What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Am i infected?

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:18:12 PM, on 6/19/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18928)
Boot mode: Normal

Running processes:
C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
C:\Program Files\Alienware\Command Center\AlienSense\FATrayMon.exe
C:\Program Files (x86)\CyberLink\Shared files\brs.exe
C:\Program Files (x86)\dcmsvc\dcmsvc.exe
C:\Program Files\Alienware\Command Center\AlienSense\FATrayAlert.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Alienware\Command Center\AlienFXHook32Mngr.exe
C:\Program Files\Alienware\Command Center\AlienFusionController.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netflix.com/MemberHome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AIM Toolbar Search Class - {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files (x86)\AIM Toolbar\aimtb.dll
R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20100517142141.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FAIESSO Helper Object - {A2F122DA-055F-4df7-8F24-7354DBDBA85B} - C:\Program Files\Alienware\Command Center\AlienSense\FAIESSO.dll
O2 - BHO: AIM Toolbar Loader - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files (x86)\AIM Toolbar\aimtb.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: AIM Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files (x86)\AIM Toolbar\aimtb.dll
O4 - HKLM\..\Run: [FATrayAlert] C:\Program Files\Alienware\Command Center\AlienSense\FATrayMon.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] "C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Keyboard OSD Utility] "C:\Program Files\Keyboard Manager\OSD Utility\OSDManager.exe" /lang en /H
O4 - HKLM\..\Run: [dcmsvc] "C:\Program Files (x86)\dcmsvc\dcmsvc.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\grIMreaPR\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Warner Bros.lnk = C:\Program Files (x86)\Warner Bros. Digital Copy Manager\Warner Bros. Digital Copy Manager.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MI1933~1\Office12\REFIEBAR.DLL
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {3D53B8B8-D037-4974-B852-C0D2D30556A7} (IADefDVD Class) - file:///D:/win/setup/iaDefDvd.dll
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Futuremark SystemInfo) - http://service.futuremark.com/openapi/receivers/FMSI.cab
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - (no CLSID) - (no file)
O20 - Winlogon Notify: FastAccess - C:\Program Files\Alienware\Command Center\AlienSense\FALogNot.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: McAfee Application Installer Cleanup (0100941276975829) (0100941276975829mcinstcleanup) - McAfee, Inc. - C:\Windows\TEMP\010094~1.EXE
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Alienware Fusion Service (AlienFusionService) - Alienware - C:\Program Files\Alienware\Command Center\AlienFusionService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FAService - Sensible Vision - C:\Program Files\Alienware\Command Center\AlienSense\FAService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Personal Firewall (McMPFSvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McShield - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
O23 - Service: mental ray 3.8 Satellite for Autodesk 3ds Max 2011 32-bit 32-bit (mi-raysat_3dsmax2011_32) - Unknown owner - C:\Program Files (x86)\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_32server.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: NBService - Nero AG - C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: Stardock WindowBlinds (WindowBlinds) - Stardock Corporation - C:\Program Files (x86)\Stardock\MyColors\VistaSrv.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Zune Wireless Configuration Service (ZuneWlanCfgSvc) - Unknown owner - c:\Windows\system32\ZuneWlanCfgSvc.exe (file missing)

–
End of file - 12995 bytes



Any help would be great thanks
Post #2
Hi,

There aren't any obvious signs of malware there, but we would need a deeper look to be certain.

WHat exactly has your computer been doing that leads you to believe it is infected?

Please give as much detail as possible.

Please do the following:

Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under the Custom Scan box paste this in


    netsvcs
    drivers32 /all
    %SYSTEMDRIVE%\*.*
    %systemroot%\system32\Spool\prtprocs\w32x86\*.dll
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemroot%\system32\user32.dll /md5
    %systemroot%\system32\ws2_32.dll /md5

  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them in your next reply.
Post #3
i just thought something was weird because no matter what i do or if i reset my pc it always says windows has an update, click to install and when i click it it say that the page failed to open.


Here is the scan results:

OTL logfile created on: 6/21/2010 4:53:51 PM - Run 2
OTL by OldTimer - Version 3.2.6.1 Folder = C:\Users\grIMreaPR\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 62.00% Memory free
10.00 Gb Paging File | 8.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): c:\pagefile.sys 6000 10000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 285.72 Gb Total Space | 118.50 Gb Free Space | 41.47% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 465.64 Gb Total Space | 315.38 Gb Free Space | 67.73% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GRIMREAPR-PC
Current User Name: grIMreaPR
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Users\grIMreaPR\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_32server.exe ()
PRC - C:\Program Files (x86)\dcmsvc\dcmsvc.exe ()
PRC - C:\Program Files (x86)\CyberLink\Shared files\brs.exe (cyberlink)
PRC - C:\Program Files\Alienware\Command Center\AlienFXHook32Mngr.exe (Alienware)
PRC - C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe (Alienware Corporation)
PRC - C:\Program Files\Alienware\Command Center\AlienSense\FATrayMon.exe (Sensible Vision )
PRC - C:\Program Files\Alienware\Command Center\AlienSense\FATrayAlert.exe (Sensible Vision )
PRC - C:\Program Files\Alienware\Command Center\AlienSense\FAService.exe (Sensible Vision )
PRC - C:\Program Files\Alienware\Command Center\AlienFusionController.exe (Alienware)


========== Modules (SafeList) ==========

MOD - C:\Users\grIMreaPR\Desktop\OTL.exe (OldTimer Tools)
MOD - c:\Program Files (x86)\McAfee\SiteAdvisor\sahook.dll (McAfee, Inc.)
MOD - C:\Program Files (x86)\Stardock\MyColors\wblind.dll (Stardock Corporation)
MOD - C:\Program Files (x86)\Stardock\MyColors\wbhelp.dll (Stardock.Net, Inc)
MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\wbload.dll ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
SRV:64bit: - (mfevtp) – C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe (McAfee, Inc.)
SRV:64bit: - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV:64bit: - (ZuneWlanCfgSvc) – C:\Windows\SysNative\ZuneWlanCfgSvc.exe (Microsoft Corporation)
SRV:64bit: - (ZuneNetworkSvc) – c:\Program Files\Zune\ZuneNss.exe (Microsoft Corporation)
SRV:64bit: - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV:64bit: - (MSK80Service) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (McProxy) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (McNASvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (McNaiAnn) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (mcmscsvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (McMPFSvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (Ati External Event Utility) – C:\Windows\SysNative\Ati2evxx.exe (ATI Technologies Inc.)
SRV:64bit: - (AlienFusionService) – C:\Program Files\Alienware\Command Center\AlienFusionService.exe (Alienware)
SRV:64bit: - (FAService) – C:\Program Files\Alienware\Command Center\AlienSense\FAService.exe (Sensible Vision )
SRV:64bit: - (msvsmon90) – C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (EvtEng) – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV:64bit: - (RegSrvc) – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (SeaPort) – C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (Akamai) – C:/Program Files (x86)/Common Files/Akamai/rswin_3697.dll ()
SRV - (McAfee SiteAdvisor Service) – C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (mi-raysat_3dsmax2011_32) – C:\Program Files (x86)\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_32server.exe ()
SRV - (WindowBlinds) – C:\Program Files (x86)\Stardock\MyColors\VistaSrv.exe (Stardock Corporation)
SRV - (MSDTC) – C:\Windows\SysWOW64\Msdtc [2006/11/02 07:34:14 | 000,000,000 | —D | M]
SRV - (vds) – C:\Windows\SysWOW64\wbem\vds.mof ()
SRV - (VSS) – C:\Windows\SysWOW64\wbem\vss.mof ()


========== Driver Services (SafeList) ==========

DRV:64bit: - (mfehidk) – C:\Windows\SysNative\drivers\mfehidk.sys (McAfee, Inc.)
DRV:64bit: - (mfefirek) – C:\Windows\SysNative\drivers\mfefirek.sys (McAfee, Inc.)
DRV:64bit: - (mfewfpk) – C:\Windows\SysNative\drivers\mfewfpk.sys (McAfee, Inc.)
DRV:64bit: - (mfeavfk) – C:\Windows\SysNative\drivers\mfeavfk.sys (McAfee, Inc.)
DRV:64bit: - (mfeapfk) – C:\Windows\SysNative\drivers\mfeapfk.sys (McAfee, Inc.)
DRV:64bit: - (mferkdet) – C:\Windows\SysNative\drivers\mferkdet.sys (McAfee, Inc.)
DRV:64bit: - (mfenlfk) – C:\Windows\SysNative\DRIVERS\mfenlfk.sys (McAfee, Inc.)
DRV:64bit: - (cfwids) – C:\Windows\SysNative\drivers\cfwids.sys (McAfee, Inc.)
DRV:64bit: - (AtiHdmiService) – C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (pcouffin) – C:\Windows\SysNative\Drivers\pcouffin.sys (VSO Software)
DRV:64bit: - (mfesmfk) – C:\Windows\SysNative\drivers\mfesmfk.sys (McAfee, Inc.)
DRV:64bit: - (mferkdk) – C:\Windows\SysNative\drivers\mferkdk.sys (McAfee, Inc.)
DRV:64bit: - (sdbus) – C:\Windows\SysNative\DRIVERS\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (atikmdag) – C:\Windows\SysNative\DRIVERS\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (FACAP) – C:\Windows\SysNative\DRIVERS\facap.sys (Sensible Vision )
DRV:64bit: - (ahcix64) – C:\Windows\SysNative\drivers\ahcix64.sys (ATI Technologies Inc.)
DRV:64bit: - (OEM18Vid) – C:\Windows\SysNative\DRIVERS\OEM18Vid.sys (Creative Technology Ltd.)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iastor.sys (Intel Corporation)
DRV:64bit: - (sscdmdm) – C:\Windows\SysNative\DRIVERS\sscdmdm.sys (MCCI Corporation)
DRV:64bit: - (sscdbus) SAMSUNG USB Composite Device driver (WDM) – C:\Windows\SysNative\DRIVERS\sscdbus.sys (MCCI Corporation)
DRV:64bit: - (sscdmdfl) – C:\Windows\SysNative\DRIVERS\sscdmdfl.sys (MCCI Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\DRIVERS\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (TPM) – C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\DRIVERS\SynTP.sys (Synaptics, Inc.)
DRV:64bit: - (RTL8169) – C:\Windows\SysNative\DRIVERS\Rtlh64.sys (Realtek Corporation )
DRV:64bit: - (igfx) – C:\Windows\SysNative\DRIVERS\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (ENTECH64) – C:\Windows\SysNative\DRIVERS\ENTECH64.sys (EnTech Taiwan)
DRV:64bit: - (mv61xx) – C:\Windows\SysNative\drivers\mv61xx.sys (Marvell Semiconductor, Inc.)
DRV:64bit: - (JRAID) – C:\Windows\SysNative\drivers\jraid.sys (JMicron Technology Corp.)
DRV:64bit: - (winbondcir) – C:\Windows\SysNative\DRIVERS\winbondcir.sys (Winbond Electronics Corporation)
DRV:64bit: - (rismxdp) – C:\Windows\SysNative\DRIVERS\rixdpx64.sys (REDC)
DRV:64bit: - (rimmptsk) – C:\Windows\SysNative\DRIVERS\rimmpx64.sys (REDC)
DRV:64bit: - (rimsptsk) – C:\Windows\SysNative\DRIVERS\rimspx64.sys (REDC)
DRV:64bit: - (NETw4v64) Intel® – C:\Windows\SysNative\DRIVERS\NETw4v64.sys (Intel Corporation)
DRV:64bit: - (WimFltr) – C:\Windows\SysNative\DRIVERS\wimfltr.sys (Microsoft Corporation)
DRV:64bit: - (JGOGO) – C:\Windows\SysNative\drivers\jgogo.sys (JMicron )
DRV - (Partizan) – C:\Windows\SysWOW64\Partizan.RRI ()
DRV - (StarOpen) – C:\Windows\SysWOW64\drivers\StarOpen.sys ()
DRV - ({FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}) – C:\Program Files (x86)\CyberLink\PowerDVD8\000.fcl (CyberLink Corp.)
DRV - (TPM) – C:\Windows\SysWOW64\tpm.msc ()
DRV - (Tcpip) – C:\Windows\SysWOW64\wbem\tcpip.mof ()
DRV - (mpsdrv) – C:\Windows\SysWOW64\wbem\mpsdrv.mof ()
DRV - (monitor) – C:\Program Files (x86)\backburner 2\monitor.exe (Discreet, a division of Autodesk, Inc.)
DRV - (ASPI) – C:\Windows\SysWOW64\drivers\ASPI32.SYS (Adaptec)
DRV - (Sentinel) – C:\Windows\System32\Drivers\SENTINEL.SYS (Rainbow Technologies, Inc.)
DRV - (Sntnlusb) – C:\Windows\SysWOW64\drivers\SNTNLUSB.SYS (Rainbow Technologies Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files (x86)\AIM Toolbar\aimtb.dll (AOL LLC.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.netflix.com/MemberHome
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 10 86 D0 FC F5 F8 C9 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files (x86)\AIM Toolbar\aimtb.dll (AOL LLC.)
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "google"
FF - prefs.js..browser.search.searchEnginesURL: "google.com"
FF - prefs.js..browser.startup.homepage: "http://www.facebook.com/?ref=home"
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.1
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:1.4
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=mcafee&p;="

FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files (x86)\McAfee\SiteAdvisor [2010/06/02 01:22:05 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/05/17 14:21:41 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/05/17 13:11:12 | 000,000,000 | —D | M]

[2010/05/04 14:14:40 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\Mozilla\Extensions
[2009/04/12 11:13:55 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\Mozilla\Extensions\[removed]
[2010/06/21 13:23:27 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\Mozilla\Firefox\Profiles\y4cs8s2o.default\extensions
[2010/05/05 14:58:17 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\grIMreaPR\AppData\Roaming\Mozilla\Firefox\Profiles\y4cs8s2o.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/13 16:23:41 | 000,000,000 | —D | M] (Fast Video Download (with SearchMenu)) – C:\Users\grIMreaPR\AppData\Roaming\Mozilla\Firefox\Profiles\y4cs8s2o.default\extensions\{c50ca3c4-5656-43c2-a061-13e717f73fc8}
[2010/06/12 17:06:20 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\Mozilla\Firefox\Profiles\y4cs8s2o.default\extensions\[removed]
[2010/05/17 13:11:17 | 000,000,000 | —D | M] – C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/05/17 13:11:17 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/04/27 17:16:24 | 000,024,376 | —- | M] (McAfee, Inc.) – C:\Program Files (x86)\Mozilla Firefox\components\Scriptff.dll
[2010/05/17 13:10:47 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
[2007/04/16 11:07:12 | 000,180,293 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: ([2006/09/18 15:37:24 | 000,000,761 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho64.dll ()
O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20100517142141.dll (McAfee, Inc.)
O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20100517142141.dll (McAfee, Inc.)
O2 - BHO: (FAIESSOHelper Class) - {A2F122DA-055F-4df7-8F24-7354DBDBA85B} - C:\Program Files\Alienware\Command Center\AlienSense\FAIESSO.dll (Sensible Vision )
O2 - BHO: (AIM Toolbar Loader) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files (x86)\AIM Toolbar\aimtb.dll (AOL LLC.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (&Windows; Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (AIM Toolbar) - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files (x86)\AIM Toolbar\aimtb.dll (AOL LLC.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows; Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (AIM Toolbar) - {61539ECD-CC67-4437-A03C-9AACCBD14326} - C:\Program Files (x86)\AIM Toolbar\aimtb.dll (AOL LLC.)
O4:64bit: - HKLM..\Run: [] File not found
O4:64bit: - HKLM..\Run: [AlienFX Controller] C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe (Alienware Corporation)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe (cyberlink)
O4 - HKLM..\Run: [dcmsvc] C:\Program Files (x86)\dcmsvc\dcmsvc.exe ()
O4 - HKLM..\Run: [FAStartup] File not found
O4 - HKLM..\Run: [FATrayAlert] C:\Program Files\Alienware\Command Center\AlienSense\FATrayMon.exe (Sensible Vision )
O4 - HKLM..\Run: [Keyboard OSD Utility] C:\Program Files\Keyboard Manager\OSD Utility\OSDManager.exe (Quanta Computer, INC.)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe File not found
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWow64\Macromed\Flash\NPSWF32_FlashUtil.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Users\grIMreaPR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Warner Bros.lnk = C:\Program Files (x86)\Warner Bros. Digital Copy Manager\Warner Bros. Digital Copy Manager.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} http://www.yougamers.com/systeminfo/FMSI.cab (Futuremark SystemInfo)
O16 - DPF: {3D53B8B8-D037-4974-B852-C0D2D30556A7} file:///D:/win/setup/iaDefDvd.dll (IADefDVD Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} http://service.futuremark.com/openapi/receivers/FMSI.cab (Futuremark SystemInfo)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 172.19.138.1 [removed]
O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml - No CLSID value found
O18 - Protocol\Filter\text/xml - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20:64bit: - Winlogon\Notify\WB: DllName - Reg Error: Key error. - C:\Program Files (x86)\Stardock\MyColors\fast64.dll File not found
O20 - Winlogon\Notify\FastAccess: DllName - C:\Program Files\Alienware\Command Center\AlienSense\FALogNot.dll - C:\Program Files\Alienware\Command Center\AlienSense\FALogNot.dll ()
O24 - Desktop WallPaper: C:\Users\grIMreaPR\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\grIMreaPR\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/05/11 17:33:43 | 000,000,000 | —D | M] - C:\Autodesk – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (MACHINE BootExecut) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: Ias - C:\Windows\SysWOW64\ias [2008/01/20 21:08:35 | 000,000,000 | —D | M]

Drivers32:64bit: aux - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: aux1 - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: aux2 - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: aux3 - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: midi - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: midi1 - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: midi2 - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: midi3 - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: midimapper - midimap.dll (Microsoft Corporation)
Drivers32:64bit: mixer - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: mixer1 - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: mixer2 - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: mixer3 - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: msacm.imaadpcm - imaadp32.acm (Microsoft Corporation)
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: msacm.msadpcm - msadp32.acm (Microsoft Corporation)
Drivers32:64bit: msacm.msg711 - msg711.acm (Microsoft Corporation)
Drivers32:64bit: msacm.msgsm610 - msgsm32.acm (Microsoft Corporation)
Drivers32:64bit: MSVideo8 - VfWWDM32.dll (Microsoft Corporation)
Drivers32:64bit: VIDC.FPS1 - frapsv64.dll (Beepa P/L)
Drivers32:64bit: vidc.i420 - iyuv_32.dll (Microsoft Corporation)
Drivers32:64bit: VIDC.IYUV - iyuv_32.dll (Microsoft Corporation)
Drivers32:64bit: vidc.mrle - msrle32.dll (Microsoft Corporation)
Drivers32:64bit: vidc.msvc - msvidc32.dll (Microsoft Corporation)
Drivers32:64bit: VIDC.UYVY - msyuv.dll (Microsoft Corporation)
Drivers32:64bit: VIDC.XFR1 - xfcodec64.dll ()
Drivers32:64bit: VIDC.YUY2 - msyuv.dll (Microsoft Corporation)
Drivers32:64bit: VIDC.YVU9 - tsbyuv.dll (Microsoft Corporation)
Drivers32:64bit: VIDC.YVYU - msyuv.dll (Microsoft Corporation)
Drivers32:64bit: wave - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: wave1 - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: wave2 - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: wave3 - wdmaud.drv (Microsoft Corporation)
Drivers32:64bit: wavemapper - msacm32.drv (Microsoft Corporation)
Drivers32: aux - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: aux1 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: aux2 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: aux3 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: midi2 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: midi3 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\Windows\SysWow64\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer2 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer3 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.imaadpcm - C:\Windows\SysWow64\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\Windows\SysWow64\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\Windows\SysWow64\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\Windows\SysWow64\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.siren - C:\Windows\SysWow64\sirenacm.dll (Microsoft Corporation)
Drivers32: SENTINEL - C:\Windows\SysWow64\SNTI386.DLL (Rainbow Technologies, Inc.)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.ffds - - File not found
Drivers32: VIDC.FPS1 - C:\Windows\SysWow64\frapsvid.dll (Beepa P/L)
Drivers32: vidc.i420 - C:\Windows\SysWow64\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.iyuv - C:\Windows\SysWow64\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\Windows\SysWow64\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\Windows\SysWow64\msvidc32.dll (Microsoft Corporation)
Drivers32: vidc.uyvy - C:\Windows\SysWow64\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.XFR1 - C:\Windows\SysWow64\xfcodec.dll ()
Drivers32: vidc.XVID - xvidvfw.dll File not found
Drivers32: vidc.yuy2 - C:\Windows\SysWow64\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvu9 - C:\Windows\SysWow64\tsbyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvyu - C:\Windows\SysWow64\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: wave2 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: wave3 - C:\Windows\SysWow64\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\Windows\SysWow64\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 90 Days ==========

[2010/06/21 16:24:44 | 000,574,464 | —- | C] (OldTimer Tools) – C:\Users\grIMreaPR\Desktop\OTL.exe
[2010/06/19 15:50:07 | 000,000,000 | —D | C] – C:\Program Files (x86)\Trend Micro
[2010/06/16 11:22:57 | 000,000,000 | —D | C] – C:\Users\grIMreaPR\Desktop\KILL_BILL_VOL2
[2010/06/14 02:10:16 | 000,000,000 | —D | C] – C:\Program Files (x86)\DVD Decrypter
[2010/06/14 01:32:58 | 000,000,000 | —D | C] – C:\Users\grIMreaPR\AppData\Local\HandBrake
[2010/06/14 01:32:50 | 000,000,000 | —D | C] – C:\Users\grIMreaPR\AppData\Roaming\HandBrake
[2010/06/14 01:32:41 | 000,000,000 | —D | C] – C:\Program Files (x86)\Handbrake
[2010/06/14 01:10:50 | 000,045,056 | —- | C] (Adaptec) – C:\Windows\SysWow64\WNASPI32.DLL
[2010/06/14 01:10:49 | 000,084,832 | —- | C] (Adaptec) – C:\Windows\SysWow64\drivers\ASPI32.SYS
[2010/06/14 01:00:19 | 000,000,000 | —D | C] – C:\Users\grIMreaPR\AppData\Local\Geckofx
[2010/06/14 00:58:54 | 000,000,000 | —D | C] – C:\Program Files (x86)\Replay Converter 3
[2010/06/14 00:58:54 | 000,000,000 | —D | C] – C:\Program Files (x86)\AviSynth 2.5
[2010/06/06 12:08:44 | 000,000,000 | —D | C] – C:\Users\grIMreaPR\AppData\Local\MagicSoftware
[2010/05/28 13:03:16 | 000,000,000 | —D | C] – C:\Program Files (x86)\Bethesda Softworks
[2010/05/11 18:11:25 | 000,000,000 | —D | C] – C:\Users\grIMreaPR\Documents\Inventor
[2010/05/11 17:17:41 | 000,000,000 | —D | C] – C:\Users\grIMreaPR\AppData\Roaming\Ahead
[2010/05/11 13:30:46 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Akamai
[2010/05/07 17:29:12 | 000,000,000 | —D | C] – C:\New Folder
[2010/04/29 19:18:05 | 000,000,000 | —D | C] – C:\Users\grIMreaPR\Documents\GTA3 User Files
[2010/04/29 18:31:55 | 000,000,000 | —D | C] – C:\Users\grIMreaPR\Documents\GTA San Andreas User Files
[2010/04/26 21:20:41 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Skype
[2010/04/24 09:43:13 | 000,000,000 | —D | C] – C:\Program Files\McAfee.com
[2010/04/24 09:41:39 | 000,009,984 | —- | C] (McAfee, Inc.) – C:\Windows\SysNative\drivers\mfeclnk.sys
[2010/04/24 09:41:05 | 000,279,752 | —- | C] (McAfee, Inc.) – C:\Windows\SysNative\drivers\mfewfpk.sys
[2010/04/24 09:41:05 | 000,093,840 | —- | C] (McAfee, Inc.) – C:\Windows\SysNative\drivers\mferkdet.sys
[2010/04/24 09:41:05 | 000,075,288 | —- | C] (McAfee, Inc.) – C:\Windows\SysNative\drivers\mfenlfk.sys
[2010/04/24 09:41:04 | 000,440,688 | —- | C] (McAfee, Inc.) – C:\Windows\SysNative\drivers\mfefirek.sys
[2010/04/24 09:41:04 | 000,121,504 | —- | C] (McAfee, Inc.) – C:\Windows\SysNative\drivers\mfeapfk.sys
[2010/04/24 09:41:04 | 000,062,416 | —- | C] (McAfee, Inc.) – C:\Windows\SysNative\drivers\cfwids.sys
[2010/04/19 14:00:31 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft XNA
[2010/04/19 13:54:59 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft SQL Server
[2010/04/19 13:54:49 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Synchronization Services
[2010/04/19 13:53:41 | 000,000,000 | —D | C] – C:\Users\grIMreaPR\Documents\Visual Studio 2008
[2010/04/19 13:49:00 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft SDKs
[2010/04/19 13:48:59 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Visual Studio 9.0
[2010/04/19 13:48:10 | 000,000,000 | —D | C] – C:\Program Files\Microsoft SDKs
[2010/04/19 13:47:49 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio 9.0
[2010/04/19 13:14:10 | 000,000,000 | —D | C] – C:\Users\grIMreaPR\AppData\Local\SIT41957.tmp
[2010/04/19 13:14:07 | 000,000,000 | —D | C] – C:\ca9997f91785be211f25fa
[2010/04/06 13:42:12 | 000,000,000 | —D | C] – C:\Program Files (x86)\Lame for Audacity
[2010/04/06 13:41:34 | 000,000,000 | —D | C] – C:\Program Files (x86)\Audacity
[2010/04/01 18:47:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\QuickTime
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\grIMreaPR\AppData\Local\*.tmp files -> C:\Users\grIMreaPR\AppData\Local\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/06/21 16:53:12 | 004,456,448 | -HS- | M] () – C:\Users\grIMreaPR\NTUSER.DAT
[2010/06/21 16:48:33 | 000,002,675 | —- | M] () – C:\Users\grIMreaPR\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2007.lnk
[2010/06/21 16:48:30 | 000,002,643 | —- | M] () – C:\Users\grIMreaPR\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office PowerPoint 2007.lnk
[2010/06/21 16:45:00 | 000,000,904 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/06/21 16:29:22 | 000,009,964 | —- | M] () – C:\Users\grIMreaPR\Documents\i just thought something was weird because nomatter what i do or if i reset my pc it always says windows has an update.docx
[2010/06/21 16:24:45 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Users\grIMreaPR\Desktop\OTL.exe
[2010/06/21 16:01:00 | 000,000,924 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-602681034-3931662181-2001462854-1000UA.job
[2010/06/21 15:45:00 | 000,000,900 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/06/21 15:19:39 | 000,002,437 | —- | M] () – C:\Users\grIMreaPR\Application Data\Microsoft\Internet Explorer\Quick Launch\Skype.lnk
[2010/06/21 15:11:52 | 000,003,216 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/06/21 15:11:52 | 000,003,216 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/06/21 15:01:00 | 000,000,872 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-602681034-3931662181-2001462854-1000Core.job
[2010/06/21 14:43:05 | 000,704,434 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/06/21 14:43:05 | 000,604,452 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/06/21 14:43:05 | 000,105,376 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/06/21 13:11:58 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/06/20 21:53:31 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/06/20 21:53:15 | 560,693,242 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/06/19 16:17:00 | 000,002,567 | —- | M] () – C:\Users\grIMreaPR\Desktop\HiJackThis.lnk
[2010/06/19 15:01:10 | 000,030,208 | —- | M] () – C:\Users\grIMreaPR\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/19 13:02:57 | 000,001,072 | —- | M] () – C:\Users\grIMreaPR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Warner Bros.lnk
[2010/06/17 12:33:35 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2010/06/17 12:32:46 | 000,524,288 | -HS- | M] () – C:\Users\grIMreaPR\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TMContainer00000000000000000001.regtrans-ms
[2010/06/17 12:32:46 | 000,065,536 | -HS- | M] () – C:\Users\grIMreaPR\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TM.blf
[2010/06/17 12:32:24 | 003,435,978 | -H– | M] () – C:\Users\grIMreaPR\AppData\Local\IconCache.db
[2010/06/16 16:02:01 | 000,002,287 | —- | M] () – C:\Users\grIMreaPR\Application Data\Microsoft\Internet Explorer\Quick Launch\Steam.lnk
[2010/06/14 02:10:17 | 000,001,811 | —- | M] () – C:\Users\grIMreaPR\Desktop\DVD Decrypter.lnk
[2010/06/14 01:32:41 | 000,000,858 | —- | M] () – C:\Users\grIMreaPR\Desktop\Handbrake.lnk
[2010/06/13 09:18:52 | 000,000,680 | —- | M] () – C:\Users\grIMreaPR\AppData\Local\d3d9caps.dat
[2010/06/10 03:37:37 | 002,204,768 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2010/06/01 00:57:55 | 000,001,583 | —- | M] () – C:\Users\grIMreaPR\Application Data\Microsoft\Internet Explorer\Quick Launch\HWMonitor.lnk
[2010/05/26 18:57:59 | 000,018,138 | —- | M] () – C:\Users\grIMreaPR\Documents\red dead redemption 100%.docx
[2010/05/11 18:29:31 | 000,001,923 | —- | M] () – C:\Users\grIMreaPR\Application Data\Microsoft\Internet Explorer\Quick Launch\Autodesk 3ds Max 2011.lnk
[2010/05/04 14:14:06 | 000,001,778 | —- | M] () – C:\Users\grIMreaPR\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/04/27 17:16:24 | 000,528,616 | —- | M] (McAfee, Inc.) – C:\Windows\SysNative\drivers\mfehidk.sys
[2010/04/27 17:16:24 | 000,440,688 | —- | M] (McAfee, Inc.) – C:\Windows\SysNative\drivers\mfefirek.sys
[2010/04/27 17:16:24 | 000,279,752 | —- | M] (McAfee, Inc.) – C:\Windows\SysNative\drivers\mfewfpk.sys
[2010/04/27 17:16:24 | 000,189,880 | —- | M] (McAfee, Inc.) – C:\Windows\SysNative\drivers\mfeavfk.sys
[2010/04/27 17:16:24 | 000,121,504 | —- | M] (McAfee, Inc.) – C:\Windows\SysNative\drivers\mfeapfk.sys
[2010/04/27 17:16:24 | 000,093,840 | —- | M] (McAfee, Inc.) – C:\Windows\SysNative\drivers\mferkdet.sys
[2010/04/27 17:16:24 | 000,075,288 | —- | M] (McAfee, Inc.) – C:\Windows\SysNative\drivers\mfenlfk.sys
[2010/04/27 17:16:24 | 000,062,416 | —- | M] (McAfee, Inc.) – C:\Windows\SysNative\drivers\cfwids.sys
[2010/04/27 17:16:24 | 000,009,984 | —- | M] (McAfee, Inc.) – C:\Windows\SysNative\drivers\mfeclnk.sys
[2010/04/19 14:07:35 | 000,063,992 | —- | M] () – C:\Users\grIMreaPR\AppData\Local\GDIPFONTCACHEV1.DAT
[2010/04/12 20:32:57 | 000,011,208 | —- | M] () – C:\Users\grIMreaPR\Documents\Community Service paragraph.docx
[2010/04/02 17:17:34 | 000,179,091 | —- | M] () – C:\Windows\SysWow64\xlive.dll.cat
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\grIMreaPR\AppData\Local\*.tmp files -> C:\Users\grIMreaPR\AppData\Local\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/21 16:29:20 | 000,009,964 | —- | C] () – C:\Users\grIMreaPR\Documents\i just thought something was weird because nomatter what i do or if i reset my pc it always says windows has an update.docx
[2010/06/19 16:13:40 | 000,002,567 | —- | C] () – C:\Users\grIMreaPR\Desktop\HiJackThis.lnk
[2010/06/19 13:02:57 | 000,001,072 | —- | C] () – C:\Users\grIMreaPR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Warner Bros.lnk
[2010/06/16 13:52:53 | 000,002,437 | —- | C] () – C:\Users\grIMreaPR\Application Data\Microsoft\Internet Explorer\Quick Launch\Skype.lnk
[2010/06/14 02:10:17 | 000,001,811 | —- | C] () – C:\Users\grIMreaPR\Desktop\DVD Decrypter.lnk
[2010/06/14 01:32:41 | 000,000,858 | —- | C] () – C:\Users\grIMreaPR\Desktop\Handbrake.lnk
[2010/05/26 17:31:08 | 000,018,138 | —- | C] () – C:\Users\grIMreaPR\Documents\red dead redemption 100%.docx
[2010/05/17 22:31:53 | 560,693,242 | —- | C] () – C:\Windows\MEMORY.DMP
[2010/05/17 20:08:31 | 000,002,643 | —- | C] () – C:\Users\grIMreaPR\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office PowerPoint 2007.lnk
[2010/05/11 18:29:31 | 000,001,923 | —- | C] () – C:\Users\grIMreaPR\Application Data\Microsoft\Internet Explorer\Quick Launch\Autodesk 3ds Max 2011.lnk
[2010/05/11 18:00:55 | 000,441,506 | —- | C] () – C:\Users\grIMreaPR\AppData\Local\dd_vcredistMSI0F37.txt
[2010/05/11 18:00:54 | 000,012,410 | —- | C] () – C:\Users\grIMreaPR\AppData\Local\dd_vcredistUI0F37.txt
[2010/05/04 14:14:06 | 000,001,778 | —- | C] () – C:\Users\grIMreaPR\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/04/19 13:55:01 | 000,399,108 | —- | C] () – C:\Users\grIMreaPR\AppData\Local\dd_SharedManagementObjects_MSI1C19.txt
[2010/04/19 13:54:57 | 000,183,854 | —- | C] () – C:\Users\grIMreaPR\AppData\Local\dd_SQLSysClrTypes_msi1C0C.txt
[2010/04/19 13:54:53 | 000,325,500 | —- | C] () – C:\Users\grIMreaPR\AppData\Local\dd_SQLCEToolsForVS2007_MSI1BFE.txt
[2010/04/19 13:54:46 | 000,404,374 | —- | C] () – C:\Users\grIMreaPR\AppData\Local\dd_SSCERuntime_MSI1BE8.txt
[2010/04/19 13:48:26 | 009,841,252 | —- | C] () – C:\Users\grIMreaPR\AppData\Local\VSMsiLog170F.txt
[2010/04/19 13:48:15 | 000,204,226 | —- | C] () – C:\Users\grIMreaPR\AppData\Local\dd_WinSDK_Win32ExpTools_x64_MSI16EB.txt
[2010/04/19 13:48:08 | 000,224,062 | —- | C] () – C:\Users\grIMreaPR\AppData\Local\dd_WinSDK_ExpTools_x64_MSI16D4.txt
[2010/04/19 13:47:45 | 001,215,374 | —- | C] () – C:\Users\grIMreaPR\AppData\Local\dd_ExpRemoteDbg_x64_MSI1689.txt
[2010/04/19 13:47:39 | 000,365,588 | —- | C] () – C:\Users\grIMreaPR\AppData\Local\dd_VC_Red_MSI1675.txt
[2010/04/19 13:14:19 | 000,237,039 | —- | C] () – C:\Users\grIMreaPR\AppData\Local\dd_depcheck_VCS_EXP_90.txt
[2010/04/19 13:14:09 | 000,501,860 | —- | C] () – C:\Users\grIMreaPR\AppData\Local\dd_install_vcs_xcor_90.txt
[2010/04/19 13:14:09 | 000,000,002 | —- | C] () – C:\Users\grIMreaPR\AppData\Local\dd_error_vcs_xcor_90.txt
[2010/04/12 14:10:23 | 000,011,208 | —- | C] () – C:\Users\grIMreaPR\Documents\Community Service paragraph.docx
[2010/04/02 17:17:34 | 000,179,091 | —- | C] () – C:\Windows\SysWow64\xlive.dll.cat
[2010/03/27 15:31:48 | 000,369,124 | —- | C] () – C:\Users\grIMreaPR\AppData\Local\dd_vcredistMSI60F6.txt
[2010/03/27 15:31:36 | 000,167,434 | —- | C] () – C:\Users\grIMreaPR\AppData\Local\dd_vcredistUI60F6.txt
[2010/03/04 18:11:22 | 000,041,872 | —- | C] () – C:\Windows\SysWow64\xfcodec.dll
[2010/03/03 22:09:55 | 000,000,618 | —- | C] () – C:\Windows\RegGenie.ini
[2010/01/16 00:22:08 | 000,721,824 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2009/10/24 10:49:56 | 000,117,248 | —- | C] () – C:\Windows\SysWow64\EhStorAuthn.dll
[2009/10/24 10:47:06 | 000,368,640 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/07/12 18:00:23 | 000,005,632 | —- | C] () – C:\Windows\SysWow64\drivers\StarOpen.sys
[2009/03/24 19:20:30 | 000,000,069 | —- | C] () – C:\Windows\NeroDigital.ini
[2009/03/17 12:31:31 | 001,238,832 | —- | C] () – C:\Windows\SysWow64\igmedkrn.dll
[2009/03/17 12:31:31 | 000,104,636 | —- | C] () – C:\Windows\SysWow64\igmedcompkrn.dll
[2009/03/17 12:18:04 | 000,000,274 | —- | C] () – C:\Windows\AWACT.dll
[2008/11/22 15:58:31 | 000,059,144 | —- | C] () – C:\Windows\SysWow64\FAib.dll
[2008/11/22 15:56:00 | 000,087,816 | —- | C] () – C:\Windows\SysWow64\FAIEExtension.dll
[2008/11/22 15:53:59 | 000,233,736 | —- | C] () – C:\Windows\SysWow64\FACrashRpt.dll
[2008/02/01 12:55:17 | 000,001,000 | —- | C] () – C:\Windows\registry.ini
[2008/02/01 12:55:17 | 000,000,438 | —- | C] () – C:\Windows\registry-oem.ini
[2008/01/20 20:50:05 | 000,060,124 | —- | C] () – C:\Windows\SysWow64\tcpmon.ini
[2007/11/04 17:50:44 | 000,058,792 | —- | C] () – C:\Windows\SysWow64\wbload.dll

========== LOP Check ==========

[2009/03/26 14:38:18 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\acccore
[2010/05/12 19:59:16 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\Autodesk
[2009/03/26 22:33:43 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\Bioshock
[2009/04/16 22:10:48 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\Braid
[2009/03/29 22:49:54 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\Broken Rules
[2010/01/03 00:26:33 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\com.warnerbros.DigitalCopyManager.449F66ACC381FDC604DC2AA255FEECEEBBBEE1E5.
1
[2009/05/21 12:59:15 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\Crayon Physics Deluxe
[2010/06/14 02:03:34 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\HandBrake
[2009/03/29 23:07:27 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\Larva Mortus Demo
[2009/10/09 15:16:46 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\LimeWire
[2009/03/26 12:44:41 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\MusicNet
[2009/06/13 08:25:13 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\NCH Swift Sound
[2009/03/26 23:55:09 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\Opera
[2009/07/12 23:30:04 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\Samsung
[2010/03/03 22:14:37 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\SmartPCTools
[2010/02/23 16:48:53 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\Subversion
[2010/03/03 21:52:13 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\Uniblue
[2010/06/18 12:52:12 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\uTorrent
[2009/09/20 16:54:27 | 000,000,000 | —D | M] – C:\Users\grIMreaPR\AppData\Roaming\Vso
[2010/06/17 12:33:36 | 000,032,544 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/04/11 00:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2008/08/08 12:49:58 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2009/09/10 20:30:06 | 000,000,418 | —- | M] () – C:\CD3rdPartyWrapper.log
[2009/03/18 06:21:57 | 000,000,000 | —- | M] () – C:\C_USERPART
[2008/08/08 09:43:36 | 2146,660,352 | -HS- | M] () – C:\hiberfil.sys
[2009/10/29 20:15:41 | 000,001,094 | -H– | M] () – C:\IPH.PH
[2006/12/01 23:37:14 | 000,904,704 | —- | M] (Microsoft Corporation) – C:\msdia80.dll
[2010/06/20 21:53:16 | 1996,488,703 | -HS- | M] () – C:\pagefile.sys
[2009/03/17 12:41:27 | 000,000,473 | —- | M] () – C:\RHDSetup.log
[2009/03/17 12:59:43 | 000,000,086 | —- | M] () – C:\setup.log

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >

< %systemroot%\system32\user32.dll /md5 >
[2009/04/11 00:26:45 | 000,648,704 | —- | M] (Microsoft Corporation) MD5=D29FDB5DEDBDC1BD882164DC6DC4DD53 – C:\Windows\SysWOW64\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/01/20 20:50:35 | 000,179,200 | —- | M] (Microsoft Corporation) MD5=B304D47D5744BA20FCB99FB8B2C07B0B – C:\Windows\SysWOW64\ws2_32.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 487 bytes -> C:\ProgramData\Temp:05EE1EEF
@Alternate Data Stream - 3552 bytes -> C:\Windows\alienware logo_slvr.jpg:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:ECF54A0E
@Alternate Data Stream - 115 bytes -> C:\ProgramData\Temp:A8ADE5D8
@Alternate Data Stream - 103 bytes -> C:\ProgramData\Temp:DFC5A2B2
< End of report >


a extra file didnt open for me either and there isnt on on my desktop
Post #4
Hi,

No obvious signs of malware in your log, but lets run a couple of scans to be certain.

Please do the following:



Please download Malwarebytes' Anti-Malware
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT

**Vista users - right click on the IE icon and run as administrator

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI