[Resolved] Laptop Infected with "Security Tool" virus

DanielD Topic Starter

Post #1May 9, 2010, 4:46 PM UTC

My neighbor recently got a new computer and has unfortunately gotten a virus. The name symptoms were fake security pop-ups as well as adds. The name the virus was using to pose as an anti-virus program was Security Tool. The computer has been infected for a week and my neighbor, who is new to computers, asked me for help. The strange thing is, when we booted up the computer so he could show me the problems, the virus had suddenly stopped. There definitely was a virus though as evidence was his desktop background being changed and a mysterious "Security Tool" icon on his desktop. However the icon led to an empty folder so somehow the virus dissapeared. So have the symptoms. But I don't believe an infected computer can fix itself miraculously on its own, and I asked the owner if he tried anything and he said no. So I would appreciate if someone could do a check-up on the laptop (my neighbor is on vacation for a couple weeks and left it in my possession) and make sure the virus is really gone.

So far all I've done is use ATF to clear the cache.

The laptop is running Windows 7 32-Bit.

Here is a HTJ log. I'll be happy to supply more information if it is required.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:46:43 AM, on 5/9/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Acer\Acer VCM\AcerVCM.exe
C:\Windows\system32\igfxext.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskhost.exe
C:\Users\Todd\Desktop\HiJackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…f4ww65w7432r28p
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…f4ww65w7432r28p
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…f4ww65w7432r28p
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
O4 - HKLM\..\Run: [EgisTecLiveUpdate] "C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe"
O4 - HKLM\..\Run: [mwlDaemon] C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NortonOnlineBackupReminder] "C:\Program Files\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: Acer VCM.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Acer\Acer VCM\Skype4COM.dll
O23 - Service: Dritek WMI Service (DsiWMIService) - Dritek System Inc. - C:\Program Files\Launch Manager\dsiwmis.exe
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\Acer Games\Acer Game Console\GameConsoleService.exe
O23 - Service: GRegService (Greg_Service) - Acer Incorporated - C:\Program Files\Acer\Registration\GregHSRW.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: MyWinLocker Service (MWLService) - Egis Technology Inc. - C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe
O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe
O23 - Service: Updater Service - Acer - C:\Program Files\Acer\Acer Updater\UpdaterService.exe

–
End of file - 8861 bytes

mowman

Post #2May 9, 2010, 7:31 PM UTC

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 5 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post
•Please be aware that I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice.
•This may cause a delay in response time, but I will do my best to keep it as short as possible.
•I will reply back shortly with instructions.

DanielD

Post #3May 10, 2010, 7:53 PM UTC

Thanks mowman. And just thought I'd add this:

There is actually one existing symptom, that is the desktop background which is somehow permanently black. The desktop was originally set to the default Windows XP one my neighbor said it changed to black after the virus. Unfortunately my neighbor has the Windows 7 Starter edition which doesn't actually allow him to change the background. Through some simple searching I found a program specifically designed for this though that allows the user to set a background, however I'm not sure if it works the exact same way as windows desktops are supposed to work, I say this because when I change the desktop with the program, it doesn't work, at least not completely. The desktop stays black, but when I open, minimize, close windows etc., the desktop image that I chose with the program flashes briefly before returning black, almost like the black background isn't really the desktop but some kind of cover. The icons on the desktop and menu bar etc. still show up so its only covering the desktop image. Anyways I'm not sure if the reason the black stays is because the program doesn't work correctly or if it really is a mean trick by the virus.

Here's a link to the desktop program, and also I tried this program before posting so the computer is still in the same state.

http://www.sevenforums.com/tutorials/281-d…und-change.html

mowman

Post #4May 10, 2010, 8:40 PM UTC

Hello vectris.Please do the following.

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

In your next reply please post the following.

Both OTL logs
GMER log

DanielD

Post #5May 10, 2010, 10:40 PM UTC

Here are the OTL logs, I'll make a second post with the GMER log in a minute.

OTL logfile created on: 5/10/2010 5:17:20 PM - Run 1
OTL by OldTimer - Version 3.2.4.1 Folder = C:\Users\Todd\Desktop
Starter Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,013.00 Mb Total Physical Memory | 494.00 Mb Available Physical Memory | 49.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 64.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 136.95 Gb Total Space | 118.87 Gb Free Space | 86.80% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: TODD
Current User Name: Todd
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Todd\Desktop\OTL.exe (OldTimer Tools)
PRC - c:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - c:\Program Files\McAfee\MSC\mcupdmgr.exe (McAfee, Inc.)
PRC - C:\Program Files\Oceanis\SystemSetting\WallPaperAgent.exe (Oceanis)
PRC - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
PRC - C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Windows\System32\igfxext.exe (Intel Corporation)
PRC - C:\Program Files\McAfee\MSK\msksrver.exe (McAfee, Inc.)
PRC - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
PRC - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated)
PRC - C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (Acer Incorporated)
PRC - C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
PRC - C:\Program Files\Acer\Registration\GregHSRW.exe (Acer Incorporated)
PRC - C:\Program Files\Launch Manager\dsiwmis.exe (Dritek System Inc.)
PRC - C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
PRC - C:\Program Files\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()

========== Modules (SafeList) ==========

MOD - C:\Users\Todd\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Acer\Acer ePower Management\SysHook.dll (Acer Incorporated)
MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation)
MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf
861225ca\GdiPlus.dll (Microsoft Corporation)
MOD - C:\Program Files\McAfee\SiteAdvisor\sahook.dll ()

========== Win32 Services (SafeList) ==========

SRV - (mcmscsvc) – C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV - (McSysmon) – C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (MpfService) – C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (MSK80Service) – C:\Program Files\McAfee\MSK\MskSrver.exe (McAfee, Inc.)
SRV - (ePowerSvc) – C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated)
SRV - (MWLService) – C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe ()
SRV - (Greg_Service) – C:\Program Files\Acer\Registration\GregHSRW.exe (Acer Incorporated)
SRV - (DsiWMIService) – C:\Program Files\Launch Manager\dsiwmis.exe (Dritek System Inc.)
SRV - (WwanSvc) – C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) – C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) – C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) – C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) – C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (RpcEptMapper) – C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (PNRPsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) – C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) – C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) – C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (Dhcp) – C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) – C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) – C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX Installer (AxInstSV) – C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppIDSvc) – C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (sppsvc) – C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
SRV - (RS_Service) – C:\Program Files\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
SRV - (McProxy) – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (McNASvc) – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (Updater Service) – C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer)
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (GameConsoleService) – C:\Program Files\Acer Games\Acer Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()

========== Driver Services (SafeList) ==========

DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (KSecPkg) – C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (EUCR) – C:\Windows\system32\DRIVERS\EUCR6SK.SYS (ENE Technology Inc.)
DRV - (L1C) – C:\Windows\System32\drivers\L1C62x86.sys (Atheros Communications, Inc.)
DRV - (mfehidk) – C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfesmfk) – C:\Windows\System32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (athr) – C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (igfx) – C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (cmdide) – C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) – C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) – C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) – C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) – C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) – C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) – C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) – C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) – C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) – C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) – C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) – C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) – C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) – C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) – C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) – C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) – C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) – C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) – C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) – C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) – C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) – C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) – C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) – C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vhdmp) – C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (vdrvroot) – C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (WIMMount) – C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) – C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) – C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) – C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) – C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) – C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) – C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) – C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) – C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) – C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) – C:\Windows\system32\DRIVERS\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) – C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) – C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) – C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) – C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwififlt) – C:\Windows\System32\drivers\vwififlt.sys (Microsoft Corporation)
DRV - (vwifibus) – C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) – C:\Windows\system32\DRIVERS\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) – C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (mshidkmdf) – C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) – C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) – C:\Windows\system32\DRIVERS\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) – C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) – C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (discache) – C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (HidBatt) – C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation)
DRV - (AcpiPmi) – C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) – C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) – C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) – C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) – C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (b57nd60x) – C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (ebdrv) – C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) – C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (iaStor) – C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (mwlPSDVDisk) – C:\Windows\System32\drivers\mwlPSDVDisk.sys (Egis Technology Inc.)
DRV - (mwlPSDNServ) – C:\Windows\System32\drivers\mwlPSDNserv.sys (Egis Technology Inc.)
DRV - (mwlPSDFilter) – C:\Windows\System32\drivers\mwlPSDFilter.sys (Egis Technology Inc.)
DRV - (MPFP) – C:\Windows\System32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (BCM43XX) – C:\Windows\System32\drivers\BCMWL6.SYS (Broadcom Corporation)
DRV - (DKbFltr) – C:\Windows\system32\DRIVERS\DKbFltr.sys (Dritek System Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…f4ww65w7432r28p
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…f4ww65w7432r28p

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…f4ww65w7432r28p
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.google.com"
FF - prefs.js..extensions.enabledItems: {66E978CD-981F-47DF-AC42-E3CF417C1467}:0.4.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/05/10 17:16:56 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/05/09 12:27:54 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/05/09 13:38:32 | 000,000,000 | —D | M]

[2010/05/09 12:30:08 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\Mozilla\Extensions
[2010/05/09 13:48:32 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\Mozilla\Firefox\Profiles\iwqb1djs.default\extensions
[2010/05/09 12:32:02 | 000,000,000 | —D | M] (New Tab Homepage) – C:\Users\Todd\AppData\Roaming\Mozilla\Firefox\Profiles\iwqb1djs.default\extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}
[2010/05/09 13:38:36 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/05/09 13:38:36 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/05/09 13:38:09 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O2 - BHO: (Windows 7 Starter Helper) - {D381FF29-7CFB-4D4E-B92A-C4EDDC696614} - C:\Program Files\Oceanis\SystemSetting\StarterHelper.dll (Oceanis)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe ()
O4 - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4 - HKLM..\Run: [EgisTecLiveUpdate] C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [mwlDaemon] C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.2
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Acer\Acer VCM\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKCU Winlogon: Shell - (C:\Program Files\Oceanis\SystemSetting\WallPaperAgent.exe) - C:\Program Files\Oceanis\SystemSetting\WallPaperAgent.exe (Oceanis)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias [2009/07/13 22:37:08 | 000,000,000 | —D | M]
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)
NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)

========== Files/Folders - Created Within 30 Days ==========

[2010/05/10 17:14:08 | 000,570,880 | —- | C] (OldTimer Tools) – C:\Users\Todd\Desktop\OTL.exe
[2010/05/09 23:38:36 | 000,000,000 | —D | C] – C:\Windows\.jagex_cache_32
[2010/05/09 23:38:19 | 000,000,000 | —D | C] – C:\Windows\Sun
[2010/05/09 13:39:08 | 000,000,000 | —D | C] – C:\ProgramData\Sun
[2010/05/09 13:39:06 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/05/09 13:38:32 | 000,411,368 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\deployJava1.dll
[2010/05/09 13:38:32 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2010/05/09 13:38:32 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2010/05/09 13:38:31 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2010/05/09 13:37:59 | 000,000,000 | —D | C] – C:\Program Files\Java
[2010/05/09 13:16:52 | 000,000,000 | —D | C] – C:\Program Files\NT Registry Optimizer
[2010/05/09 13:15:22 | 000,000,000 | —D | C] – C:\Program Files\Oceanis
[2010/05/09 12:57:02 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2010/05/09 12:56:35 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\SUPERAntiSpyware.com
[2010/05/09 12:56:35 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2010/05/09 12:55:47 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Wise Installation Wizard
[2010/05/09 12:51:55 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\Malwarebytes
[2010/05/09 12:51:43 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/05/09 12:51:42 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/05/09 12:51:41 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/05/09 12:51:40 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/05/09 12:29:51 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\Mozilla
[2010/05/09 12:29:51 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\Mozilla
[2010/05/09 12:29:16 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Todd\Desktop\HiJackThis.exe
[2010/05/09 12:27:36 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2010/05/09 12:25:28 | 000,050,688 | —- | C] (Atribune.org) – C:\Users\Todd\Desktop\ATF-Cleaner.exe
[2010/04/27 19:14:26 | 001,037,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\lsasrv.dll
[2010/04/27 19:14:26 | 000,133,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\ksecpkg.sys
[2010/04/18 16:56:03 | 003,954,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2010/04/18 16:56:03 | 003,899,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2010/04/18 16:56:01 | 000,427,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vbscript.dll

========== Files - Modified Within 30 Days ==========

[2010/05/10 17:22:12 | 001,048,576 | -HS- | M] () – C:\Users\Todd\NTUSER.DAT
[2010/05/10 17:19:06 | 000,009,696 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/05/10 17:19:06 | 000,009,696 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/05/10 17:16:30 | 000,713,888 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/05/10 17:16:30 | 000,615,360 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/05/10 17:16:30 | 000,103,702 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/05/10 17:14:34 | 000,570,880 | —- | M] (OldTimer Tools) – C:\Users\Todd\Desktop\OTL.exe
[2010/05/10 17:12:39 | 000,008,921 | —- | M] () – C:\Windows\System32\Config.MPF
[2010/05/10 17:11:40 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/05/10 17:11:35 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/05/10 17:11:25 | 796,831,744 | -HS- | M] () – C:\hiberfil.sys
[2010/05/10 00:36:13 | 003,343,306 | -H– | M] () – C:\Users\Todd\AppData\Local\IconCache.db
[2010/05/10 00:33:40 | 000,000,075 | —- | M] () – C:\Users\Todd\jagex_runescape_preferences2.dat
[2010/05/10 00:33:40 | 000,000,041 | —- | M] () – C:\Users\Todd\jagex_runescape_preferences.dat
[2010/05/09 23:41:16 | 000,000,000 | —- | M] () – C:\Users\Todd\jagex__preferences3.dat
[2010/05/09 13:42:44 | 156,607,328 | —- | M] () – C:\Users\Todd\Desktop\OOo_3.2.0_Win_x86_install-wJRE_en-US.exe
[2010/05/09 13:38:05 | 000,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2010/05/09 13:38:05 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2010/05/09 13:38:04 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2010/05/09 13:38:03 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\deployJava1.dll
[2010/05/09 13:15:24 | 000,002,000 | —- | M] () – C:\Users\Public\Desktop\Oceanis Change Background W7.lnk
[2010/05/09 12:56:41 | 000,000,995 | —- | M] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/05/09 12:51:47 | 000,000,987 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/05/09 12:29:56 | 000,000,000 | —- | M] () – C:\Windows\nsreg.dat
[2010/05/09 12:29:28 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Todd\Desktop\HiJackThis.exe
[2010/05/09 12:27:58 | 000,001,893 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010/05/09 12:25:28 | 000,050,688 | —- | M] (Atribune.org) – C:\Users\Todd\Desktop\ATF-Cleaner.exe
[2010/04/29 18:39:38 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/04/29 18:39:26 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/04/28 13:34:21 | 000,001,988 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/04/18 17:01:36 | 000,000,342 | —- | M] () – C:\Windows\tasks\McDefragTask.job

========== Files Created - No Company Name ==========

[2010/05/09 23:41:16 | 000,000,000 | —- | C] () – C:\Users\Todd\jagex__preferences3.dat
[2010/05/09 23:41:15 | 000,000,075 | —- | C] () – C:\Users\Todd\jagex_runescape_preferences2.dat
[2010/05/09 23:38:59 | 000,000,041 | —- | C] () – C:\Users\Todd\jagex_runescape_preferences.dat
[2010/05/09 13:15:24 | 000,002,000 | —- | C] () – C:\Users\Public\Desktop\Oceanis Change Background W7.lnk
[2010/05/09 13:02:20 | 156,607,328 | —- | C] () – C:\Users\Todd\Desktop\OOo_3.2.0_Win_x86_install-wJRE_en-US.exe
[2010/05/09 12:56:41 | 000,000,995 | —- | C] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/05/09 12:51:47 | 000,000,987 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/05/09 12:29:56 | 000,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2010/05/09 12:27:58 | 000,001,893 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010/04/11 14:30:13 | 000,001,988 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/01/08 21:34:41 | 000,356,352 | —- | C] () – C:\Windows\EMCRI_E.dll
[2009/08/03 18:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/07/13 19:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll

========== LOP Check ==========

[2010/03/25 12:09:17 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\Acer
[2010/03/25 12:09:11 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\Leadertech
[2010/03/25 12:13:34 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\WildTangent
[2010/04/18 17:01:36 | 000,000,342 | —- | M] () – C:\Windows\Tasks\McDefragTask.job
[2010/04/04 17:20:50 | 000,000,320 | —- | M] () – C:\Windows\Tasks\McQcTask.job
[2009/07/14 00:53:46 | 000,009,336 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2009/07/13 21:26:15 | 000,053,312 | —- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E – C:\Windows\System32\drivers\AGP440.sys
[2009/07/13 21:26:15 | 000,053,312 | —- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E – C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009/07/13 21:26:15 | 000,053,312 | —- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009/07/13 21:26:15 | 000,021,584 | —- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E – C:\Windows\System32\drivers\atapi.sys
[2009/07/13 21:26:15 | 000,021,584 | —- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009/07/13 21:26:15 | 000,021,584 | —- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2009/07/13 21:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows\System32\cngaudit.dll
[2009/07/13 21:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

< MD5 for: IASTOR.SYS >
[2009/06/04 22:54:36 | 000,408,600 | —- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 – C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2009/06/04 22:43:16 | 000,330,264 | —- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 – C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2009/06/04 22:43:16 | 000,330,264 | —- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 – C:\Windows\System32\drivers\iaStor.sys
[2009/06/04 22:43:16 | 000,330,264 | —- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 – C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_c1f15fc3e546800a\iaStor.sys

< MD5 for: IASTORV.SYS >
[2009/07/13 21:20:36 | 000,332,352 | —- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 – C:\Windows\System32\drivers\iaStorV.sys
[2009/07/13 21:20:36 | 000,332,352 | —- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 – C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/13 21:20:36 | 000,332,352 | —- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 – C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2009/07/13 21:16:02 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – C:\Windows\System32\netlogon.dll
[2009/07/13 21:16:02 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2009/07/13 21:20:44 | 000,142,416 | —- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F – C:\Windows\System32\drivers\nvstor.sys
[2009/07/13 21:20:44 | 000,142,416 | —- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F – C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/13 21:20:44 | 000,142,416 | —- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F – C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys

< MD5 for: SCECLI.DLL >
[2009/07/13 21:16:13 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – C:\Windows\System32\scecli.dll
[2009/07/13 21:16:13 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >

< End of report >
SRV - (mcmscsvc) – C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV - (McSysmon) – C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (MpfService) – C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (MSK80Service) – C:\Program Files\McAfee\MSK\MskSrver.exe (McAfee, Inc.)
SRV - (ePowerSvc) – C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated)
SRV - (MWLService) – C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe ()
SRV - (Greg_Service) – C:\Program Files\Acer\Registration\GregHSRW.exe (Acer Incorporated)
SRV - (DsiWMIService) – C:\Program Files\Launch Manager\dsiwmis.exe (Dritek System Inc.)
SRV - (WwanSvc) – C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) – C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) – C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) – C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) – C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (RpcEptMapper) – C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (PNRPsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) – C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) – C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) – C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (Dhcp) – C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) – C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) – C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX Installer (AxInstSV) – C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppIDSvc) – C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (sppsvc) – C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
SRV - (RS_Service) – C:\Program Files\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
SRV - (McProxy) – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (McNASvc) – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (Updater Service) – C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer)
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (GameConsoleService) – C:\Program Files\Acer Games\Acer Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()

========== Driver Services (SafeList) ==========

DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (KSecPkg) – C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (EUCR) – C:\Windows\system32\DRIVERS\EUCR6SK.SYS (ENE Technology Inc.)
DRV - (L1C) – C:\Windows\System32\drivers\L1C62x86.sys (Atheros Communications, Inc.)
DRV - (mfehidk) – C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfesmfk) – C:\Windows\System32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (athr) – C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (igfx) – C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (cmdide) – C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) – C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) – C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) – C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) – C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) – C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) – C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) – C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) – C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) – C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) – C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) – C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) – C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) – C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) – C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) – C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) – C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) – C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) – C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) – C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) – C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) – C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) – C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) – C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vhdmp) – C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (vdrvroot) – C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (WIMMount) – C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) – C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) – C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) – C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) – C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) – C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) – C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) – C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) – C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) – C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) – C:\Windows\system32\DRIVERS\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) – C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) – C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) – C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) – C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwififlt) – C:\Windows\System32\drivers\vwififlt.sys (Microsoft Corporation)
DRV - (vwifibus) – C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) – C:\Windows\system32\DRIVERS\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) – C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (mshidkmdf) – C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) – C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) – C:\Windows\system32\DRIVERS\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) – C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) – C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (discache) – C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (HidBatt) – C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation)
DRV - (AcpiPmi) – C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) – C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) – C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) – C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) – C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (b57nd60x) – C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (ebdrv) – C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) – C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (iaStor) – C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (mwlPSDVDisk) – C:\Windows\System32\drivers\mwlPSDVDisk.sys (Egis Technology Inc.)
DRV - (mwlPSDNServ) – C:\Windows\System32\drivers\mwlPSDNserv.sys (Egis Technology Inc.)
DRV - (mwlPSDFilter) – C:\Windows\System32\drivers\mwlPSDFilter.sys (Egis Technology Inc.)
DRV - (MPFP) – C:\Windows\System32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (BCM43XX) – C:\Windows\System32\drivers\BCMWL6.SYS (Broadcom Corporation)
DRV - (DKbFltr) – C:\Windows\system32\DRIVERS\DKbFltr.sys (Dritek System Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…f4ww65w7432r28p
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…f4ww65w7432r28p

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…f4ww65w7432r28p
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.google.com"
FF - prefs.js..extensions.enabledItems: {66E978CD-981F-47DF-AC42-E3CF417C1467}:0.4.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/05/10 17:16:56 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/05/09 12:27:54 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/05/09 13:38:32 | 000,000,000 | —D | M]

[2010/05/09 12:30:08 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\Mozilla\Extensions
[2010/05/09 13:48:32 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\Mozilla\Firefox\Profiles\iwqb1djs.default\extensions
[2010/05/09 12:32:02 | 000,000,000 | —D | M] (New Tab Homepage) – C:\Users\Todd\AppData\Roaming\Mozilla\Firefox\Profiles\iwqb1djs.default\extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}
[2010/05/09 13:38:36 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/05/09 13:38:36 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/05/09 13:38:09 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O2 - BHO: (Windows 7 Starter Helper) - {D381FF29-7CFB-4D4E-B92A-C4EDDC696614} - C:\Program Files\Oceanis\SystemSetting\StarterHelper.dll (Oceanis)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe ()
O4 - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4 - HKLM..\Run: [EgisTecLiveUpdate] C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [mwlDaemon] C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.2
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Acer\Acer VCM\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKCU Winlogon: Shell - (C:\Program Files\Oceanis\SystemSetting\WallPaperAgent.exe) - C:\Program Files\Oceanis\SystemSetting\WallPaperAgent.exe (Oceanis)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/05/10 17:14:08 | 000,570,880 | —- | C] (OldTimer Tools) – C:\Users\Todd\Desktop\OTL.exe
[2010/05/09 23:38:36 | 000,000,000 | —D | C] – C:\Windows\.jagex_cache_32
[2010/05/09 23:38:19 | 000,000,000 | —D | C] – C:\Windows\Sun
[2010/05/09 13:39:08 | 000,000,000 | —D | C] – C:\ProgramData\Sun
[2010/05/09 13:39:06 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/05/09 13:38:32 | 000,411,368 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\deployJava1.dll
[2010/05/09 13:38:32 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2010/05/09 13:38:32 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2010/05/09 13:38:31 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2010/05/09 13:37:59 | 000,000,000 | —D | C] – C:\Program Files\Java
[2010/05/09 13:16:52 | 000,000,000 | —D | C] – C:\Program Files\NT Registry Optimizer
[2010/05/09 13:15:22 | 000,000,000 | —D | C] – C:\Program Files\Oceanis
[2010/05/09 12:57:02 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2010/05/09 12:56:35 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\SUPERAntiSpyware.com
[2010/05/09 12:56:35 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2010/05/09 12:55:47 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Wise Installation Wizard
[2010/05/09 12:51:55 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\Malwarebytes
[2010/05/09 12:51:43 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/05/09 12:51:42 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/05/09 12:51:41 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/05/09 12:51:40 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/05/09 12:29:51 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\Mozilla
[2010/05/09 12:29:51 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\Mozilla
[2010/05/09 12:29:16 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Todd\Desktop\HiJackThis.exe
[2010/05/09 12:27:36 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2010/05/09 12:25:28 | 000,050,688 | —- | C] (Atribune.org) – C:\Users\Todd\Desktop\ATF-Cleaner.exe
[2010/04/27 19:14:26 | 001,037,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\lsasrv.dll
[2010/04/27 19:14:26 | 000,133,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\ksecpkg.sys
[2010/04/18 16:56:03 | 003,954,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2010/04/18 16:56:03 | 003,899,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2010/04/18 16:56:01 | 000,427,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vbscript.dll

========== Files - Modified Within 30 Days ==========

[2010/05/10 17:41:33 | 001,048,576 | -HS- | M] () – C:\Users\Todd\NTUSER.DAT
[2010/05/10 17:19:06 | 000,009,696 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/05/10 17:19:06 | 000,009,696 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/05/10 17:16:30 | 000,713,888 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/05/10 17:16:30 | 000,615,360 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/05/10 17:16:30 | 000,103,702 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/05/10 17:14:34 | 000,570,880 | —- | M] (OldTimer Tools) – C:\Users\Todd\Desktop\OTL.exe
[2010/05/10 17:12:39 | 000,008,921 | —- | M] () – C:\Windows\System32\Config.MPF
[2010/05/10 17:11:40 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/05/10 17:11:35 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/05/10 17:11:25 | 796,831,744 | -HS- | M] () – C:\hiberfil.sys
[2010/05/10 00:36:13 | 003,343,306 | -H– | M] () – C:\Users\Todd\AppData\Local\IconCache.db
[2010/05/10 00:33:40 | 000,000,075 | —- | M] () – C:\Users\Todd\jagex_runescape_preferences2.dat
[2010/05/10 00:33:40 | 000,000,041 | —- | M] () – C:\Users\Todd\jagex_runescape_preferences.dat
[2010/05/09 23:41:16 | 000,000,000 | —- | M] () – C:\Users\Todd\jagex__preferences3.dat
[2010/05/09 13:42:44 | 156,607,328 | —- | M] () – C:\Users\Todd\Desktop\OOo_3.2.0_Win_x86_install-wJRE_en-US.exe
[2010/05/09 13:38:05 | 000,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2010/05/09 13:38:05 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2010/05/09 13:38:04 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2010/05/09 13:38:03 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\deployJava1.dll
[2010/05/09 13:15:24 | 000,002,000 | —- | M] () – C:\Users\Public\Desktop\Oceanis Change Background W7.lnk
[2010/05/09 12:56:41 | 000,000,995 | —- | M] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/05/09 12:51:47 | 000,000,987 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/05/09 12:29:56 | 000,000,000 | —- | M] () – C:\Windows\nsreg.dat
[2010/05/09 12:29:28 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Todd\Desktop\HiJackThis.exe
[2010/05/09 12:27:58 | 000,001,893 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010/05/09 12:25:28 | 000,050,688 | —- | M] (Atribune.org) – C:\Users\Todd\Desktop\ATF-Cleaner.exe
[2010/04/29 18:39:38 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/04/29 18:39:26 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/04/28 13:34:21 | 000,001,988 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/04/18 17:01:36 | 000,000,342 | —- | M] () – C:\Windows\tasks\McDefragTask.job

========== Files Created - No Company Name ==========

[2010/05/09 23:41:16 | 000,000,000 | —- | C] () – C:\Users\Todd\jagex__preferences3.dat
[2010/05/09 23:41:15 | 000,000,075 | —- | C] () – C:\Users\Todd\jagex_runescape_preferences2.dat
[2010/05/09 23:38:59 | 000,000,041 | —- | C] () – C:\Users\Todd\jagex_runescape_preferences.dat
[2010/05/09 13:15:24 | 000,002,000 | —- | C] () – C:\Users\Public\Desktop\Oceanis Change Background W7.lnk
[2010/05/09 13:02:20 | 156,607,328 | —- | C] () – C:\Users\Todd\Desktop\OOo_3.2.0_Win_x86_install-wJRE_en-US.exe
[2010/05/09 12:56:41 | 000,000,995 | —- | C] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/05/09 12:51:47 | 000,000,987 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/05/09 12:29:56 | 000,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2010/05/09 12:27:58 | 000,001,893 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010/04/11 14:30:13 | 000,001,988 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/01/08 21:34:41 | 000,356,352 | —- | C] () – C:\Windows\EMCRI_E.dll
[2009/08/03 18:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/07/13 19:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll

========== LOP Check ==========

[2010/03/25 12:09:17 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\Acer
[2010/03/25 12:09:11 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\Leadertech
[2010/03/25 12:13:34 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\WildTangent
[2010/04/18 17:01:36 | 000,000,342 | —- | M] () – C:\Windows\Tasks\McDefragTask.job
[2010/04/04 17:20:50 | 000,000,320 | —- | M] () – C:\Windows\Tasks\McQcTask.job
[2009/07/14 00:53:46 | 000,009,336 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2009/07/13 21:26:15 | 000,053,312 | —- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E – C:\Windows\System32\drivers\AGP440.sys
[2009/07/13 21:26:15 | 000,053,312 | —- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E – C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009/07/13 21:26:15 | 000,053,312 | —- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009/07/13 21:26:15 | 000,021,584 | —- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E – C:\Windows\System32\drivers\atapi.sys
[2009/07/13 21:26:15 | 000,021,584 | —- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009/07/13 21:26:15 | 000,021,584 | —- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2009/07/13 21:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows\System32\cngaudit.dll
[2009/07/13 21:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

< MD5 for: IASTOR.SYS >
[2009/06/04 22:54:36 | 000,408,600 | —- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 – C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2009/06/04 22:43:16 | 000,330,264 | —- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 – C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2009/06/04 22:43:16 | 000,330,264 | —- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 – C:\Windows\System32\drivers\iaStor.sys
[2009/06/04 22:43:16 | 000,330,264 | —- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 – C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_c1f15fc3e546800a\iaStor.sys

< MD5 for: IASTORV.SYS >
[2009/07/13 21:20:36 | 000,332,352 | —- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 – C:\Windows\System32\drivers\iaStorV.sys
[2009/07/13 21:20:36 | 000,332,352 | —- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 – C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/13 21:20:36 | 000,332,352 | —- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 – C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2009/07/13 21:16:02 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – C:\Windows\System32\netlogon.dll
[2009/07/13 21:16:02 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2009/07/13 21:20:44 | 000,142,416 | —- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F – C:\Windows\System32\drivers\nvstor.sys
[2009/07/13 21:20:44 | 000,142,416 | —- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F – C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/13 21:20:44 | 000,142,416 | —- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F – C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys

< MD5 for: SCECLI.DLL >
[2009/07/13 21:16:13 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – C:\Windows\System32\scecli.dll
[2009/07/13 21:16:13 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >

< End of report >

OTL Extras logfile created on: 5/10/2010 5:17:20 PM - Run 1
OTL by OldTimer - Version 3.2.4.1 Folder = C:\Users\Todd\Desktop
Starter Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,013.00 Mb Total Physical Memory | 494.00 Mb Available Physical Memory | 49.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 64.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 136.95 Gb Total Space | 118.87 Gb Free Space | 86.80% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: TODD
Current User Name: Todd
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{047F790A-7A2A-4B6A-AD02-38092BA63DAC}" = Acer VCM
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 20
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3D5044A5-97B8-45C0-B956-BB2376569188}" = Windows Live Movie Maker
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{51F026FA-5146-4232-A8BA-1364740BD053}" = Acer Crystal Eye webcam
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{67E03279-F703-408F-B4BF-46B5FC8D70CD}" = Microsoft Works
"{68301905-2DEA-41CE-A4D4-E8B443B099BA}" = MyWinLocker
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.3.2 MUI
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}" = eBay Worldwide
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"Acer Assist" = Acer Assist
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Acer Welcome Center" = Welcome Center
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"BBEC16685668EB1D6F3D05051DD7314B66370C9F" = Windows Driver Package - ENE (EUCR) USB (11/23/2009 5.89.0.62)
"HDMI" = Intel® Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"Identity Card" = Identity Card
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"MSC" = McAfee SecurityCenter
"NTREGOPT_is1" = NTREGOPT 1.1j
"Oceanis Change Background Windows 7_is1" = Oceanis Change Background Windows 7
"WildTangent acer Master Uninstall" = Acer Games
"WinLiveSuite_Wave3" = Windows Live Essentials

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/18/2010 4:37:50 PM | Computer Name = Todd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: The data is invalid. .

Error - 4/18/2010 4:37:50 PM | Computer Name = Todd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: The data is invalid. .

Error - 4/18/2010 4:37:50 PM | Computer Name = Todd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: The data is invalid. .

Error - 4/18/2010 4:37:50 PM | Computer Name = Todd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: The data is invalid. .

Error - 4/18/2010 4:37:50 PM | Computer Name = Todd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: The data is invalid. .

Error - 4/18/2010 4:37:50 PM | Computer Name = Todd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: The data is invalid. .

Error - 4/18/2010 4:37:50 PM | Computer Name = Todd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: The data is invalid. .

Error - 4/18/2010 4:37:50 PM | Computer Name = Todd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: The data is invalid. .

Error - 4/18/2010 4:37:50 PM | Computer Name = Todd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: The data is invalid. .

Error - 4/18/2010 4:37:50 PM | Computer Name = Todd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: The data is invalid. .

[ System Events ]
Error - 4/5/2010 11:22:04 PM | Computer Name = Todd | Source = EventLog | ID = 6008
Description = The previous system shutdown at 8:04:41 PM on ?4/?5/?2010 was unexpected.

Error - 4/6/2010 3:59:31 PM | Computer Name = Todd | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the ShellHWDetection service.

Error - 4/6/2010 3:59:35 PM | Computer Name = Todd | Source = DCOM | ID = 10010
Description =

Error - 4/11/2010 2:32:49 PM | Computer Name = Todd | Source = DCOM | ID = 10010
Description =

Error - 4/11/2010 2:33:29 PM | Computer Name = Todd | Source = DCOM | ID = 10010
Description =

Error - 4/19/2010 8:01:06 PM | Computer Name = Todd | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80246007: Security Update for the 2007 Microsoft Office System (KB978380).

Error - 4/19/2010 8:01:14 PM | Computer Name = Todd | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80246007: Security Update for the 2007 Microsoft Office System (KB972581).

Error - 4/19/2010 8:18:13 PM | Computer Name = Todd | Source = DCOM | ID = 10010
Description =

Error - 4/21/2010 1:13:01 PM | Computer Name = Todd | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the Wlansvc service.

Error - 4/28/2010 1:35:34 PM | Computer Name = Todd | Source = DCOM | ID = 10010
Description =

< End of report >

DanielD

Post #6May 10, 2010, 11:13 PM UTC

Ok well something bad happened after the Gmer scan. The scan finished fine but when I tried to open firefox the computer waited for a minute and then crashed to a blue screen, here's the info about the crash that windows gave me after rebooting.

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7600.2.0.0.768.11
Locale ID: 1033

Additional information about the problem:
BCCode: f4
BCP1: 00000003
BCP2: 85A72D40
BCP3: 85A72EAC
BCP4: 81E3B810
OS Version: 6_1_7600
Service Pack: 0_0
Product: 768_1

Files that help describe the problem:
C:\Windows\Minidump\051010-18376-01.dmp
C:\Users\Todd\AppData\Local\Temp\WER-46410-0.sysdata.xml

Read our privacy statement online:
http://go.microsoft.com/fwlink/?linkid=104…mp;clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt

I'm posting this right after the crash so I have no idea if it will happen again or what really caused it. I don't think it was Gmer cus the scan finished fine and it was 5 minutes later when I tried to open Firefox that it happened. Everything else seems fine though so hopefully it was just a freak crash and nothing was harmed.

Anyways I can't figure out how to attach files (its like the option is missing or something…) so I'll just post the log for now.

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-05-10 19:01:08
Windows 6.1.7600
Running: gmer.exe; Driver: C:\Users\Todd\AppData\Local\Temp\ugldipob.sys

—- System - GMER 1.0.15 —-

INT 0x1F \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C2DAF8
INT 0x37 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C2D104
INT 0xC1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C2D3F4
INT 0xD1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C162D8
INT 0xD2 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C15898
INT 0xDF \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C2D1DC
INT 0xE1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C2D958
INT 0xE3 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C2D6F8
INT 0xFD \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C2DF2C
INT 0xFE \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C2E1A8

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0x8B5C279E]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0x8B5C2738]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0x8B5C274C]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateUserProcess [0x8B5C2762]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0x8B5C27DC]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0x8B5C281F]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0x8B5C2710]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0x8B5C2724]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0x8B5C27B2]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0x8B5C2833]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0x8B5C278A]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0x8B5C2776]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0x8B5C280B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0x8B5C27F2]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0x8B5C27C8]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!ZwSaveKeyEx + 13B1 81C7F8E9 1 Byte [06]
.text ntoskrnl.exe!KiDispatchInterrupt + 5A2 81C9F3D2 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, …] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntoskrnl.exe!ZwYieldExecution 81CE7505 5 Bytes JMP 8B5C27CC \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
.text peauth.sys A29D6C9D 28 Bytes [55, 6A, 52, BA, 34, 6A, 3A, …]
.text peauth.sys A29D6CC1 28 Bytes [55, 6A, 52, BA, 34, 6A, 3A, …]

—- User code sections - GMER 1.0.15 —-

.text C:\Windows\system32\services.exe[596] kernel32.dll!GetStartupInfoA 77BD1DF0 5 Bytes JMP 006B0F40
.text C:\Windows\system32\services.exe[596] kernel32.dll!CreateProcessW 77BD202D 5 Bytes JMP 006B0F00
.text C:\Windows\system32\services.exe[596] kernel32.dll!CreateProcessA 77BD2062 5 Bytes JMP 006B0095
.text C:\Windows\system32\services.exe[596] kernel32.dll!CreateNamedPipeW 77C01FD6 5 Bytes JMP 006B0FDB
.text C:\Windows\system32\services.exe[596] kernel32.dll!CreatePipe 77C04A8B 5 Bytes JMP 006B0F65
.text C:\Windows\system32\services.exe[596] kernel32.dll!VirtualProtect 77C150AB 5 Bytes JMP 006B0F76
.text C:\Windows\system32\services.exe[596] kernel32.dll!LoadLibraryExW 77C1B6BF 5 Bytes JMP 006B0F91
.text C:\Windows\system32\services.exe[596] kernel32.dll!LoadLibraryExA 77C1BC8B 5 Bytes JMP 006B0058
.text C:\Windows\system32\services.exe[596] kernel32.dll!CreateFileW 77C20B7D 5 Bytes JMP 006B001B
.text C:\Windows\system32\services.exe[596] kernel32.dll!GetProcAddress 77C21857 5 Bytes JMP 006B00B0
.text C:\Windows\system32\services.exe[596] kernel32.dll!LoadLibraryA 77C22884 5 Bytes JMP 006B0047
.text C:\Windows\system32\services.exe[596] kernel32.dll!LoadLibraryW 77C228D2 5 Bytes JMP 006B0FB6
.text C:\Windows\system32\services.exe[596] kernel32.dll!CreateFileA 77C2291C 5 Bytes JMP 006B0000
.text C:\Windows\system32\services.exe[596] kernel32.dll!GetStartupInfoW 77C27CD5 5 Bytes JMP 006B0F25
.text C:\Windows\system32\services.exe[596] kernel32.dll!CreateNamedPipeA 77C5D5BF 5 Bytes JMP 006B002C
.text C:\Windows\system32\services.exe[596] kernel32.dll!WinExec 77C5E76D 5 Bytes JMP 006B0084
.text C:\Windows\system32\services.exe[596] kernel32.dll!VirtualProtectEx 77C5F729 5 Bytes JMP 006B0073
.text C:\Windows\system32\services.exe[596] msvcrt.dll!_open 77787E48 5 Bytes JMP 00440000
.text C:\Windows\system32\services.exe[596] msvcrt.dll!_wsystem 777BB04F 5 Bytes JMP 00440FC3
.text C:\Windows\system32\services.exe[596] msvcrt.dll!system 777BB16F 5 Bytes JMP 00440FDE
.text C:\Windows\system32\services.exe[596] msvcrt.dll!_creat 777BED29 5 Bytes JMP 00440033
.text C:\Windows\system32\services.exe[596] msvcrt.dll!_wcreat 777C038E 5 Bytes JMP 00440044
.text C:\Windows\system32\services.exe[596] msvcrt.dll!_wopen 777C0570 5 Bytes JMP 00440FEF
.text C:\Windows\system32\services.exe[596] ADVAPI32.dll!RegOpenKeyA 7694D2ED 5 Bytes JMP 00430FEF
.text C:\Windows\system32\services.exe[596] ADVAPI32.dll!RegCreateKeyA 7694D3C1 5 Bytes JMP 00430F83
.text C:\Windows\system32\services.exe[596] ADVAPI32.dll!RegCreateKeyExA 76951B71 5 Bytes JMP 00430014
.text C:\Windows\system32\services.exe[596] ADVAPI32.dll!RegCreateKeyW 76951CC0 5 Bytes JMP 00430F68
.text C:\Windows\system32\services.exe[596] ADVAPI32.dll!RegOpenKeyW 76953129 5 Bytes JMP 00430FD4
.text C:\Windows\system32\services.exe[596] ADVAPI32.dll!RegCreateKeyExW 7695B946 5 Bytes JMP 00430F57
.text C:\Windows\system32\services.exe[596] ADVAPI32.dll!RegOpenKeyExA 7695BC0D 5 Bytes JMP 00430FAF
.text C:\Windows\system32\services.exe[596] ADVAPI32.dll!RegOpenKeyExW 7695BEC4 5 Bytes JMP 00430F9E
.text C:\Windows\system32\services.exe[596] WS2_32.dll!socket 765B3F00 5 Bytes JMP 00080FEF
.text C:\Windows\system32\lsass.exe[604] kernel32.dll!GetStartupInfoA 77BD1DF0 5 Bytes JMP 004F00AC
.text C:\Windows\system32\lsass.exe[604] kernel32.dll!CreateProcessW 77BD202D 5 Bytes JMP 004F0F5E
.text C:\Windows\system32\lsass.exe[604] kernel32.dll!CreateProcessA 77BD2062 5 Bytes JMP 004F00F3
.text C:\Windows\system32\lsass.exe[604] kernel32.dll!CreateNamedPipeW 77C01FD6 5 Bytes JMP 004F0047
.text C:\Windows\system32\lsass.exe[604] kernel32.dll!CreatePipe 77C04A8B 5 Bytes JMP 004F009B
.text C:\Windows\system32\lsass.exe[604] kernel32.dll!VirtualProtect 77C150AB 5 Bytes JMP 004F0F8D
.text C:\Windows\system32\lsass.exe[604] kernel32.dll!LoadLibraryExW 77C1B6BF 5 Bytes JMP 004F0F9E
.text C:\Windows\system32\lsass.exe[604] kernel32.dll!LoadLibraryExA 77C1BC8B 5 Bytes JMP 004F0FB9
.text C:\Windows\system32\lsass.exe[604] kernel32.dll!CreateFileW 77C20B7D 5 Bytes JMP 004F0011
.text C:\Windows\system32\lsass.exe[604] kernel32.dll!GetProcAddress 77C21857 5 Bytes JMP 004F0F43
.text C:\Windows\system32\lsass.exe[604] kernel32.dll!LoadLibraryA 77C22884 5 Bytes JMP 004F0FDB
.text C:\Windows\system32\lsass.exe[604] kernel32.dll!LoadLibraryW 77C228D2 5 Bytes JMP 004F0FCA
.text C:\Windows\system32\lsass.exe[604] kernel32.dll!CreateFileA 77C2291C 5 Bytes JMP 004F0000
.text C:\Windows\system32\lsass.exe[604] kernel32.dll!GetStartupInfoW 77C27CD5 5 Bytes JMP 004F00C7
.text C:\Windows\system32\lsass.exe[604] kernel32.dll!CreateNamedPipeA 77C5D5BF 5 Bytes JMP 004F002C
.text C:\Windows\system32\lsass.exe[604] kernel32.dll!WinExec 77C5E76D 5 Bytes JMP 004F00D8
.text C:\Windows\system32\lsass.exe[604] kernel32.dll!VirtualProtectEx 77C5F729 5 Bytes JMP 004F0080
.text C:\Windows\system32\lsass.exe[604] msvcrt.dll!_open 77787E48 5 Bytes JMP 004E0000
.text C:\Windows\system32\lsass.exe[604] msvcrt.dll!_wsystem 777BB04F 5 Bytes JMP 004E006E
.text C:\Windows\system32\lsass.exe[604] msvcrt.dll!system 777BB16F 5 Bytes JMP 004E0053
.text C:\Windows\system32\lsass.exe[604] msvcrt.dll!_creat 777BED29 5 Bytes JMP 004E0038
.text C:\Windows\system32\lsass.exe[604] msvcrt.dll!_wcreat 777C038E 5 Bytes JMP 004E0FE3
.text C:\Windows\system32\lsass.exe[604] msvcrt.dll!_wopen 777C0570 5 Bytes JMP 004E001D
.text C:\Windows\system32\lsass.exe[604] ADVAPI32.dll!RegOpenKeyA 7694D2ED 5 Bytes JMP 00210000
.text C:\Windows\system32\lsass.exe[604] ADVAPI32.dll!RegCreateKeyA 7694D3C1 5 Bytes JMP 00210FB9
.text C:\Windows\system32\lsass.exe[604] ADVAPI32.dll!RegCreateKeyExA 76951B71 3 Bytes JMP 00210054
.text C:\Windows\system32\lsass.exe[604] ADVAPI32.dll!RegCreateKeyExA + 4 76951B75 1 Byte [89]
.text C:\Windows\system32\lsass.exe[604] ADVAPI32.dll!RegCreateKeyW 76951CC0 3 Bytes JMP 00210FA8
.text C:\Windows\system32\lsass.exe[604] ADVAPI32.dll!RegCreateKeyW + 4 76951CC4 1 Byte [89]
.text C:\Windows\system32\lsass.exe[604] ADVAPI32.dll!RegOpenKeyW 76953129 3 Bytes JMP 00210FEF
.text C:\Windows\system32\lsass.exe[604] ADVAPI32.dll!RegOpenKeyW + 4 7695312D 1 Byte [89]
.text C:\Windows\system32\lsass.exe[604] ADVAPI32.dll!RegCreateKeyExW 7695B946 3 Bytes JMP 00210065
.text C:\Windows\system32\lsass.exe[604] ADVAPI32.dll!RegCreateKeyExW + 4 7695B94A 1 Byte [89]
.text C:\Windows\system32\lsass.exe[604] ADVAPI32.dll!RegOpenKeyExA 7695BC0D 3 Bytes JMP 0021001B
.text C:\Windows\system32\lsass.exe[604] ADVAPI32.dll!RegOpenKeyExA + 4 7695BC11 1 Byte [89]
.text C:\Windows\system32\lsass.exe[604] ADVAPI32.dll!RegOpenKeyExW 7695BEC4 3 Bytes JMP 00210FCA
.text C:\Windows\system32\lsass.exe[604] ADVAPI32.dll!RegOpenKeyExW + 4 7695BEC8 1 Byte [89]
.text C:\Windows\system32\lsass.exe[604] WS2_32.dll!socket 765B3F00 5 Bytes JMP 00200FEF
.text C:\Windows\system32\svchost.exe[712] kernel32.dll!GetStartupInfoA 77BD1DF0 5 Bytes JMP 008D0F21
.text C:\Windows\system32\svchost.exe[712] kernel32.dll!CreateProcessW 77BD202D 5 Bytes JMP 008D0EE1
.text C:\Windows\system32\svchost.exe[712] kernel32.dll!CreateProcessA 77BD2062 5 Bytes JMP 008D0076
.text C:\Windows\system32\svchost.exe[712] kernel32.dll!CreateNamedPipeW 77C01FD6 5 Bytes JMP 008D0FCA
.text C:\Windows\system32\svchost.exe[712] kernel32.dll!CreatePipe 77C04A8B 5 Bytes JMP 008D004A
.text C:\Windows\system32\svchost.exe[712] kernel32.dll!VirtualProtect 77C150AB 5 Bytes JMP 008D0F57
.text C:\Windows\system32\svchost.exe[712] kernel32.dll!LoadLibraryExW 77C1B6BF 5 Bytes JMP 008D0F72
.text C:\Windows\system32\svchost.exe[712] kernel32.dll!LoadLibraryExA 77C1BC8B 5 Bytes JMP 008D0F83
.text C:\Windows\system32\svchost.exe[712] kernel32.dll!CreateFileW 77C20B7D 5 Bytes JMP 008D001B
.text C:\Windows\system32\svchost.exe[712] kernel32.dll!GetProcAddress 77C21857 5 Bytes JMP 008D0091
.text C:\Windows\system32\svchost.exe[712] kernel32.dll!LoadLibraryA 77C22884 5 Bytes JMP 008D0FB9
.text C:\Windows\system32\svchost.exe[712] kernel32.dll!LoadLibraryW 77C228D2 5 Bytes JMP 008D0F94
.text C:\Windows\system32\svchost.exe[712] kernel32.dll!CreateFileA 77C2291C 5 Bytes JMP 008D0000
.text C:\Windows\system32\svchost.exe[712] kernel32.dll!GetStartupInfoW 77C27CD5 5 Bytes JMP 008D0065
.text C:\Windows\system32\svchost.exe[712] kernel32.dll!CreateNamedPipeA 77C5D5BF 5 Bytes JMP 008D0FE5
.text C:\Windows\system32\svchost.exe[712] kernel32.dll!WinExec 77C5E76D 5 Bytes JMP 008D0F06
.text C:\Windows\system32\svchost.exe[712] kernel32.dll!VirtualProtectEx 77C5F729 5 Bytes JMP 008D0F3C
.text C:\Windows\system32\svchost.exe[712] msvcrt.dll!_open 77787E48 5 Bytes JMP 008C000C
.text C:\Windows\system32\svchost.exe[712] msvcrt.dll!_wsystem 777BB04F 5 Bytes JMP 008C0055
.text C:\Windows\system32\svchost.exe[712] msvcrt.dll!system 777BB16F 5 Bytes JMP 008C0FCA
.text C:\Windows\system32\svchost.exe[712] msvcrt.dll!_creat 777BED29 5 Bytes JMP 008C003A
.text C:\Windows\system32\svchost.exe[712] msvcrt.dll!_wcreat 777C038E 5 Bytes JMP 008C0FE5
.text C:\Windows\system32\svchost.exe[712] msvcrt.dll!_wopen 777C0570 5 Bytes JMP 008C001D
.text C:\Windows\system32\svchost.exe[712] ADVAPI32.dll!RegOpenKeyA 7694D2ED 5 Bytes JMP 00450000
.text C:\Windows\system32\svchost.exe[712] ADVAPI32.dll!RegCreateKeyA 7694D3C1 5 Bytes JMP 00450F9E
.text C:\Windows\system32\svchost.exe[712] ADVAPI32.dll!RegCreateKeyExA 76951B71 5 Bytes JMP 00450036
.text C:\Windows\system32\svchost.exe[712] ADVAPI32.dll!RegCreateKeyW 76951CC0 5 Bytes JMP 00450025
.text C:\Windows\system32\svchost.exe[712] ADVAPI32.dll!RegOpenKeyW 76953129 5 Bytes JMP 00450FE5
.text C:\Windows\system32\svchost.exe[712] ADVAPI32.dll!RegCreateKeyExW 7695B946 5 Bytes JMP 00450F79
.text C:\Windows\system32\svchost.exe[712] ADVAPI32.dll!RegOpenKeyExA 7695BC0D 5 Bytes JMP 00450FCA
.text C:\Windows\system32\svchost.exe[712] ADVAPI32.dll!RegOpenKeyExW 7695BEC4 5 Bytes JMP 00450FB9
.text C:\Windows\system32\svchost.exe[712] WS2_32.dll!socket 765B3F00 5 Bytes JMP 00440FEF
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!GetStartupInfoA 77BD1DF0 5 Bytes JMP 006700BD
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!CreateProcessW 77BD202D 5 Bytes JMP 00670104
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!CreateProcessA 77BD2062 5 Bytes JMP 00670F6F
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!CreateNamedPipeW 77C01FD6 5 Bytes JMP 00670025
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!CreatePipe 77C04A8B 5 Bytes JMP 006700AC
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!VirtualProtect 77C150AB 5 Bytes JMP 00670F9E
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!LoadLibraryExW 77C1B6BF 5 Bytes JMP 0067006C
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!LoadLibraryExA 77C1BC8B 5 Bytes JMP 0067005B
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!CreateFileW 77C20B7D 5 Bytes JMP 00670FEF
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!GetProcAddress 77C21857 5 Bytes JMP 00670F54
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!LoadLibraryA 77C22884 5 Bytes JMP 00670FB9
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!LoadLibraryW 77C228D2 5 Bytes JMP 00670040
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!CreateFileA 77C2291C 5 Bytes JMP 0067000A
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!GetStartupInfoW 77C27CD5 5 Bytes JMP 006700D8
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!CreateNamedPipeA 77C5D5BF 5 Bytes JMP 00670FD4
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!WinExec 77C5E76D 5 Bytes JMP 006700E9
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!VirtualProtectEx 77C5F729 5 Bytes JMP 00670091
.text C:\Windows\system32\svchost.exe[784] msvcrt.dll!_open 77787E48 5 Bytes JMP 00350FEF
.text C:\Windows\system32\svchost.exe[784] msvcrt.dll!_wsystem 777BB04F 5 Bytes JMP 00350FA1
.text C:\Windows\system32\svchost.exe[784] msvcrt.dll!system 777BB16F 5 Bytes JMP 00350FB2
.text C:\Windows\system32\svchost.exe[784] msvcrt.dll!_creat 777BED29 5 Bytes JMP 00350011
.text C:\Windows\system32\svchost.exe[784] msvcrt.dll!_wcreat 777C038E 5 Bytes JMP 00350022
.text C:\Windows\system32\svchost.exe[784] msvcrt.dll!_wopen 777C0570 5 Bytes JMP 00350000
.text C:\Windows\system32\svchost.exe[784] ADVAPI32.dll!RegOpenKeyA 7694D2ED 5 Bytes JMP 0024000A
.text C:\Windows\system32\svchost.exe[784] ADVAPI32.dll!RegCreateKeyA 7694D3C1 5 Bytes JMP 00240025
.text C:\Windows\system32\svchost.exe[784] ADVAPI32.dll!RegCreateKeyExA 76951B71 5 Bytes JMP 00240F94
.text C:\Windows\system32\svchost.exe[784] ADVAPI32.dll!RegCreateKeyW 76951CC0 5 Bytes JMP 00240036
.text C:\Windows\system32\svchost.exe[784] ADVAPI32.dll!RegOpenKeyW 76953129 5 Bytes JMP 00240FEF
.text C:\Windows\system32\svchost.exe[784] ADVAPI32.dll!RegCreateKeyExW 7695B946 5 Bytes JMP 00240051
.text C:\Windows\system32\svchost.exe[784] ADVAPI32.dll!RegOpenKeyExA 7695BC0D 5 Bytes JMP 00240FCA
.text C:\Windows\system32\svchost.exe[784] ADVAPI32.dll!RegOpenKeyExW 7695BEC4 5 Bytes JMP 00240FB9
.text C:\Windows\system32\svchost.exe[784] WS2_32.dll!socket 765B3F00 5 Bytes JMP 001F000A
.text C:\Windows\System32\svchost.exe[852] kernel32.dll!GetStartupInfoA 77BD1DF0 5 Bytes JMP 00850087
.text C:\Windows\System32\svchost.exe[852] kernel32.dll!CreateProcessW 77BD202D 5 Bytes JMP 008500E9
.text C:\Windows\System32\svchost.exe[852] kernel32.dll!CreateProcessA 77BD2062 5 Bytes JMP 008500CE
.text C:\Windows\System32\svchost.exe[852] kernel32.dll!CreateNamedPipeW 77C01FD6 5 Bytes JMP 00850FB2
.text C:\Windows\System32\svchost.exe[852] kernel32.dll!CreatePipe 77C04A8B 5 Bytes JMP 00850076
.text C:\Windows\System32\svchost.exe[852] kernel32.dll!VirtualProtect 77C150AB 5 Bytes JMP 00850040
.text C:\Windows\System32\svchost.exe[852] kernel32.dll!LoadLibraryExW 77C1B6BF 5 Bytes JMP 00850F68
.text C:\Windows\System32\svchost.exe[852] kernel32.dll!LoadLibraryExA 77C1BC8B 5 Bytes JMP 00850025
.text C:\Windows\System32\svchost.exe[852] kernel32.dll!CreateFileW 77C20B7D 5 Bytes JMP 00850FDE
.text C:\Windows\System32\svchost.exe[852] kernel32.dll!GetProcAddress 77C21857 5 Bytes JMP 008500FA
.text C:\Windows\System32\svchost.exe[852] kernel32.dll!LoadLibraryA 77C22884 5 Bytes JMP 00850014
.text C:\Windows\System32\svchost.exe[852] kernel32.dll!LoadLibraryW 77C228D2 5 Bytes JMP 00850F83
.text C:\Windows\System32\svchost.exe[852] kernel32.dll!CreateFileA 77C2291C 5 Bytes JMP 00850FEF
.text C:\Windows\System32\svchost.exe[852] kernel32.dll!GetStartupInfoW 77C27CD5 5 Bytes JMP 00850098
.text C:\Windows\System32\svchost.exe[852] kernel32.dll!CreateNamedPipeA 77C5D5BF 5 Bytes JMP 00850FCD
.text C:\Windows\System32\svchost.exe[852] kernel32.dll!WinExec 77C5E76D 5 Bytes JMP 008500B3
.text C:\Windows\System32\svchost.exe[852] kernel32.dll!VirtualProtectEx 77C5F729 5 Bytes JMP 0085005B
.text C:\Windows\System32\svchost.exe[852] msvcrt.dll!_open 77787E48 5 Bytes JMP 00840000
.text C:\Windows\System32\svchost.exe[852] msvcrt.dll!_wsystem 777BB04F 5 Bytes JMP 00840FBC
.text C:\Windows\System32\svchost.exe[852] msvcrt.dll!system 777BB16F 5 Bytes JMP 0084003D
.text C:\Windows\System32\svchost.exe[852] msvcrt.dll!_creat 777BED29 5 Bytes JMP 00840FCD
.text C:\Windows\System32\svchost.exe[852] msvcrt.dll!_wcreat 777C038E 5 Bytes JMP 00840022
.text C:\Windows\System32\svchost.exe[852] msvcrt.dll!_wopen 777C0570 5 Bytes JMP 00840011
.text C:\Windows\System32\svchost.exe[852] ADVAPI32.dll!RegOpenKeyA 7694D2ED 5 Bytes JMP 007F0FEF
.text C:\Windows\System32\svchost.exe[852] ADVAPI32.dll!RegCreateKeyA 7694D3C1 5 Bytes JMP 007F0047
.text C:\Windows\System32\svchost.exe[852] ADVAPI32.dll!RegCreateKeyExA 76951B71 5 Bytes JMP 007F0073
.text C:\Windows\System32\svchost.exe[852] ADVAPI32.dll!RegCreateKeyW 76951CC0 5 Bytes JMP 007F0062
.text C:\Windows\System32\svchost.exe[852] ADVAPI32.dll!RegOpenKeyW 76953129 5 Bytes JMP 007F000A
.text C:\Windows\System32\svchost.exe[852] ADVAPI32.dll!RegCreateKeyExW 7695B946 5 Bytes JMP 007F0098
.text C:\Windows\System32\svchost.exe[852] ADVAPI32.dll!RegOpenKeyExA 7695BC0D 5 Bytes JMP 007F0025
.text C:\Windows\System32\svchost.exe[852] ADVAPI32.dll!RegOpenKeyExW 7695BEC4 5 Bytes JMP 007F0036
.text C:\Windows\System32\svchost.exe[852] WS2_32.dll!socket 765B3F00 5 Bytes JMP 006A0FEF
.text C:\Windows\System32\svchost.exe[924] kernel32.dll!GetStartupInfoA 77BD1DF0 5 Bytes JMP 00790F46
.text C:\Windows\System32\svchost.exe[924] kernel32.dll!CreateProcessW 77BD202D 5 Bytes JMP 007900A5
.text C:\Windows\System32\svchost.exe[924] kernel32.dll!CreateProcessA 77BD2062 5 Bytes JMP 00790F10
.text C:\Windows\System32\svchost.exe[924] kernel32.dll!CreateNamedPipeW 77C01FD6 5 Bytes JMP 00790FB9
.text C:\Windows\System32\svchost.exe[924] kernel32.dll!CreatePipe 77C04A8B 5 Bytes JMP 00790F57
.text C:\Windows\System32\svchost.exe[924] kernel32.dll!VirtualProtect 77C150AB 5 Bytes JMP 0079005B
.text C:\Windows\System32\svchost.exe[924] kernel32.dll!LoadLibraryExW 77C1B6BF 5 Bytes JMP 00790F83
.text C:\Windows\System32\svchost.exe[924] kernel32.dll!LoadLibraryExA 77C1BC8B 5 Bytes JMP 00790F9E
.text C:\Windows\System32\svchost.exe[924] kernel32.dll!CreateFileW 77C20B7D 5 Bytes JMP 00790FD4
.text C:\Windows\System32\svchost.exe[924] kernel32.dll!GetProcAddress 77C21857 5 Bytes JMP 007900B6
.text C:\Windows\System32\svchost.exe[924] kernel32.dll!LoadLibraryA 77C22884 5 Bytes JMP 00790025
.text C:\Windows\System32\svchost.exe[924] kernel32.dll!LoadLibraryW 77C228D2 5 Bytes JMP 00790040
.text C:\Windows\System32\svchost.exe[924] kernel32.dll!CreateFileA 77C2291C 5 Bytes JMP 00790FEF
.text C:\Windows\System32\svchost.exe[924] kernel32.dll!GetStartupInfoW 77C27CD5 5 Bytes JMP 00790080
.text C:\Windows\System32\svchost.exe[924] kernel32.dll!CreateNamedPipeA 77C5D5BF 5 Bytes JMP 0079000A
.text C:\Windows\System32\svchost.exe[924] kernel32.dll!WinExec 77C5E76D 5 Bytes JMP 00790F21
.text C:\Windows\System32\svchost.exe[924] kernel32.dll!VirtualProtectEx 77C5F729 5 Bytes JMP 00790F68
.text C:\Windows\System32\svchost.exe[924] msvcrt.dll!_open 77787E48 5 Bytes JMP 00740FEF
.text C:\Windows\System32\svchost.exe[924] msvcrt.dll!_wsystem 777BB04F 5 Bytes JMP 00740051
.text C:\Windows\System32\svchost.exe[924] msvcrt.dll!system 777BB16F 5 Bytes JMP 00740040
.text C:\Windows\System32\svchost.exe[924] msvcrt.dll!_creat 777BED29 5 Bytes JMP 0074000A
.text C:\Windows\System32\svchost.exe[924] msvcrt.dll!_wcreat 777C038E 5 Bytes JMP 00740025
.text C:\Windows\System32\svchost.exe[924] msvcrt.dll!_wopen 777C0570 5 Bytes JMP 00740FD2
.text C:\Windows\System32\svchost.exe[924] ADVAPI32.dll!RegOpenKeyA 7694D2ED 5 Bytes JMP 00550000
.text C:\Windows\System32\svchost.exe[924] ADVAPI32.dll!RegCreateKeyA 7694D3C1 5 Bytes JMP 0055006C
.text C:\Windows\System32\svchost.exe[924] ADVAPI32.dll!RegCreateKeyExA 76951B71 5 Bytes JMP 00550FD4
.text C:\Windows\System32\svchost.exe[924] ADVAPI32.dll!RegCreateKeyW 76951CC0 5 Bytes JMP 00550FEF
.text C:\Windows\System32\svchost.exe[924] ADVAPI32.dll!RegOpenKeyW 76953129 5 Bytes JMP 00550025
.text C:\Windows\System32\svchost.exe[924] ADVAPI32.dll!RegCreateKeyExW 7695B946 5 Bytes JMP 00550FC3
.text C:\Windows\System32\svchost.exe[924] ADVAPI32.dll!RegOpenKeyExA 7695BC0D 5 Bytes JMP 00550040
.text C:\Windows\System32\svchost.exe[924] ADVAPI32.dll!RegOpenKeyExW 7695BEC4 5 Bytes JMP 0055005B
.text C:\Windows\System32\svchost.exe[924] WS2_32.dll!socket 765B3F00 5 Bytes JMP 00540FEF
.text C:\Windows\system32\svchost.exe[952] kernel32.dll!GetStartupInfoA 77BD1DF0 5 Bytes JMP 00D40091
.text C:\Windows\system32\svchost.exe[952] kernel32.dll!CreateProcessW 77BD202D 5 Bytes JMP 00D40F28
.text C:\Windows\system32\svchost.exe[952] kernel32.dll!CreateProcessA 77BD2062 5 Bytes JMP 00D400B3
.text C:\Windows\system32\svchost.exe[952] kernel32.dll!CreateNamedPipeW 77C01FD6 5 Bytes JMP 00D4002F
.text C:\Windows\system32\svchost.exe[952] kernel32.dll!CreatePipe 77C04A8B 5 Bytes JMP 00D40F68
.text C:\Windows\system32\svchost.exe[952] kernel32.dll!VirtualProtect 77C150AB 5 Bytes JMP 00D4006C
.text C:\Windows\system32\svchost.exe[952] kernel32.dll!LoadLibraryExW 77C1B6BF 5 Bytes JMP 00D40F94
.text C:\Windows\system32\svchost.exe[952] kernel32.dll!LoadLibraryExA 77C1BC8B 5 Bytes JMP 00D4005B
.text C:\Windows\system32\svchost.exe[952] kernel32.dll!CreateFileW 77C20B7D 5 Bytes JMP 00D40FDE
.text C:\Windows\system32\svchost.exe[952] kernel32.dll!GetProcAddress 77C21857 5 Bytes JMP 00D400D8
.text C:\Windows\system32\svchost.exe[952] kernel32.dll!LoadLibraryA 77C22884 5 Bytes JMP 00D4004A
.text C:\Windows\system32\svchost.exe[952] kernel32.dll!LoadLibraryW 77C228D2 5 Bytes JMP 00D40FC3
.text C:\Windows\system32\svchost.exe[952] kernel32.dll!CreateFileA 77C2291C 5 Bytes JMP 00D40FEF
.text C:\Windows\system32\svchost.exe[952] kernel32.dll!GetStartupInfoW 77C27CD5 5 Bytes JMP 00D40F4D
.text C:\Windows\system32\svchost.exe[952] kernel32.dll!CreateNamedPipeA 77C5D5BF 5 Bytes JMP 00D40014
.text C:\Windows\system32\svchost.exe[952] kernel32.dll!WinExec 77C5E76D 5 Bytes JMP 00D400A2
.text C:\Windows\system32\svchost.exe[952] kernel32.dll!VirtualProtectEx 77C5F729 5 Bytes JMP 00D40F83
.text C:\Windows\system32\svchost.exe[952] msvcrt.dll!_open 77787E48 5 Bytes JMP 00BF0000
.text C:\Windows\system32\svchost.exe[952] msvcrt.dll!_wsystem 777BB04F 5 Bytes JMP 00BF0FBE
.text C:\Windows\system32\svchost.exe[952] msvcrt.dll!system 777BB16F 5 Bytes JMP 00BF0049
.text C:\Windows\system32\svchost.exe[952] msvcrt.dll!_creat 777BED29 5 Bytes JMP 00BF001D
.text C:\Windows\system32\svchost.exe[952] msvcrt.dll!_wcreat 777C038E 5 Bytes JMP 00BF002E
.text C:\Windows\system32\svchost.exe[952] msvcrt.dll!_wopen 777C0570 5 Bytes JMP 00BF0FE3
.text C:\Windows\system32\svchost.exe[952] ADVAPI32.dll!RegOpenKeyA 7694D2ED 5 Bytes JMP 00890FE5
.text C:\Windows\system32\svchost.exe[952] ADVAPI32.dll!RegCreateKeyA 7694D3C1 5 Bytes JMP 00890FCA
.text C:\Windows\system32\svchost.exe[952] ADVAPI32.dll!RegCreateKeyExA 76951B71 5 Bytes JMP 0089006C
.text C:\Windows\system32\svchost.exe[952] ADVAPI32.dll!RegCreateKeyW 76951CC0 5 Bytes JMP 00890051
.text C:\Windows\system32\svchost.exe[952] ADVAPI32.dll!RegOpenKeyW 76953129 5 Bytes JMP 0089000A
.text C:\Windows\system32\svchost.exe[952] ADVAPI32.dll!RegCreateKeyExW 7695B946 5 Bytes JMP 00890FAF
.text C:\Windows\system32\svchost.exe[952] ADVAPI32.dll!RegOpenKeyExA 7695BC0D 5 Bytes JMP 0089001B
.text C:\Windows\system32\svchost.exe[952] ADVAPI32.dll!RegOpenKeyExW 7695BEC4 5 Bytes JMP 00890036
.text C:\Windows\system32\svchost.exe[952] WS2_32.dll!socket 765B3F00 5 Bytes JMP 00800000
.text C:\Windows\system32\svchost.exe[1092] kernel32.dll!GetStartupInfoA 77BD1DF0 5 Bytes JMP 005C0098
.text C:\Windows\system32\svchost.exe[1092] kernel32.dll!CreateProcessW 77BD202D 5 Bytes JMP 005C0F2F
.text C:\Windows\system32\svchost.exe[1092] kernel32.dll!CreateProcessA 77BD2062 5 Bytes JMP 005C0F40
.text C:\Windows\system32\svchost.exe[1092] kernel32.dll!CreateNamedPipeW 77C01FD6 5 Bytes JMP 005C0022
.text C:\Windows\system32\svchost.exe[1092] kernel32.dll!CreatePipe 77C04A8B 5 Bytes JMP 005C0087
.text C:\Windows\system32\svchost.exe[1092] kernel32.dll!VirtualProtect 77C150AB 5 Bytes JMP 005C0F79
.text C:\Windows\system32\svchost.exe[1092] kernel32.dll!LoadLibraryExW 77C1B6BF 5 Bytes JMP 005C0F94
.text C:\Windows\system32\svchost.exe[1092] kernel32.dll!LoadLibraryExA 77C1BC8B 5 Bytes JMP 005C0FA5
.text C:\Windows\system32\svchost.exe[1092] kernel32.dll!CreateFileW 77C20B7D 5 Bytes JMP 005C0011
.text C:\Windows\system32\svchost.exe[1092] kernel32.dll!GetProcAddress 77C21857 5 Bytes JMP 005C0F1E
.text C:\Windows\system32\svchost.exe[1092] kernel32.dll!LoadLibraryA 77C22884 5 Bytes JMP 005C003D
.text C:\Windows\system32\svchost.exe[1092] kernel32.dll!LoadLibraryW 77C228D2 5 Bytes JMP 005C0FB6
.text C:\Windows\system32\svchost.exe[1092] kernel32.dll!CreateFileA 77C2291C 5 Bytes JMP 005C0000
.text C:\Windows\system32\svchost.exe[1092] kernel32.dll!GetStartupInfoW 77C27CD5 5 Bytes JMP 005C00A9
.text C:\Windows\system32\svchost.exe[1092] kernel32.dll!CreateNamedPipeA 77C5D5BF 5 Bytes JMP 005C0FDB
.text C:\Windows\system32\svchost.exe[1092] kernel32.dll!WinExec 77C5E76D 5 Bytes JMP 005C00C4
.text C:\Windows\system32\svchost.exe[1092] kernel32.dll!VirtualProtectEx 77C5F729 5 Bytes JMP 005C006C
.text C:\Windows\system32\svchost.exe[1092] msvcrt.dll!_open 77787E48 5 Bytes JMP 00250FEF
.text C:\Windows\system32\svchost.exe[1092] msvcrt.dll!_wsystem 777BB04F 5 Bytes JMP 00250F90
.text C:\Windows\system32\svchost.exe[1092] msvcrt.dll!system 777BB16F 5 Bytes JMP 00250FA1
.text C:\Windows\system32\svchost.exe[1092] msvcrt.dll!_creat 777BED29 5 Bytes JMP 00250FCD
.text C:\Windows\system32\svchost.exe[1092] msvcrt.dll!_wcreat 777C038E 5 Bytes JMP 00250FB2
.text C:\Windows\system32\svchost.exe[1092] msvcrt.dll!_wopen 777C0570 5 Bytes JMP 00250FDE
.text C:\Windows\system32\svchost.exe[1092] ADVAPI32.dll!RegOpenKeyA 7694D2ED 5 Bytes JMP 00240FEF
.text C:\Windows\system32\svchost.exe[1092] ADVAPI32.dll!RegCreateKeyA 7694D3C1 5 Bytes JMP 00240014
.text C:\Windows\system32\svchost.exe[1092] ADVAPI32.dll!RegCreateKeyExA 76951B71 5 Bytes JMP 00240036
.text C:\Windows\system32\svchost.exe[1092] ADVAPI32.dll!RegCreateKeyW 76951CC0 5 Bytes JMP 00240025
.text C:\Windows\system32\svchost.exe[1092] ADVAPI32.dll!RegOpenKeyW 76953129 5 Bytes JMP 00240FD4
.text C:\Windows\system32\svchost.exe[1092] ADVAPI32.dll!RegCreateKeyExW 7695B946 5 Bytes JMP 00240F79
.text C:\Windows\system32\svchost.exe[1092] ADVAPI32.dll!RegOpenKeyExA 7695BC0D 5 Bytes JMP 00240FC3
.text C:\Windows\system32\svchost.exe[1092] ADVAPI32.dll!RegOpenKeyExW 7695BEC4 5 Bytes JMP 00240FA8
.text C:\Windows\system32\svchost.exe[1092] WS2_32.dll!socket 765B3F00 5 Bytes JMP 00230000
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!GetStartupInfoA 77BD1DF0 5 Bytes JMP 004D009B
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!CreateProcessW 77BD202D 5 Bytes JMP 004D0F2B
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!CreateProcessA 77BD2062 5 Bytes JMP 004D0F3C
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!CreateNamedPipeW 77C01FD6 5 Bytes JMP 004D005B
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!CreatePipe 77C04A8B 5 Bytes JMP 004D0F7C
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!VirtualProtect 77C150AB 3 Bytes JMP 004D0FA8
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!VirtualProtect + 4 77C150AF 1 Byte [88]
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!LoadLibraryExW 77C1B6BF 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!LoadLibraryExW 77C1B6BF 3 Bytes JMP 004D0FC3
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!LoadLibraryExW + 4 77C1B6C3 1 Byte [88]
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!LoadLibraryExA 77C1BC8B 3 Bytes JMP 004D0FD4
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!LoadLibraryExA + 4 77C1BC8F 1 Byte [88]
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!CreateFileW 77C20B7D 5 Bytes JMP 004D0025
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!GetProcAddress 77C21857 5 Bytes JMP 004D00D1
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!LoadLibraryA 77C22884 5 Bytes JMP 004D006C
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!LoadLibraryW 77C228D2 5 Bytes JMP 004D0FE5
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!CreateFileA 77C2291C 5 Bytes JMP 004D0000
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!GetStartupInfoW 77C27CD5 5 Bytes JMP 004D0F57
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!CreateNamedPipeA 77C5D5BF 5 Bytes JMP 004D0040
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!WinExec 77C5E76D 5 Bytes JMP 004D00B6
.text C:\Windows\system32\svchost.exe[1180] kernel32.dll!VirtualProtectEx 77C5F729 5 Bytes JMP 004D0F8D
.text C:\Windows\system32\svchost.exe[1180] msvcrt.dll!_open 77787E48 5 Bytes JMP 004C0000
.text C:\Windows\system32\svchost.exe[1180] msvcrt.dll!_wsystem 777BB04F 5 Bytes JMP 004C004E
.text C:\Windows\system32\svchost.exe[1180] msvcrt.dll!system 777BB16F 5 Bytes JMP 004C0FC3
.text C:\Windows\system32\svchost.exe[1180] msvcrt.dll!_creat 777BED29 5 Bytes JMP 004C0FD4
.text C:\Windows\system32\svchost.exe[1180] msvcrt.dll!_wcreat 777C038E 5 Bytes JMP 004C0033
.text C:\Windows\system32\svchost.exe[1180] msvcrt.dll!_wopen 777C0570 5 Bytes JMP 004C0FEF
.text C:\Windows\system32\svchost.exe[1180] ADVAPI32.dll!RegOpenKeyA 7694D2ED 5 Bytes JMP 004B0FEF
.text C:\Windows\system32\svchost.exe[1180] ADVAPI32.dll!RegCreateKeyA 7694D3C1 5 Bytes JMP 004B002C
.text C:\Windows\system32\svchost.exe[1180] ADVAPI32.dll!RegCreateKeyExA 76951B71 5 Bytes JMP 004B0F9B
.text C:\Windows\system32\svchost.exe[1180] ADVAPI32.dll!RegCreateKeyW 76951CC0 5 Bytes JMP 004B003D
.text C:\Windows\system32\svchost.exe[1180] ADVAPI32.dll!RegOpenKeyW 76953129 5 Bytes JMP 004B000A
.text C:\Windows\system32\svchost.exe[1180] ADVAPI32.dll!RegCreateKeyExW 7695B946 5 Bytes JMP 004B0062
.text C:\Windows\system32\svchost.exe[1180] ADVAPI32.dll!RegOpenKeyExA 7695BC0D 5 Bytes JMP 004B0FD4
.text C:\Windows\system32\svchost.exe[1180] ADVAPI32.dll!RegOpenKeyExW 7695BEC4 5 Bytes JMP 004B001B
.text C:\Windows\system32\svchost.exe[1180] WS2_32.dll!socket 765B3F00 5 Bytes JMP 00420000
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!GetStartupInfoA 77BD1DF0 5 Bytes JMP 008200A5
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!CreateProcessW 77BD202D 5 Bytes JMP 00820F32
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!CreateProcessA 77BD2062 5 Bytes JMP 008200D1
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!CreateNamedPipeW 77C01FD6 5 Bytes JMP 00820FCA
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!CreatePipe 77C04A8B 5 Bytes JMP 00820F72
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!VirtualProtect 77C150AB 5 Bytes JMP 0082006F
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!LoadLibraryExW 77C1B6BF 5 Bytes JMP 00820F8D
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!LoadLibraryExA 77C1BC8B 5 Bytes JMP 00820FA8
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!CreateFileW 77C20B7D 5 Bytes JMP 00820FE5
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!GetProcAddress 77C21857 5 Bytes JMP 00820F17
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!LoadLibraryA 77C22884 5 Bytes JMP 00820040
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!LoadLibraryW 77C228D2 5 Bytes JMP 00820FB9
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!CreateFileA 77C2291C 5 Bytes JMP 00820000
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!GetStartupInfoW 77C27CD5 5 Bytes JMP 00820F57
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!CreateNamedPipeA 77C5D5BF 5 Bytes JMP 0082001B
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!WinExec 77C5E76D 5 Bytes JMP 008200B6
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!VirtualProtectEx 77C5F729 5 Bytes JMP 00820080
.text C:\Windows\system32\svchost.exe[1396] msvcrt.dll!_open 77787E48 5 Bytes JMP 00750FE3
.text C:\Windows\system32\svchost.exe[1396] msvcrt.dll!_wsystem 777BB04F 5 Bytes JMP 0075005A
.text C:\Windows\system32\svchost.exe[1396] msvcrt.dll!system 777BB16F 5 Bytes JMP 00750049
.text C:\Windows\system32\svchost.exe[1396] msvcrt.dll!_creat 777BED29 5 Bytes JMP 00750027
.text C:\Windows\system32\svchost.exe[1396] msvcrt.dll!_wcreat 777C038E 5 Bytes JMP 00750038
.text C:\Windows\system32\svchost.exe[1396] msvcrt.dll!_wopen 777C0570 5 Bytes JMP 00750000
.text C:\Windows\system32\svchost.exe[1396] ADVAPI32.dll!RegOpenKeyA 7694D2ED 5 Bytes JMP 00740000
.text C:\Windows\system32\svchost.exe[1396] ADVAPI32.dll!RegCreateKeyA 7694D3C1 5 Bytes JMP 00740047
.text C:\Windows\system32\svchost.exe[1396] ADVAPI32.dll!RegCreateKeyExA 76951B71 5 Bytes JMP 00740073
.text C:\Windows\system32\svchost.exe[1396] ADVAPI32.dll!RegCreateKeyW 76951CC0 5 Bytes JMP 00740062
.text C:\Windows\system32\svchost.exe[1396] ADVAPI32.dll!RegOpenKeyW 76953129 5 Bytes JMP 00740011
.text C:\Windows\system32\svchost.exe[1396] ADVAPI32.dll!RegCreateKeyExW 7695B946 5 Bytes JMP 00740098
.text C:\Windows\system32\svchost.exe[1396] ADVAPI32.dll!RegOpenKeyExA 7695BC0D 5 Bytes JMP 00740FDB
.text C:\Windows\system32\svchost.exe[1396] ADVAPI32.dll!RegOpenKeyExW 7695BEC4 5 Bytes JMP 0074002C
.text C:\Windows\system32\svchost.exe[1396] WS2_32.dll!socket 765B3F00 5 Bytes JMP 006B0000
.text C:\Windows\Explorer.exe[1588] kernel32.dll!GetStartupInfoA 77BD1DF0 5 Bytes JMP 03BF0076
.text C:\Windows\Explorer.exe[1588] kernel32.dll!CreateProcessW 77BD202D 5 Bytes JMP 03BF00BD
.text C:\Windows\Explorer.exe[1588] kernel32.dll!CreateProcessA 77BD2062 5 Bytes JMP 03BF00A2
.text C:\Windows\Explorer.exe[1588] kernel32.dll!CreateNamedPipeW 77C01FD6 5 Bytes JMP 03BF000A
.text C:\Windows\Explorer.exe[1588] kernel32.dll!CreatePipe 77C04A8B 5 Bytes JMP 03BF0065
.text C:\Windows\Explorer.exe[1588] kernel32.dll!VirtualProtect 77C150AB 5 Bytes JMP 03BF0F72
.text C:\Windows\Explorer.exe[1588] kernel32.dll!LoadLibraryExW 77C1B6BF 5 Bytes JMP 03BF0F83
.text C:\Windows\Explorer.exe[1588] kernel32.dll!LoadLibraryExA 77C1BC8B 5 Bytes JMP 03BF0040
.text C:\Windows\Explorer.exe[1588] kernel32.dll!CreateFileW 77C20B7D 5 Bytes JMP 03BF0FD4
.text C:\Windows\Explorer.exe[1588] kernel32.dll!GetProcAddress 77C21857 5 Bytes JMP 03BF0F17
.text C:\Windows\Explorer.exe[1588] kernel32.dll!LoadLibraryA 77C22884 5 Bytes JMP 03BF0F9E
.text C:\Windows\Explorer.exe[1588] kernel32.dll!LoadLibraryW 77C228D2 5 Bytes JMP 03BF002F
.text C:\Windows\Explorer.exe[1588] kernel32.dll!CreateFileA 77C2291C 5 Bytes JMP 03BF0FE5
.text C:\Windows\Explorer.exe[1588] kernel32.dll!GetStartupInfoW 77C27CD5 5 Bytes JMP 03BF0F32
.text C:\Windows\Explorer.exe[1588] kernel32.dll!CreateNamedPipeA 77C5D5BF 5 Bytes JMP 03BF0FB9
.text C:\Windows\Explorer.exe[1588] kernel32.dll!WinExec 77C5E76D 5 Bytes JMP 03BF0091
.text C:\Windows\Explorer.exe[1588] kernel32.dll!VirtualProtectEx 77C5F729 5 Bytes JMP 03BF0F61
.text C:\Windows\Explorer.exe[1588] ADVAPI32.dll!RegOpenKeyA 7694D2ED 5 Bytes JMP 03440FEF
.text C:\Windows\Explorer.exe[1588] ADVAPI32.dll!RegCreateKeyA 7694D3C1 5 Bytes JMP 03440FC3
.text C:\Windows\Explorer.exe[1588] ADVAPI32.dll!RegCreateKeyExA 76951B71 5 Bytes JMP 03440054
.text C:\Windows\Explorer.exe[1588] ADVAPI32.dll!RegCreateKeyW 76951CC0 5 Bytes JMP 03440FB2
.text C:\Windows\Explorer.exe[1588] ADVAPI32.dll!RegOpenKeyW 76953129 5 Bytes JMP 03440FDE
.text C:\Windows\Explorer.exe[1588] ADVAPI32.dll!RegCreateKeyExW 7695B946 5 Bytes JMP 03440F97
.text C:\Windows\Explorer.exe[1588] ADVAPI32.dll!RegOpenKeyExA 7695BC0D 5 Bytes JMP 0344001E
.text C:\Windows\Explorer.exe[1588] ADVAPI32.dll!RegOpenKeyExW 7695BEC4 5 Bytes JMP 03440039
.text C:\Windows\Explorer.exe[1588] msvcrt.dll!_open 77787E48 5 Bytes JMP 03450000
.text C:\Windows\Explorer.exe[1588] msvcrt.dll!_wsystem 777BB04F 5 Bytes JMP 0345005A
.text C:\Windows\Explorer.exe[1588] msvcrt.dll!system 777BB16F 5 Bytes JMP 03450049
.text C:\Windows\Explorer.exe[1588] msvcrt.dll!_creat 777BED29 5 Bytes JMP 03450038
.text C:\Windows\Explorer.exe[1588] msvcrt.dll!_wcreat 777C038E 5 Bytes JMP 03450FE3
.text C:\Windows\Explorer.exe[1588] msvcrt.dll!_wopen 777C0570 5 Bytes JMP 0345001D
.text C:\Windows\Explorer.exe[1588] SHELL32.dll!SHEvaluateSystemCommandTemplate + 58A2 76B7E254 4 Bytes [80, 1B, 00, 10]
.text C:\Windows\Explorer.exe[1588] WS2_32.dll!socket 765B3F00 5 Bytes JMP 03430FEF
.text C:\Windows\Explorer.exe[1588] WININET.dll!InternetOpenA 75FA7E1C 5 Bytes JMP 02380000
.text C:\Windows\Explorer.exe[1588] WININET.dll!InternetOpenW 75FA9DA0 5 Bytes JMP 0238001B
.text C:\Windows\Explorer.exe[1588] WININET.dll!InternetOpenUrlA 75FADC18 5 Bytes JMP 02380FE5
.text C:\Windows\Explorer.exe[1588] WININET.dll!InternetOpenUrlW 75FFDC34 5 Bytes JMP 02380FCA
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1820] kernel32.dll!LoadLibraryA 77C22884 5 Bytes JMP 0041C130 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1820] kernel32.dll!LoadLibraryW 77C228D2 5 Bytes JMP 0041C1B0 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\Windows\system32\svchost.exe[2328] kernel32.dll!GetStartupInfoA 77BD1DF0 5 Bytes JMP 00300F46
.text C:\Windows\system32\svchost.exe[2328] kernel32.dll!CreateProcessW 77BD202D 5 Bytes JMP 003000B6
.text C:\Windows\system32\svchost.exe[2328] kernel32.dll!CreateProcessA 77BD2062 5 Bytes JMP 003000A5
.text C:\Windows\system32\svchost.exe[2328] kernel32.dll!CreateNamedPipeW 77C01FD6 5 Bytes JMP 00300FB9
.text C:\Windows\system32\svchost.exe[2328] kernel32.dll!CreatePipe 77C04A8B 5 Bytes JMP 00300079
.text C:\Windows\system32\svchost.exe[2328] kernel32.dll!VirtualProtect 77C150AB 5 Bytes JMP 00300F72
.text C:\Windows\system32\svchost.exe[2328] kernel32.dll!LoadLibraryExW 77C1B6BF 5 Bytes JMP 00300F83
.text C:\Windows\system32\svchost.exe[2328] kernel32.dll!LoadLibraryExA 77C1BC8B 5 Bytes JMP 0030004A
.text C:\Windows\system32\svchost.exe[2328] kernel32.dll!CreateFileW 77C20B7D 5 Bytes JMP 00300FE5
.text C:\Windows\system32\svchost.exe[2328] kernel32.dll!GetProcAddress 77C21857 5 Bytes JMP 00300EFC
.text C:\Windows\system32\svchost.exe[2328] kernel32.dll!LoadLibraryA 77C22884 5 Bytes JMP 00300FA8
.text C:\Windows\system32\svchost.exe[2328] kernel32.dll!LoadLibraryW 77C228D2 5 Bytes JMP 0030002F
.text C:\Windows\system32\svchost.exe[2328] kernel32.dll!CreateFileA 77C2291C 5 Bytes JMP 00300000
.text C:\Windows\system32\svchost.exe[2328] kernel32.dll!GetStartupInfoW 77C27CD5 5 Bytes JMP 00300F2B
.text C:\Windows\system32\svchost.exe[2328] kernel32.dll!CreateNamedPipeA 77C5D5BF 5 Bytes JMP 00300FD4
.text C:\Windows\system32\svchost.exe[2328] kernel32.dll!WinExec 77C5E76D 5 Bytes JMP 00300094
.text C:\Windows\system32\svchost.exe[2328] kernel32.dll!VirtualProtectEx 77C5F729 5 Bytes JMP 00300F61
.text C:\Windows\system32\svchost.exe[2328] msvcrt.dll!_open 77787E48 5 Bytes JMP 002F0000
.text C:\Windows\system32\svchost.exe[2328] msvcrt.dll!_wsystem 777BB04F 5 Bytes JMP 002F0FBE
.text C:\Windows\system32\svchost.exe[2328] msvcrt.dll!system 777BB16F 5 Bytes JMP 002F0049
.text C:\Windows\system32\svchost.exe[2328] msvcrt.dll!_creat 777BED29 5 Bytes JMP 002F0FD9
.text C:\Windows\system32\svchost.exe[2328] msvcrt.dll!_wcreat 777C038E 5 Bytes JMP 002F002E
.text C:\Windows\system32\svchost.exe[2328] msvcrt.dll!_wopen 777C0570 5 Bytes JMP 002F001D
.text C:\Windows\system32\svchost.exe[2328] ADVAPI32.dll!RegOpenKeyA 7694D2ED 5 Bytes JMP 002E0FEF
.text C:\Windows\system32\svchost.exe[2328] ADVAPI32.dll!RegCreateKeyA 7694D3C1 5 Bytes JMP 002E0022
.text C:\Windows\system32\svchost.exe[2328] ADVAPI32.dll!RegCreateKeyExA 76951B71 5 Bytes JMP 002E0F8A
.text C:\Windows\system32\svchost.exe[2328] ADVAPI32.dll!RegCreateKeyW 76951CC0 5 Bytes JMP 002E0F9B
.text C:\Windows\system32\svchost.exe[2328] ADVAPI32.dll!RegOpenKeyW 76953129 5 Bytes JMP 002E0000
.text C:\Windows\system32\svchost.exe[2328] ADVAPI32.dll!RegCreateKeyExW 7695B946 5 Bytes JMP 002E0047
.text C:\Windows\system32\svchost.exe[2328] ADVAPI32.dll!RegOpenKeyExA 7695BC0D 5 Bytes JMP 002E0FC0
.text C:\Windows\system32\svchost.exe[2328] ADVAPI32.dll!RegOpenKeyExW 7695BEC4 5 Bytes JMP 002E0011
.text C:\Windows\system32\svchost.exe[2328] WS2_32.dll!socket 765B3F00 5 Bytes JMP 002D0000
.text C:\Program Files\Mozilla Firefox\firefox.exe[3544] ntdll.dll!LdrLoadDll 77ADF585 5 Bytes JMP 009813F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text C:\Windows\system32\svchost.exe[3616] kernel32.dll!GetStartupInfoA 77BD1DF0 5 Bytes JMP 00010F32
.text C:\Windows\system32\svchost.exe[3616] kernel32.dll!CreateProcessW 77BD202D 5 Bytes JMP 00010EF2
.text C:\Windows\system32\svchost.exe[3616] kernel32.dll!CreateProcessA 77BD2062 5 Bytes JMP 00010F0D
.text C:\Windows\system32\svchost.exe[3616] kernel32.dll!CreateNamedPipeW 77C01FD6 5 Bytes JMP 00010FD4
.text C:\Windows\system32\svchost.exe[3616] kernel32.dll!CreatePipe 77C04A8B 5 Bytes JMP 00010065
.text C:\Windows\system32\svchost.exe[3616] kernel32.dll!VirtualProtect 77C150AB 5 Bytes JMP 00010F72
.text C:\Windows\system32\svchost.exe[3616] kernel32.dll!LoadLibraryExW 77C1B6BF 5 Bytes JMP 0001004A
.text C:\Windows\system32\svchost.exe[3616] kernel32.dll!LoadLibraryExA 77C1BC8B 5 Bytes JMP 00010F8D
.text C:\Windows\system32\svchost.exe[3616] kernel32.dll!CreateFileW 77C20B7D 5 Bytes JMP 0001000A
.text C:\Windows\system32\svchost.exe[3616] kernel32.dll!GetProcAddress 77C21857 5 Bytes JMP 00010ED7
.text C:\Windows\system32\svchost.exe[3616] kernel32.dll!LoadLibraryA 77C22884 5 Bytes JMP 00010FB9
.text C:\Windows\system32\svchost.exe[3616] kernel32.dll!LoadLibraryW 77C228D2 5 Bytes JMP 00010F9E
.text C:\Windows\system32\svchost.exe[3616] kernel32.dll!CreateFileA 77C2291C 5 Bytes JMP 00010FE5
.text C:\Windows\system32\svchost.exe[3616] kernel32.dll!GetStartupInfoW 77C27CD5 5 Bytes JMP 00010076
.text C:\Windows\system32\svchost.exe[3616] kernel32.dll!CreateNamedPipeA 77C5D5BF 5 Bytes JMP 0001001B
.text C:\Windows\system32\svchost.exe[3616] kernel32.dll!WinExec 77C5E76D 5 Bytes JMP 00010087
.text C:\Windows\system32\svchost.exe[3616] kernel32.dll!VirtualProtectEx 77C5F729 5 Bytes JMP 00010F61
.text C:\Windows\system32\svchost.exe[3616] msvcrt.dll!_open 77787E48 5 Bytes JMP 00110FE3
.text C:\Windows\system32\svchost.exe[3616] msvcrt.dll!_wsystem 777BB04F 5 Bytes JMP 00110F9C
.text C:\Windows\system32\svchost.exe[3616] msvcrt.dll!system 777BB16F 5 Bytes JMP 00110FAD
.text C:\Windows\system32\svchost.exe[3616] msvcrt.dll!_creat 777BED29 5 Bytes JMP 0011000C
.text C:\Windows\system32\svchost.exe[3616] msvcrt.dll!_wcreat 777C038E 5 Bytes JMP 0011001D
.text C:\Windows\system32\svchost.exe[3616] msvcrt.dll!_wopen 777C0570 5 Bytes JMP 00110FD2
.text C:\Windows\system32\svchost.exe[3616] ADVAPI32.dll!RegOpenKeyA 7694D2ED 5 Bytes JMP 00150FEF
.text C:\Windows\system32\svchost.exe[3616] ADVAPI32.dll!RegCreateKeyA 7694D3C1 5 Bytes JMP 0015003D
.text C:\Windows\system32\svchost.exe[3616] ADVAPI32.dll!RegCreateKeyExA 76951B71 5 Bytes JMP 00150073
.text C:\Windows\system32\svchost.exe[3616] ADVAPI32.dll!RegCreateKeyW 76951CC0 5 Bytes JMP 00150062
.text C:\Windows\system32\svchost.exe[3616] ADVAPI32.dll!RegOpenKeyW 76953129 5 Bytes JMP 00150000
.text C:\Windows\system32\svchost.exe[3616] ADVAPI32.dll!RegCreateKeyExW 7695B946 5 Bytes JMP 00150FC0
.text C:\Windows\system32\svchost.exe[3616] ADVAPI32.dll!RegOpenKeyExA 7695BC0D 5 Bytes JMP 0015001B
.text C:\Windows\system32\svchost.exe[3616] ADVAPI32.dll!RegOpenKeyExW 7695BEC4 5 Bytes JMP 0015002C
.text C:\Windows\system32\svchost.exe[3616] WS2_32.dll!socket 765B3F00 5 Bytes JMP 0016000A

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \Driver\tdx \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

Device \Driver\ACPI_HAL \Device\0000004c halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \Driver\tdx \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\tdx \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

—- EOF - GMER 1.0.15 —-

mowman

Post #7May 11, 2010, 11:57 PM UTC

Hello vectris,please do the following.

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

You have Malwarebytes installed.Please update and run a quick scan,post the log

I need you to run the following scan: Eset Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Do Not place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

Can you post the logs and tell me what symptoms you are now experiencing

DanielD

Post #8May 12, 2010, 7:52 PM UTC

Ok here are the logs. As for symptoms computer still seems fine. Nothing questionable has happened yet and the security tool icon has not re-appeared. But just to make sure you know the virus stopped on it's own prior to this post but without the user taking any action, thus I believed it was hidden and came here. But to answer the question there are no current symptoms. Also I was able to fix the background by changing windows themes and then reverting back. That somehow cleared the background and I am now able to change it.

Also just thought I'd add that the Eset scanner took 14 hours, so I would suggest adding a warning about that in the canned phrase. I'm pretty sure I followed the directions correctly too.

OTL logfile created on: 5/11/2010 10:33:23 PM - Run 2
OTL by OldTimer - Version 3.2.4.1 Folder = C:\Users\Todd\Desktop
Starter Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,013.00 Mb Total Physical Memory | 422.00 Mb Available Physical Memory | 42.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 66.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 136.95 Gb Total Space | 118.79 Gb Free Space | 86.74% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: TODD
Current User Name: Todd
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Todd\Desktop\OTL.exe (OldTimer Tools)
PRC - c:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - C:\Program Files\Oceanis\SystemSetting\WallPaperAgent.exe (Oceanis)
PRC - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
PRC - C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Windows\System32\igfxext.exe (Intel Corporation)
PRC - C:\Program Files\McAfee\MSK\msksrver.exe (McAfee, Inc.)
PRC - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
PRC - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated)
PRC - C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (Acer Incorporated)
PRC - C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
PRC - C:\Program Files\Acer\Registration\GregHSRW.exe (Acer Incorporated)
PRC - C:\Program Files\Launch Manager\dsiwmis.exe (Dritek System Inc.)
PRC - C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
PRC - C:\Program Files\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()

========== Modules (SafeList) ==========

MOD - C:\Users\Todd\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Acer\Acer ePower Management\SysHook.dll (Acer Incorporated)
MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation)
MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\McAfee\SiteAdvisor\sahook.dll ()

========== Win32 Services (SafeList) ==========

SRV - (mcmscsvc) – C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV - (McSysmon) – C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (MpfService) – C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (MSK80Service) – C:\Program Files\McAfee\MSK\MskSrver.exe (McAfee, Inc.)
SRV - (ePowerSvc) – C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated)
SRV - (MWLService) – C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe ()
SRV - (Greg_Service) – C:\Program Files\Acer\Registration\GregHSRW.exe (Acer Incorporated)
SRV - (DsiWMIService) – C:\Program Files\Launch Manager\dsiwmis.exe (Dritek System Inc.)
SRV - (WwanSvc) – C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) – C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) – C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) – C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) – C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (RpcEptMapper) – C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (PNRPsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) – C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) – C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) – C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (Dhcp) – C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) – C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) – C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX Installer (AxInstSV) – C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppIDSvc) – C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (sppsvc) – C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
SRV - (RS_Service) – C:\Program Files\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
SRV - (McProxy) – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (McNASvc) – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (Updater Service) – C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer)
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (GameConsoleService) – C:\Program Files\Acer Games\Acer Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()

========== Driver Services (SafeList) ==========

DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (KSecPkg) – C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (EUCR) – C:\Windows\system32\DRIVERS\EUCR6SK.SYS (ENE Technology Inc.)
DRV - (L1C) – C:\Windows\System32\drivers\L1C62x86.sys (Atheros Communications, Inc.)
DRV - (mfehidk) – C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfesmfk) – C:\Windows\System32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (athr) – C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (igfx) – C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (cmdide) – C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) – C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) – C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) – C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) – C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) – C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) – C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) – C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) – C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) – C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) – C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) – C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) – C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) – C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) – C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) – C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) – C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) – C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) – C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) – C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) – C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) – C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) – C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) – C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vhdmp) – C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (vdrvroot) – C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (WIMMount) – C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) – C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) – C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) – C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) – C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) – C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) – C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) – C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) – C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) – C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) – C:\Windows\system32\DRIVERS\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) – C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) – C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) – C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) – C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwififlt) – C:\Windows\System32\drivers\vwififlt.sys (Microsoft Corporation)
DRV - (vwifibus) – C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) – C:\Windows\system32\DRIVERS\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) – C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (mshidkmdf) – C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) – C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) – C:\Windows\system32\DRIVERS\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) – C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) – C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (discache) – C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (HidBatt) – C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation)
DRV - (AcpiPmi) – C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) – C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) – C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) – C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) – C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (b57nd60x) – C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (ebdrv) – C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) – C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (iaStor) – C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (mwlPSDVDisk) – C:\Windows\System32\drivers\mwlPSDVDisk.sys (Egis Technology Inc.)
DRV - (mwlPSDNServ) – C:\Windows\System32\drivers\mwlPSDNserv.sys (Egis Technology Inc.)
DRV - (mwlPSDFilter) – C:\Windows\System32\drivers\mwlPSDFilter.sys (Egis Technology Inc.)
DRV - (MPFP) – C:\Windows\System32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (BCM43XX) – C:\Windows\System32\drivers\BCMWL6.SYS (Broadcom Corporation)
DRV - (DKbFltr) – C:\Windows\system32\DRIVERS\DKbFltr.sys (Dritek System Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…f4ww65w7432r28p
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…f4ww65w7432r28p

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…f4ww65w7432r28p
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.google.com"
FF - prefs.js..extensions.enabledItems: {66E978CD-981F-47DF-AC42-E3CF417C1467}:0.4.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/05/10 17:16:56 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/05/09 12:27:54 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/05/09 13:38:32 | 000,000,000 | —D | M]

[2010/05/09 12:30:08 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\Mozilla\Extensions
[2010/05/10 18:49:00 | 000,000,000 | —D | M] – C:\Users\Todd\AppData\Roaming\Mozilla\Firefox\Profiles\iwqb1djs.default\extensions
[2010/05/09 12:32:02 | 000,000,000 | —D | M] (New Tab Homepage) – C:\Users\Todd\AppData\Roaming\Mozilla\Firefox\Profiles\iwqb1djs.default\extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}
[2010/05/09 13:38:36 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/05/09 13:38:36 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/05/09 13:38:09 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O2 - BHO: (Windows 7 Starter Helper) - {D381FF29-7CFB-4D4E-B92A-C4EDDC696614} - C:\Program Files\Oceanis\SystemSetting\StarterHelper.dll (Oceanis)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe ()
O4 - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4 - HKLM..\Run: [EgisTecLiveUpdate] C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [mwlDaemon] C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.2
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Acer\Acer VCM\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKCU Winlogon: Shell - (C:\Program Files\Oceanis\SystemSetting\WallPaperAgent.exe) - C:\Program Files\Oceanis\SystemSetting\WallPaperAgent.exe (Oceanis)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/05/11 22:28:32 | 000,000,000 | —D | C] – C:\_OTL
[2010/05/10 19:06:36 | 000,000,000 | —D | C] – C:\Windows\Minidump
[2010/05/10 17:14:08 | 000,570,880 | —- | C] (OldTimer Tools) – C:\Users\Todd\Desktop\OTL.exe
[2010/05/09 23:38:36 | 000,000,000 | —D | C] – C:\Windows\.jagex_cache_32
[2010/05/09 23:38:19 | 000,000,000 | —D | C] – C:\Windows\Sun
[2010/05/09 13:39:08 | 000,000,000 | —D | C] – C:\ProgramData\Sun
[2010/05/09 13:39:06 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/05/09 13:38:32 | 000,411,368 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\deployJava1.dll
[2010/05/09 13:38:32 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2010/05/09 13:38:32 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2010/05/09 13:38:31 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2010/05/09 13:37:59 | 000,000,000 | —D | C] – C:\Program Files\Java
[2010/05/09 13:16:52 | 000,000,000 | —D | C] – C:\Program Files\NT Registry Optimizer
[2010/05/09 13:15:22 | 000,000,000 | —D | C] – C:\Program Files\Oceanis
[2010/05/09 12:57:02 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2010/05/09 12:56:35 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\SUPERAntiSpyware.com
[2010/05/09 12:56:35 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2010/05/09 12:55:47 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Wise Installation Wizard
[2010/05/09 12:51:55 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\Malwarebytes
[2010/05/09 12:51:43 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/05/09 12:51:42 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/05/09 12:51:41 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/05/09 12:51:40 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/05/09 12:29:51 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Roaming\Mozilla
[2010/05/09 12:29:51 | 000,000,000 | —D | C] – C:\Users\Todd\AppData\Local\Mozilla
[2010/05/09 12:29:16 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Todd\Desktop\HiJackThis.exe
[2010/05/09 12:27:36 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2010/05/09 12:25:28 | 000,050,688 | —- | C] (Atribune.org) – C:\Users\Todd\Desktop\ATF-Cleaner.exe
[2010/04/27 19:14:26 | 001,037,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\lsasrv.dll
[2010/04/27 19:14:26 | 000,133,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\ksecpkg.sys
[2010/04/18 16:56:03 | 003,954,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2010/04/18 16:56:03 | 003,899,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2010/04/18 16:56:01 | 000,427,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vbscript.dll

========== Files - Modified Within 30 Days ==========

[2010/05/11 22:41:22 | 001,048,576 | -HS- | M] () – C:\Users\Todd\NTUSER.DAT
[2010/05/11 22:39:03 | 000,713,888 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/05/11 22:39:03 | 000,615,360 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/05/11 22:39:03 | 000,103,702 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/05/11 22:38:16 | 000,009,696 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/05/11 22:38:16 | 000,009,696 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/05/11 22:31:52 | 000,008,921 | —- | M] () – C:\Windows\System32\Config.MPF
[2010/05/11 22:30:59 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/05/11 22:30:54 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/05/11 22:30:48 | 796,831,744 | -HS- | M] () – C:\hiberfil.sys
[2010/05/10 19:17:48 | 003,344,065 | -H– | M] () – C:\Users\Todd\AppData\Local\IconCache.db
[2010/05/10 19:06:30 | 209,690,331 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/05/10 18:41:33 | 000,293,376 | —- | M] () – C:\Users\Todd\Desktop\gmer.exe
[2010/05/10 17:14:34 | 000,570,880 | —- | M] (OldTimer Tools) – C:\Users\Todd\Desktop\OTL.exe
[2010/05/10 00:33:40 | 000,000,075 | —- | M] () – C:\Users\Todd\jagex_runescape_preferences2.dat
[2010/05/10 00:33:40 | 000,000,041 | —- | M] () – C:\Users\Todd\jagex_runescape_preferences.dat
[2010/05/09 23:41:16 | 000,000,000 | —- | M] () – C:\Users\Todd\jagex__preferences3.dat
[2010/05/09 13:42:44 | 156,607,328 | —- | M] () – C:\Users\Todd\Desktop\OOo_3.2.0_Win_x86_install-wJRE_en-US.exe
[2010/05/09 13:38:05 | 000,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2010/05/09 13:38:05 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2010/05/09 13:38:04 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2010/05/09 13:38:03 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\deployJava1.dll
[2010/05/09 13:15:24 | 000,002,000 | —- | M] () – C:\Users\Public\Desktop\Oceanis Change Background W7.lnk
[2010/05/09 12:56:41 | 000,000,995 | —- | M] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/05/09 12:51:47 | 000,000,987 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/05/09 12:29:56 | 000,000,000 | —- | M] () – C:\Windows\nsreg.dat
[2010/05/09 12:29:28 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Todd\Desktop\HiJackThis.exe
[2010/05/09 12:27:58 | 000,001,893 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010/05/09 12:25:28 | 000,050,688 | —- | M] (Atribune.org) – C:\Users\Todd\Desktop\ATF-Cleaner.exe
[2010/04/29 18:39:38 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/04/29 18:39:26 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/04/28 13:34:21 | 000,001,988 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/04/18 17:01:36 | 000,000,342 | —- | M] () – C:\Windows\tasks\McDefragTask.job

========== Files Created - No Company Name ==========

[2010/05/10 19:06:30 | 209,690,331 | —- | C] () – C:\Windows\MEMORY.DMP
[2010/05/09 23:41:16 | 000,000,000 | —- | C] () – C:\Users\Todd\jagex__preferences3.dat
[2010/05/09 23:41:15 | 000,000,075 | —- | C] () – C:\Users\Todd\jagex_runescape_preferences2.dat
[2010/05/09 23:38:59 | 000,000,041 | —- | C] () – C:\Users\Todd\jagex_runescape_preferences.dat
[2010/05/09 13:15:24 | 000,002,000 | —- | C] () – C:\Users\Public\Desktop\Oceanis Change Background W7.lnk
[2010/05/09 13:02:20 | 156,607,328 | —- | C] () – C:\Users\Todd\Desktop\OOo_3.2.0_Win_x86_install-wJRE_en-US.exe
[2010/05/09 12:56:41 | 000,000,995 | —- | C] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/05/09 12:51:47 | 000,000,987 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/05/09 12:29:56 | 000,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2010/05/09 12:27:58 | 000,001,893 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010/01/08 21:34:41 | 000,356,352 | —- | C] () – C:\Windows\EMCRI_E.dll
[2009/08/03 18:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/07/13 19:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
< End of report >

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4091

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

5/11/2010 10:58:52 PM
mbam-log-2010-05-11 (22-58-52).txt

Scan type: Quick scan
Objects scanned: 116615
Time elapsed: 10 minute(s), 53 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=0f9ad24c9e6589429671109d5ae1997f
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-05-12 05:17:27
# local_time=2010-05-12 01:17:27 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=5121 16776573 100 96 2188373 25632028 0 0
# compatibility_mode=5893 16776574 66 85 25165095 25178895 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=81658
# found=0
# cleaned=0
# scan_time=50544

mowman

Post #9May 12, 2010, 10:34 PM UTC

Hello vectris.Your logs appear clean of any infections,please do the following.

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

Here are some recommendations to help you stay clean.

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/

Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.

please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:

So How did I get infected?
Miekies' prevention suggestions
Hardening Windows Security - Part 1 & Part 2.

Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.

Thats it you are good to go.Safe surfing

DanielD

Post #10May 13, 2010, 4:43 AM UTC

Thank you very much mowman! I really appreciate the time you guys dedicate to helping people like me and best of luck with your malware training.

mowman

Post #11May 13, 2010, 8:18 AM UTC

You're welcome.Glad we could help

CatByte

Post #12May 13, 2010, 9:16 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

[Resolved] Laptop Infected with "Security Tool" virus

✨ Ask AI

Ask AI