in your computer but just to be sure, please run OTL again for me please then post the log. Also, please describe how your computer is doing at the moment. Thank you.
Post #19
OTL logfile created on: 3/9/2010 10:53:26 PM - Run 3
OTL by OldTimer - Version 3.1.30.2 Folder = C:\Users\Mike\Desktop
64bit-Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18882)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

6.00 Gb Total Physical Memory | 4.00 Gb Available Physical Memory | 70.00% Memory free
12.00 Gb Paging File | 10.00 Gb Available in Paging File | 83.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931.51 Gb Total Space | 727.52 Gb Free Space | 78.10% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MIKE-PC
Current User Name: Mike
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Mike\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe (Google Inc.)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10e.exe (Adobe Systems, Inc.)
PRC - C:\Program Files (x86)\Curse\CurseClient.exe ()
PRC - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files (x86)\EVGA Precision\Bundle\OSDServer\RTSS.exe ()
PRC - C:\Program Files (x86)\EVGA Precision\EVGAPrecision.exe ()
PRC - C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Program Files (x86)\Google\Quick Search Box\GoogleQuickSearchBox.exe (Google Inc.)
PRC - C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe ()
PRC - C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Users\Mike\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files (x86)\EVGA Precision\Bundle\OSDServer\RTSSHooks.dll ()
MOD - C:\Windows\SysWOW64\comdlg32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV:64bit: - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV:64bit: - (FontCache) – C:\Windows\SysNative\FntCache.dll (Microsoft Corporation)
SRV:64bit: - (LBTServ) – C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV:64bit: - (UmRdpService) – C:\Windows\SysNative\umrdp.dll (Microsoft Corporation)
SRV:64bit: - (CscService) – C:\Windows\SysNative\cscsvc.dll (Microsoft Corporation)
SRV:64bit: - (wbengine) – C:\Windows\SysNative\wbengine.exe (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) – C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (Fax) – C:\Windows\SysNative\fxssvc.exe (Microsoft Corporation)
SRV - (Stereo Service) – C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (gupdate) Google Update Service (gupdate) – C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (avg9emc) – C:\Program Files (x86)\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg9wd) – C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (IntuitUpdateService) – C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
SRV - (Apple Mobile Device) – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (gusvc) – C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (clr_optimization_v2.0.50727_64) – C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (MSDTC) – C:\Windows\SysWOW64\Msdtc [2006/11/02 07:34:14 | 000,000,000 | —D | M]
SRV - (vds) – C:\Windows\SysWOW64\wbem\vds.mof ()
SRV - (VSS) – C:\Windows\SysWOW64\wbem\vss.mof ()


========== Driver Services (SafeList) ==========

DRV:64bit: - (AvgTdiA) – C:\Windows\SysNative\Drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (AvgMfx64) – C:\Windows\SysNative\Drivers\avgmfx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (AvgLdx64) – C:\Windows\SysNative\Drivers\avgldx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (WpdUsb) – C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation)
DRV:64bit: - (LMouFilt) – C:\Windows\SysNative\DRIVERS\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LHidFilt) – C:\Windows\SysNative\DRIVERS\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (L8042Kbd) – C:\Windows\SysNative\DRIVERS\L8042Kbd.sys (Logitech, Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (fvevol) – C:\Windows\SysNative\DRIVERS\fvevol.sys (Microsoft Corporation)
DRV:64bit: - (HdAudAddService) – C:\Windows\SysNative\drivers\HdAudio.sys (Microsoft Corporation)
DRV:64bit: - (CSC) – C:\Windows\SysNative\drivers\csc.sys (Microsoft Corporation)
DRV:64bit: - (RTL8169) – C:\Windows\SysNative\DRIVERS\Rtlh64.sys (Realtek Corporation )
DRV - (SASDIFSV) – C:\Program Files (x86)\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM) – C:\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (RTCore64) – C:\Program Files (x86)\EVGA Precision\RTCore64.sys ()
DRV - (CSC) – C:\Windows\CSC [2009/08/08 13:11:36 | 000,000,000 | —D | M]
DRV - (mpsdrv) – C:\Windows\SysWOW64\wbem\mpsdrv.mof ()
DRV - (Tcpip) – C:\Windows\SysWOW64\wbem\tcpip.mof ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = BF BF 23 BB 2E AC CA 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



O1 HOSTS File: ([2006/09/18 15:37:24 | 000,000,761 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg64.dll (Google Inc.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll ()
O4:64bit: - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [EVGAPrecision] C:\Program Files (x86)\EVGA Precision\EVGAPrecisionWrapper.exe ()
O4 - HKLM..\Run: [Google Quick Search Box] C:\Program Files (x86)\Google\Quick Search Box\GoogleQuickSearchBox.exe (Google Inc.)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKCU..\Run: [CurseClient] C:\Program Files (x86)\Curse\CurseClient.exe ()
O4 - HKCU..\Run: [igndlm.exe] C:\Program Files (x86)\Download Manager\DLM.exe (IGN Entertainment)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe File not found
O4 - Startup: C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O8:64bit: - Extra context menu item: Google Sidewiki… - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll (Google Inc.)
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll (Google Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKCU\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} http://www.superadblocker.com/activex/sabspx.cab (SABScanProcesses Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed]
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20:64bit: - AppInit_DLLs: (avgrssta.dll) - C:\Windows\SysNative\avgrssta.dll (AVG Technologies CZ, s.r.o.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Users\Mike\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Mike\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files (x86)\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
64bit: O35 - comfile [open] – "%1" %* File not found
64bit: O35 - exefile [open] – "%1" %* File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/03/09 18:01:13 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\httpapi.dll
[2010/03/09 18:01:13 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\nshhttp.dll
[2010/03/09 18:01:13 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\httpapi.dll
[2010/03/09 18:01:13 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\nshhttp.dll
[2010/03/08 17:08:07 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2010/03/07 13:43:53 | 000,000,000 | —D | C] – C:\Users\Mike\AppData\Local\Walmart MP3 Music Downloads
[2010/03/07 13:43:52 | 000,000,000 | —D | C] – C:\Program Files (x86)\Walmart MP3 Music Downloads
[2010/03/03 22:32:12 | 006,279,784 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvwgf2umx.dll
[2010/03/03 22:32:12 | 004,503,144 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvwgf2um.dll
[2010/03/03 22:32:12 | 000,068,200 | —- | C] (Khronos Group) – C:\Windows\SysWow64\OpenCL.dll
[2010/03/03 22:32:12 | 000,065,640 | —- | C] (Khronos Group) – C:\Windows\SysNative\OpenCL.dll
[2010/03/03 22:32:12 | 000,011,240 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\drivers\nvBridge.kmd
[2010/03/03 22:32:11 | 021,005,416 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvoglv64.dll
[2010/03/03 22:32:11 | 015,227,496 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvoglv32.dll
[2010/03/03 22:32:09 | 002,106,472 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvid.dll
[2010/03/03 22:32:09 | 002,009,704 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvid.dll
[2010/03/03 22:32:07 | 011,647,592 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcompiler.dll
[2010/03/03 22:32:07 | 005,444,200 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuda.dll
[2010/03/03 22:32:07 | 004,029,544 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuda.dll
[2010/03/03 22:32:07 | 002,893,416 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvenc.dll
[2010/03/03 22:32:07 | 002,646,632 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvenc.dll
[2010/03/03 22:32:05 | 016,061,032 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcompiler.dll
[2010/03/03 22:32:05 | 000,235,624 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcod196.dll
[2010/03/03 22:32:05 | 000,235,624 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcod.dll
[2010/03/01 21:39:03 | 000,000,000 | —D | C] – C:\Rooter$
[2010/03/01 21:37:52 | 000,173,119 | —- | C] (Eric_71) – C:\Users\Mike\Desktop\Rooter.exe
[2010/02/28 10:07:36 | 000,000,000 | —D | C] – C:\_OTL
[2010/02/28 09:59:44 | 000,472,064 | —- | C] ( ) – C:\Users\Mike\Desktop\RootRepeal.exe
[2010/02/24 21:32:58 | 000,549,888 | —- | C] (OldTimer Tools) – C:\Users\Mike\Desktop\OTL.exe
[2010/02/24 21:26:27 | 000,000,000 | —D | C] – C:\Users\Mike\Documents\OneNote Notebooks
[2010/02/23 23:37:26 | 000,000,000 | —D | C] – C:\Program Files (x86)\Trend Micro
[2010/02/23 23:37:10 | 000,812,344 | —- | C] (Trend Micro Inc.) – C:\Users\Mike\Desktop\HijackThisInstaller.exe
[2010/02/23 23:11:31 | 000,000,000 | —D | C] – C:\Program Files (x86)\TrendMicro
[2010/02/23 22:41:19 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Adobe
[2010/02/23 22:41:19 | 000,000,000 | —D | C] – C:\Program Files (x86)\Adobe
[2010/02/23 16:59:41 | 000,817,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2010/02/23 16:59:40 | 000,726,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2010/02/23 16:59:26 | 000,471,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\secproc_isv.dll
[2010/02/23 16:59:26 | 000,471,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\secproc.dll
[2010/02/23 16:59:24 | 000,538,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\secproc_isv.dll
[2010/02/23 16:59:19 | 000,539,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\secproc.dll
[2010/02/23 16:59:18 | 000,600,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RMActivate_isv.exe
[2010/02/23 16:59:18 | 000,599,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RMActivate.exe
[2010/02/23 16:59:18 | 000,409,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RMActivate_ssp.exe
[2010/02/23 16:59:17 | 000,413,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RMActivate_ssp_isv.exe
[2010/02/23 16:59:16 | 000,526,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RMActivate_isv.exe
[2010/02/23 16:59:14 | 000,518,144 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RMActivate.exe
[2010/02/23 16:59:14 | 000,460,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msdrm.dll
[2010/02/23 16:59:14 | 000,347,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RMActivate_ssp.exe
[2010/02/23 16:59:14 | 000,346,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RMActivate_ssp_isv.exe
[2010/02/23 16:59:14 | 000,332,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msdrm.dll
[2010/02/23 16:59:14 | 000,160,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\secproc_ssp_isv.dll
[2010/02/23 16:59:14 | 000,160,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\secproc_ssp.dll
[2010/02/23 16:59:14 | 000,152,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\secproc_ssp_isv.dll
[2010/02/23 16:59:14 | 000,152,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\secproc_ssp.dll
[2010/02/23 16:57:29 | 004,240,384 | —- | C] (Microsoft) – C:\Windows\SysWow64\GameUXLegacyGDFs.dll
[2010/02/23 16:57:29 | 004,240,384 | —- | C] (Microsoft) – C:\Windows\SysNative\GameUXLegacyGDFs.dll
[2010/02/23 16:57:29 | 001,927,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\gameux.dll
[2010/02/23 16:57:29 | 001,696,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\gameux.dll
[2010/02/23 16:57:29 | 000,032,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\Apphlpdm.dll
[2010/02/23 16:57:29 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\Apphlpdm.dll
[2010/02/23 16:51:30 | 004,698,184 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl.exe
[2010/02/22 00:55:00 | 014,828,648 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcpl.dll
[2010/02/22 00:55:00 | 001,067,624 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvsvc64.dll
[2010/02/22 00:55:00 | 000,116,328 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvmctray.dll
[2010/02/21 15:07:11 | 000,000,000 | —D | C] – C:\Windows\SysNative\appmgmt
[2010/02/21 14:55:49 | 001,840,232 | —- | C] (Trend Micro) – C:\Users\Mike\Desktop\HousecallLauncher.exe
[2010/02/21 14:51:17 | 000,157,712 | —- | C] (Trend Micro Inc.) – C:\Windows\SysWow64\drivers\tmcomm.sys
[2010/02/21 14:50:35 | 000,532,480 | —- | C] (Trend Micro Incorporated) – C:\Users\Mike\Desktop\cwshredder.exe
[2010/02/18 23:42:00 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2010/02/18 23:41:49 | 000,000,000 | —D | C] – C:\Users\Mike\AppData\Roaming\SUPERAntiSpyware.com
[2010/02/18 23:41:49 | 000,000,000 | —D | C] – C:\Program Files (x86)\SUPERAntiSpyware
[2010/02/14 22:18:33 | 000,000,000 | —D | C] – C:\Users\Mike\AppData\Roaming\Apple Computer
[2010/02/14 22:18:33 | 000,000,000 | —D | C] – C:\Users\Mike\AppData\Local\Apple Computer
[2010/02/14 22:17:47 | 000,107,368 | —- | C] (GEAR Software Inc.) – C:\Windows\SysWow64\GEARAspi.dll
[2010/02/14 22:17:46 | 000,126,312 | —- | C] (GEAR Software Inc.) – C:\Windows\SysNative\GEARAspi64.dll
[2010/02/14 22:17:18 | 000,034,152 | —- | C] (GEAR Software Inc.) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys
[2010/02/14 22:17:15 | 000,000,000 | —D | C] – C:\Windows\SysNative\DRVSTORE
[2010/02/14 22:16:00 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/02/14 22:15:59 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2010/02/14 22:15:59 | 000,000,000 | —D | C] – C:\ProgramData\{0DD0EEEE-2A7C-411C-9243-1AE62F445FC3}
[2010/02/14 22:15:55 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/02/14 22:13:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\QuickTime
[2010/02/14 22:13:55 | 000,000,000 | —D | C] – C:\ProgramData\Apple Computer
[2010/02/14 22:13:36 | 000,000,000 | —D | C] – C:\Users\Mike\AppData\Local\Apple
[2010/02/14 22:12:28 | 000,000,000 | —D | C] – C:\Program Files (x86)\Apple Software Update
[2010/02/14 22:09:11 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Apple
[2010/02/14 22:08:53 | 000,000,000 | —D | C] – C:\ProgramData\Apple
[2010/02/14 22:08:53 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Apple
[2010/02/10 21:25:57 | 001,570,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\quartz.dll
[2010/02/10 21:25:57 | 001,314,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\quartz.dll
[2010/02/10 21:25:57 | 000,123,904 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msvfw32.dll
[2010/02/10 21:25:57 | 000,091,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\avifil32.dll
[2010/02/10 21:25:57 | 000,082,944 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mciavi32.dll
[2010/02/10 21:25:57 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iyuv_32.dll
[2010/02/10 21:25:57 | 000,038,400 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msvidc32.dll
[2010/02/10 21:25:57 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msyuv.dll
[2010/02/10 21:25:57 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msrle32.dll
[2010/02/10 21:25:57 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tsbyuv.dll

========== Files - Modified Within 30 Days ==========

[2010/03/09 22:55:40 | 002,883,584 | -HS- | M] () – C:\Users\Mike\ntuser.dat
[2010/03/09 22:19:00 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/03/09 22:09:01 | 000,005,168 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/03/09 22:09:01 | 000,005,168 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/03/09 18:09:54 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/03/09 18:08:57 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/03/09 18:08:51 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/03/09 18:08:05 | 2138,234,879 | -HS- | M] () – C:\hiberfil.sys
[2010/03/09 18:02:56 | 000,524,288 | -HS- | M] () – C:\Users\Mike\ntuser.dat{9072cd49-d55c-11de-8776-001fbc0156c9}.TMContainer00000000000000000001.regtrans-ms
[2010/03/09 18:02:56 | 000,065,536 | -HS- | M] () – C:\Users\Mike\ntuser.dat{9072cd49-d55c-11de-8776-001fbc0156c9}.TM.blf
[2010/03/09 17:57:57 | 001,261,963 | -H– | M] () – C:\Users\Mike\AppData\Local\IconCache.db
[2010/03/09 17:52:00 | 000,077,312 | —- | M] () – C:\mbr.exe
[2010/03/09 17:43:07 | 056,950,137 | —- | M] () – C:\Windows\SysNative\drivers\Avg\incavi.avm
[2010/03/09 17:38:31 | 000,000,416 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{B935C216-1B96-4A6A-B2B2-2A2D9D90417D}.job
[2010/03/08 20:46:42 | 000,000,680 | —- | M] () – C:\Users\Mike\AppData\Local\d3d9caps.dat
[2010/03/08 17:03:05 | 000,290,816 | —- | M] () – C:\Users\Mike\Desktop\exeHelper.com
[2010/03/07 13:43:54 | 000,001,245 | —- | M] () – C:\Users\Public\Desktop\Walmart MP3 Music Downloads.lnk
[2010/03/03 15:18:41 | 000,000,749 | —- | M] () – C:\Users\Public\Desktop\World of Warcraft.lnk
[2010/03/01 21:38:01 | 000,173,119 | —- | M] (Eric_71) – C:\Users\Mike\Desktop\Rooter.exe
[2010/03/01 15:28:28 | 000,026,112 | —- | M] () – C:\Users\Mike\Documents\Doc1.doc
[2010/02/28 19:37:04 | 000,016,937 | —- | M] () – C:\Users\Mike\Documents\Samantha Vorsino.docx
[2010/02/28 10:44:37 | 000,001,917 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/02/28 09:59:51 | 000,472,064 | —- | M] ( ) – C:\Users\Mike\Desktop\RootRepeal.exe
[2010/02/24 21:33:52 | 000,293,376 | —- | M] () – C:\Users\Mike\Desktop\gmer.exe
[2010/02/24 21:33:03 | 000,549,888 | —- | M] (OldTimer Tools) – C:\Users\Mike\Desktop\OTL.exe
[2010/02/24 21:26:27 | 000,001,141 | —- | M] () – C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
[2010/02/24 13:00:44 | 000,068,064 | —- | M] () – C:\Users\Mike\AppData\Local\GDIPFONTCACHEV1.DAT
[2010/02/24 12:59:00 | 000,290,296 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2010/02/23 23:37:26 | 000,001,928 | —- | M] () – C:\Users\Mike\Desktop\HiJackThis.lnk
[2010/02/23 23:37:23 | 000,812,344 | —- | M] (Trend Micro Inc.) – C:\Users\Mike\Desktop\HijackThisInstaller.exe
[2010/02/22 00:55:04 | 000,275,946 | —- | M] () – C:\Windows\SysNative\NvApps.xml
[2010/02/22 00:55:04 | 000,066,714 | —- | M] () – C:\Windows\SysNative\NvwsApps.xml
[2010/02/22 00:55:00 | 014,828,648 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcpl.dll
[2010/02/22 00:55:00 | 001,067,624 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvsvc64.dll
[2010/02/22 00:55:00 | 000,116,328 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvmctray.dll
[2010/02/21 23:18:39 | 021,005,416 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvoglv64.dll
[2010/02/21 23:18:39 | 016,061,032 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcompiler.dll
[2010/02/21 23:18:39 | 015,227,496 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvoglv32.dll
[2010/02/21 23:18:39 | 011,906,152 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvd3dumx.dll
[2010/02/21 23:18:39 | 011,647,592 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcompiler.dll
[2010/02/21 23:18:39 | 009,386,088 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvd3dum.dll
[2010/02/21 23:18:39 | 006,279,784 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvwgf2umx.dll
[2010/02/21 23:18:39 | 005,444,200 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuda.dll
[2010/02/21 23:18:39 | 004,503,144 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvwgf2um.dll
[2010/02/21 23:18:39 | 004,029,544 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuda.dll
[2010/02/21 23:18:39 | 002,893,416 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvenc.dll
[2010/02/21 23:18:39 | 002,646,632 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvenc.dll
[2010/02/21 23:18:39 | 002,106,472 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvid.dll
[2010/02/21 23:18:39 | 002,009,704 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvid.dll
[2010/02/21 23:18:39 | 001,592,936 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvapi64.dll
[2010/02/21 23:18:39 | 001,296,488 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvapi.dll
[2010/02/21 23:18:39 | 000,649,832 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvudisp.exe
[2010/02/21 23:18:39 | 000,235,624 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcod196.dll
[2010/02/21 23:18:39 | 000,235,624 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcod.dll
[2010/02/21 23:18:39 | 000,068,200 | —- | M] (Khronos Group) – C:\Windows\SysWow64\OpenCL.dll
[2010/02/21 23:18:39 | 000,065,640 | —- | M] (Khronos Group) – C:\Windows\SysNative\OpenCL.dll
[2010/02/21 23:18:39 | 000,011,240 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\drivers\nvBridge.kmd
[2010/02/21 23:18:39 | 000,009,834 | —- | M] () – C:\Windows\SysNative\nvinfo.pb
[2010/02/21 20:27:17 | 000,690,960 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/02/21 20:27:17 | 000,595,446 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/02/21 20:27:17 | 000,101,144 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/02/21 20:25:59 | 000,015,872 | —- | M] () – C:\Users\Mike\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/21 14:55:58 | 001,840,232 | —- | M] (Trend Micro) – C:\Users\Mike\Desktop\HousecallLauncher.exe
[2010/02/21 14:50:39 | 000,532,480 | —- | M] (Trend Micro Incorporated) – C:\Users\Mike\Desktop\cwshredder.exe
[2010/02/21 14:46:18 | 000,000,036 | —- | M] () – C:\Users\Mike\AppData\Local\housecall.guid.cache
[2010/02/20 17:15:56 | 000,032,768 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\nshhttp.dll
[2010/02/20 17:14:20 | 000,033,792 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\httpapi.dll
[2010/02/20 17:06:41 | 000,024,064 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\nshhttp.dll
[2010/02/20 17:05:14 | 000,030,720 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\httpapi.dll
[2010/02/18 23:41:50 | 000,000,944 | —- | M] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/02/16 21:26:18 | 000,239,583 | —- | M] () – C:\Users\Mike\Documents\prject.xps
[2010/02/15 17:06:23 | 000,388,264 | —- | M] () – C:\Users\Mike\Documents\2009 Railsback D Form 1040 Individual Tax Return.tax2009
[2010/02/14 22:17:54 | 000,001,804 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2010/02/14 22:14:07 | 000,001,756 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/02/10 12:41:52 | 000,649,832 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\NVUNINST.EXE

========== Files Created - No Company Name ==========

[2010/03/09 17:51:55 | 000,077,312 | —- | C] () – C:\mbr.exe
[2010/03/08 17:03:01 | 000,290,816 | —- | C] () – C:\Users\Mike\Desktop\exeHelper.com
[2010/03/07 13:43:54 | 000,001,245 | —- | C] () – C:\Users\Public\Desktop\Walmart MP3 Music Downloads.lnk
[2010/03/06 17:41:00 | 2138,234,879 | -HS- | C] () – C:\hiberfil.sys
[2010/03/03 22:32:12 | 000,009,834 | —- | C] () – C:\Windows\SysNative\nvinfo.pb
[2010/03/01 15:28:27 | 000,026,112 | —- | C] () – C:\Users\Mike\Documents\Doc1.doc
[2010/02/26 16:14:30 | 000,016,937 | —- | C] () – C:\Users\Mike\Documents\Samantha Vorsino.docx
[2010/02/24 21:26:27 | 000,001,141 | —- | C] () – C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
[2010/02/23 23:11:36 | 000,001,928 | —- | C] () – C:\Users\Mike\Desktop\HiJackThis.lnk
[2010/02/23 22:41:24 | 000,001,917 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/02/22 00:55:04 | 000,275,946 | —- | C] () – C:\Windows\SysNative\NvApps.xml
[2010/02/22 00:55:04 | 000,066,714 | —- | C] () – C:\Windows\SysNative\NvwsApps.xml
[2010/02/21 14:46:18 | 000,000,036 | —- | C] () – C:\Users\Mike\AppData\Local\housecall.guid.cache
[2010/02/18 23:41:50 | 000,000,944 | —- | C] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/02/16 21:26:09 | 000,239,583 | —- | C] () – C:\Users\Mike\Documents\prject.xps
[2010/02/14 22:17:54 | 000,001,804 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2010/02/14 22:14:07 | 000,001,756 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/02/08 21:53:43 | 000,388,264 | —- | C] () – C:\Users\Mike\Documents\2009 Railsback D Form 1040 Individual Tax Return.tax2009
[2009/10/03 14:34:55 | 000,000,680 | —- | C] () – C:\Users\Mike\AppData\Local\d3d9caps.dat
[2009/09/24 19:40:55 | 000,000,262 | —- | C] () – C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
[2009/09/01 20:46:58 | 000,015,872 | —- | C] () – C:\Users\Mike\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/30 18:40:19 | 000,117,248 | —- | C] () – C:\Windows\SysWow64\EhStorAuthn.dll
[2009/08/30 18:39:36 | 000,368,640 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/08/19 19:12:54 | 000,060,124 | —- | C] () – C:\Windows\SysWow64\tcpmon.ini
[2009/08/16 19:20:52 | 000,000,079 | —- | C] () – C:\Users\Mike\AppData\Local\DVDPATH.TXT
[2009/08/14 19:40:17 | 000,000,180 | —- | C] () – C:\Users\Mike\AppData\Roaming\setup.log
[2009/08/14 19:40:15 | 000,000,760 | —- | C] () – C:\Users\Mike\AppData\Roaming\setup_ldm.iss
[2009/08/08 08:44:56 | 000,121,902 | —- | C] () – C:\ProgramData\nvModes.001
[2009/08/08 08:44:52 | 000,121,902 | —- | C] () – C:\ProgramData\nvModes.dat
[2009/08/07 22:18:40 | 000,000,732 | —- | C] () – C:\Users\Mike\AppData\Local\d3d9caps64.dat
< End of report >


Thank you,

Comp running a bit slower than I think it should be….but otherwise ok. ANy suggestions for that?

Thank you, I appreciate your help.


-Michael-
Post #20
Hi,

With that, your computer now looks clean! :thumbup:

Please delete GMER, RootRepeal, Rooter, exeHelper, MBR and all the logs we've created.

You can keep Malwarebytes, it is an excellent malware removal tool. Update atleast once a week then run a complete scan.

–Next–

Clean up with OTL:
  • Right click OTL.exe then choose "Run as Administrator" to run the tool.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.
–Next–

You need to create a new Clean restore point.
  • Click Start - All Programs - Accessories - System Tools - System Restore
  • Click on open System Protection.
  • On the System Protection tab in System Properties click on Create.
  • Give the restore point an appropriate name and click Create.
–Next–
  • Open any folder.
  • Click on Organize button.
  • Select Folders and Search Options.
  • On the Folder Options window, click on View tab.
  • Select Show hidden files and folders from the list.
  • Click OK to save the new settings and close the Folder Options window.
–Next–

You have some unnecessary programs that are being launched at boot time, these programs can be loaded manually.
StartUpLite - This utility can help increase the speed of your boot up process.

To keep your operating system up to date visit
  • Secunia Software inspector to check your program update status.
  • Microsoft Windows Update .

Here are some tips to reduce the potential for spyware infection in the future:

1. It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them
Then consider a password keeper, to keep all your passwords safe.

2. Make your Internet Explorer More Secure
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab.
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.

    • Change the Download signed ActiveX controls to Prompt.
    • Change the Download unsigned ActiveX controls to Disable.
    • Change the Initialise and script ActiveX controls not marked as safe to Disable.
    • Change the Installation of desktop items to Prompt.
    • Change the Launching programs and files in an IFRAME to Prompt.
    • Change the Navigate sub-frames across different domains to Prompt.
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
3. Update your Anti-Virus Software - I can not overemphasize the need for you to update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

4. Make sure you keep your Windows OS current by visiting Windows update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

5. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

6. Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

7. SpywareBlaster - Download and install SpywareBlaster. This program prevents the installation of ActiveX-based spyware and other potentially unwanted programs.

8. Protect your computer from internet threats with SandboxIE. This program isolates Internet Explorer from the rest of your operating system, 'sandboxing' it away - so malicious websites can't do damage to the rest of your system. There is a Getting Started guide on their website.

9. Some excellent free firewalls. Note: Use only one firewall at a time.
Agnitum Outpost Firewall
Comodo Firewall - If you are installing this and already have an anti spyware then please do not install Comodo's anti spyware program.
Online Armor Personal Firewall

10. And finally, please read these excellent articles:
Malware: Help prevent the Infection by Sandi Hardmeier,
Preventing Malware - Tools and Practices for Safe Computing

For more safe computing tips please read the guide by Rorschach112 on how to prevent malware and about safe computing here.



Good luck, happy computing and stay clean! ^_^
Post #21
Thank you very much for your help. I have one final question…I currently have the free versions of AVG, Malwarebytes and Super Anti spyware loaded up. Should I carry all 3 or uninstall the Super anti spyware? Thank you Once again, -Michael-
Post #22
Hi, Yes, you can keep the 3 of them but remember to have them updated before running a scan and when using Malwarebytes, make sure that SuperAntiSpyware is not running and vice versa as they may conflict with each other. :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI