What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Notron Security detected instrusion

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
HI, Today Notron Security has shown this message on my laptop. GANESHLPT2 is my laptopname. An instrusion attempt by GANESHLPT2 was blocked. Network traffic from GANESHLPT2 matches the signature of a known attack. The attack was resulted from \DEVICE\HARDISKVOLUME3\PROGRAM FILES\INTERNET EXPLOER\ IEXPLORE.EXE. To stop being notified for this type of traffic, in the Action panel, click Stop Notifying Me. Network traffic from medicinebuyviagra.copm:8080/jquery.jxx?v=5.3.4 matches the signature of a known attack. The attack was resulted from \DEVICE\HARDISKVOLUME3\PROGRAM FILES\INTERNET EXPLOER\IEXPLORE.EXE. To stop being notified for this type of traffic, in the Action panel, click Stop Notifying Me. one more Medium alert Unauthorized access blocked (Open Process Token) Action: C:\Program Files\Microsoft Security Essentials\MSMPENG.EXE Target: c:\Program Files\Notral Security Suite\Engine\4.2.0.12\mcui32.3xe couple of months back it deteced Trojan Horse and removed here are the details hiydcxed.class (Trojan Horse) This Virus has been removed. hiydcxed.class Contained in c:\users\ganesh\appdata\localallow\sun\java\deployment\cache\6.0\55\648f5137-6c1d3f88 deleted hieeyfc.lcass (Trojan Horse) This Virus has been removed. hieeyfc.lcass Contained in c:\users\ganesh\appdata\localallow\sun\java\deployment\cache\6.0\55\648f5137-6c1d3f88 deleted. Your help in this matter is greatly appreciated.
Post #2
Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post



Please do the following



  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under Custom Scan paste this in

    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • You may need two posts to fit them both in.







[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If GMER won't run try with devices unchecked.If still no go try in safe mode.



In your next reply please post the following.
  • Both OTL logs
  • GMER log
Post #3
Hi mowman, Thanks for taking time and looking at my post.

Here is the output of OTL.txt

OTL logfile created on: 9/28/2010 10:02:20 PM - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\Ganesh\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 54.00% Memory free
6.00 Gb Paging File | 4.00 Gb Available in Paging File | 73.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 173.71 Gb Total Space | 36.25 Gb Free Space | 20.87% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.90 Gb Free Space | 59.01% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GANESHLPT2
Current User Name: Ganesh
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Ganesh\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\Soluto\SolutoService.exe (Soluto)
PRC - C:\Program Files\Soluto\Soluto.exe (Soluto)
PRC - C:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Norton Security Suite\Engine\4.2.0.12\ccsvchst.exe (Symantec Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\inetsrv\WMSvc.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
PRC - c:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Windows\System32\stacsv.exe (IDT, Inc.)
PRC - C:\Windows\System32\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - c:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe (Microsoft Corporation)
PRC - C:\Windows\OEM02Mon.exe (Creative Technology Ltd.)
PRC - C:\Program Files\Fingerprint Reader Suite\upeksvr.exe (UPEK Inc.)
PRC - C:\Program Files\Fingerprint Reader Suite\psqltray.exe (UPEK Inc.)
PRC - C:\Tools\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)


========== Modules (SafeList) ==========

MOD - C:\Users\Ganesh\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation)
MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (MBackMonitor) – C:\Program Files\McAfee\MBK\MBackMonitor.exe File not found
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (TeamViewer5) – C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (SolutoService) – C:\Program Files\Soluto\SolutoService.exe (Soluto)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (N360) – C:\Program Files\Norton Security Suite\Engine\4.2.0.12\ccSvcHst.exe (Symantec Corporation)
SRV - (wlcrasvc) – C:\Program Files\Live Mesh\Remote Desktop\wlcrasvc.exe (Microsoft Corporation)
SRV - (wlidsvc) – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (WwanSvc) – C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) – C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) – C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) – C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) – C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (RpcEptMapper) – C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (PNRPsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) – C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) – C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) – C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (WAS) – C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (W3SVC) – C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (ftpsvc) – C:\Windows\System32\inetsrv\ftpsvc.dll (Microsoft Corporation)
SRV - (Dhcp) – C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) – C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) – C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX Installer (AxInstSV) – C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppHostSvc) – C:\Windows\System32\inetsrv\apphostsvc.dll (Microsoft Corporation)
SRV - (AppIDSvc) – C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (WMSVC) – C:\Windows\System32\inetsrv\WMSvc.exe (Microsoft Corporation)
SRV - (sppsvc) – C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
SRV - (IISADMIN) – C:\Windows\System32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (MSSQL$SQLEXPRESS) SQL Server (SQLEXPRESS) – c:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (MsDepSvc) – C:\Program Files\IIS\Microsoft Web Deploy\MsDepSvc.exe (Microsoft Corporation)
SRV - (SQLWriter) – c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
SRV - (SQLBrowser) – c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
SRV - (MSSQLServerADHelper) – c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (sprtsvc_ddoctorv2) SupportSoft Sprocket Service (ddoctorv2) – C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (STacSV) – C:\Windows\System32\stacsv.exe (IDT, Inc.)
SRV - (AESTFilters) – C:\Windows\System32\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (msvsmon90) – C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe (Microsoft Corporation)
SRV - (WLSetupSvc) – C:\Program Files\Windows Live\installer\WLSetupSvc.exe (Microsoft Corporation)
SRV - (usnjsvc) – C:\Program Files\Windows Live\Messenger\usnsvc.exe (Microsoft Corporation)
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (EvtEng) Intel® – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (RegSrvc) Intel® – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (msftesql$SQLEXPRESS) SQL Server FullText Search (SQLEXPRESS) – c:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe (Microsoft Corporation)
SRV - (DSBrokerService) – C:\Program Files\DellSupport\brkrsvc.exe ()
SRV - (msvsmon80) – c:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe (Microsoft Corporation)
SRV - (WMPControllerService) – C:\DELL\Utilities\Dell Premium Remote Control\WMPControllerService.exe (Gyration, Inc.)


========== Driver Services (SafeList) ==========

DRV - (BHDrvx86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20100901.003\BHDrvx86.sys (Symantec Corporation)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100928.003\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100928.003\NAVENG.SYS (Symantec Corporation)
DRV - (PCGenFAM) – C:\Windows\system32\DRIVERS\PCGenFAM.sys (Soluto LTD.)
DRV - (SymEvent) – C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (IDSVix86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100927.001\IDSvix86.sys (Symantec Corporation)
DRV - (SYMTDIv) – C:\Windows\System32\Drivers\N360\0402000.00C\SYMTDIV.SYS (Symantec Corporation)
DRV - (SymIRON) – C:\Windows\system32\drivers\N360\0402000.00C\Ironx86.SYS (Symantec Corporation)
DRV - (SymEFA) – C:\Windows\system32\drivers\N360\0402000.00C\SYMEFA.SYS (Symantec Corporation)
DRV - (SRTSP) – C:\Windows\System32\Drivers\N360\0402000.00C\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\system32\drivers\N360\0402000.00C\SRTSPX.SYS (Symantec Corporation)
DRV - (MpFilter) – C:\Windows\System32\drivers\MpFilter.sys (Microsoft Corporation)
DRV - (MpNWMon) – C:\Windows\System32\drivers\MpNWMon.sys (Microsoft Corporation)
DRV - (ccHP) – C:\Windows\system32\drivers\N360\0402000.00C\ccHPx86.sys (Symantec Corporation)
DRV - (KSecPkg) – C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (SymDS) – C:\Windows\system32\drivers\N360\0402000.00C\SYMDS.SYS (Symantec Corporation)
DRV - (urvpndrv) – C:\Windows\System32\drivers\covpnwlh.sys (F5 Networks, Inc.)
DRV - (f5ipfw) – C:\Windows\System32\drivers\urfltwlh.sys (F5 Networks)
DRV - (mfehidk) – C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfesmfk) – C:\Windows\System32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (cmdide) – C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) – C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) – C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) – C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) – C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) – C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) – C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) – C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) – C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) – C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) – C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) – C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) – C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) – C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) – C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) – C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) – C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) – C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) – C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) – C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) – C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) – C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) – C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) – C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vmbus) – C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (vhdmp) – C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (vdrvroot) – C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (WIMMount) – C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) – C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) – C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) – C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) – C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) – C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) – C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) – C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) – C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) – C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) – C:\Windows\System32\drivers\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) – C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) – C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) – C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) – C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwifibus) – C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) – C:\Windows\System32\drivers\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) – C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (mshidkmdf) – C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) – C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) – C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) – C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) – C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (discache) – C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (HidBatt) – C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation)
DRV - (AcpiPmi) – C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) – C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) – C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) – C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) – C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (yukonw7) – C:\Windows\System32\drivers\yk62x86.sys (Marvell)
DRV - (netw5v32) Intel® – C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation)
DRV - (b57nd60x) – C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (ebdrv) – C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) – C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (CtClsFlt) – C:\Windows\System32\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV - (CtAudDrv) – C:\Windows\System32\drivers\CtAudDrv.sys (Creative Technology Ltd.)
DRV - (IdcPHid) IdeaCom HID Touch Screen Driver (PS/2) – C:\Windows\System32\drivers\idcphid.sys (IdeaCom Technology Inc.)
DRV - (TcUsb) – C:\Windows\System32\drivers\tcusb.sys (UPEK Inc.)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (MCSTRM) – C:\Windows\System32\drivers\mcstrm.sys (RealNetworks, Inc.)
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (OEM02Dev) – C:\Windows\System32\drivers\OEM02Dev.sys (Creative Technology Ltd.)
DRV - (iaStor) – C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (iaNvStor) Intel® – C:\Windows\system32\drivers\ianvstor.sys (Intel Corporation)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (rismxdp) – C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimmptsk) – C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rimsptsk) – C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (ElbyCDIO) – C:\Windows\System32\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV - (OEM02Vfx) – C:\Windows\System32\drivers\OEM02Vfx.sys (EyePower Games Pte. Ltd.)
DRV - (dsunidrv) – C:\Windows\System32\drivers\dsunidrv.sys (Gteko Ltd.)
DRV - (ElbyDelay) – C:\Windows\System32\drivers\ElbyDelay.sys (Elaborate Bytes AG)
DRV - (DSproct) – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys (Gteko Ltd.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.live.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Live Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledItems: {3191E4CE-790E-42be-B2E0-223475263B7E}:6030.2008.0904.1938
FF - prefs.js..extensions.enabledItems: {DBBB3167-6E81-400f-BBFD-BD8921726F52}:6030.2008.0904.1940
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..browser.startup.homepage: "http://www.xfinity.com/?cid=xfactiv_tech_main"
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"


FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Fiddler2\FiddlerHook [2010/03/08 20:50:17 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\IPSFFPlgn\ [2010/06/11 11:31:43 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\coFFPlgn\ [2010/06/09 12:48:49 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/16 23:05:57 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/19 00:26:29 | 000,000,000 | —D | M]

[2009/11/04 02:31:45 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Extensions
[2010/07/12 16:33:32 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\3nadhxl6.default\extensions
[2009/11/04 02:31:46 | 000,000,000 | —D | M] (F5 Networks Cache Cleaner Plugin) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\3nadhxl6.default\extensions\{3191E4CE-790E-42be-B2E0-223475263B7E}
[2010/07/12 16:33:32 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\3nadhxl6.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/11/04 02:31:47 | 000,000,000 | —D | M] (F5 Networks Host Plugin) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\3nadhxl6.default\extensions\{DBBB3167-6E81-400f-BBFD-BD8921726F52}
[2010/09/25 02:18:09 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions
[2009/11/04 02:31:49 | 000,000,000 | —D | M] (CS Lite) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{00084897-021a-4361-8423-083407a033e0}
[2010/02/28 01:37:31 | 000,000,000 | —D | M] (Image Zoom) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}
[2010/05/21 08:34:58 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/01/31 17:58:13 | 000,000,000 | —D | M] (Groowe Search Toolbar) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{268ad77e-cff8-42d7-b479-da60a7b93305}
[2010/09/24 00:14:48 | 000,000,000 | —D | M] (JonDoFox) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{437be45a-4114-11dd-b9ab-71d256d89593}
[2009/12/14 20:03:22 | 000,000,000 | —D | M] (ChatZilla) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
[2009/11/04 02:31:49 | 000,000,000 | —D | M] (Dr.Web anti-virus link checker) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{6614d11d-d21d-b211-ae23-815234e1ebb5}
[2009/11/04 02:31:50 | 000,000,000 | —D | M] (Copy Plain Text) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{723AAF16-AF1F-4404-A5D7-0BFE39766605}
[2010/09/24 00:14:56 | 000,000,000 | —D | M] (NoScript) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2009/11/04 02:31:50 | 000,000,000 | —D | M] (TabRenamizer) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{792BDDFE-2E7C-42ed-B18D-18154D2761BD}
[2009/11/04 02:31:50 | 000,000,000 | —D | M] (No name found) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{89736E8E-4B14-4042-8C75-AD00B6BD3900}
[2009/11/04 02:31:50 | 000,000,000 | —D | M] (MR Tech Toolkit) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{9669CC8F-B388-42FE-86F4-CB5E7F5A8BDC}(45)
[2009/11/04 02:31:50 | 000,000,000 | —D | M] (CacheIt!) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{98449521-9320-4257-aa35-9e1a39c8cbe0}
[2010/03/08 20:53:45 | 000,000,000 | —D | M] (Sage) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{a6ca9b3b-5e52-4f47-85d8-cca35bb57596}
[2010/07/16 01:00:34 | 000,000,000 | —D | M] (Calculator) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{AA052FD6-366A-4771-A591-0D8DC551585D}
[2009/11/04 02:31:51 | 000,000,000 | —D | M] (Temporary Inbox) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{ac1e10b8-206d-4746-a18e-0483852dc20b}
[2010/07/29 07:32:12 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2009/11/04 02:31:52 | 000,000,000 | —D | M] (Plain Text to Link) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{C90B0826-5A17-4970-A5BF-A43D22452E21}
[2009/11/04 02:31:52 | 000,000,000 | —D | M] (Media Pirate - The video downloader) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{cc265d3d-3f6f-0170-a78b-bbbaef7a868c}
[2009/11/04 02:31:52 | 000,000,000 | —D | M] (JSView) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{cf15270e-cf08-4def-b4ea-6a5ac23f3bca}
[2010/08/18 00:14:27 | 000,000,000 | —D | M] (Adblock Plus) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/05/21 08:34:57 | 000,000,000 | —D | M] (FoxClocks) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1}
[2009/11/04 02:31:55 | 000,000,000 | —D | M] (Menu Editor) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{EDA7B1D7-F793-4e03-B074-E6F303317FB0}
[2010/08/21 13:22:54 | 000,000,000 | —D | M] (ScribeFire) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{F807FACD-E46A-4793-B345-D58CB177673C}
[2010/09/16 23:07:14 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\[removed]
[2009/11/04 02:31:49 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\[removed]
[2009/11/04 02:31:49 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\elemhidehelper@adblockplus(44).org
[2010/07/21 00:49:08 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\[removed]
[2008/09/06 14:21:25 | 000,001,733 | —- | M] () – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\3nadhxl6.default\searchplugins\live-search.xml
[2010/09/16 23:05:55 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2007/02/22 19:19:12 | 000,165,248 | —- | M] (F5 Networks) – C:\Program Files\Mozilla Firefox\plugins\NPuroamHost.dll
[2008/12/30 05:13:42 | 000,000,897 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\livecom.png
[2008/12/30 05:13:42 | 000,001,015 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\livecom.src

O1 HOSTS File: ([2010/09/23 00:03:03 | 000,000,759 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Find as you type Helper) - {186A2813-D175-4cf8-B179-3873AC4E975C} - C:\Program Files\Ookii.org Find As You Type 1.3\InternetExplorerISearch.dll (Ookii.org)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Security Suite\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Security Suite\Engine\4.2.0.12\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Find as you type) - {4AE165F6-CCA4-4e9a-98CE-C2FE8B59F383} - C:\Program Files\Ookii.org Find As You Type 1.3\InternetExplorerISearch.dll (Ookii.org)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Find as you type) - {4AE165F6-CCA4-4E9A-98CE-C2FE8B59F383} - C:\Program Files\Ookii.org Find As You Type 1.3\InternetExplorerISearch.dll (Ookii.org)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O8 - Extra context menu item: Add to &Evernote - C:\Program Files\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - C:\Program Files\Fiddler2\Fiddler.exe (Eric Lawrence)
O9 - Extra 'Tools' menuitem : Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - C:\Program Files\Fiddler2\Fiddler.exe (Eric Lawrence)
O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: infospace.com ([bellevue] https in Trusted sites)
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: motricity.com ([bellevue] https in Trusted sites)
O15 - HKCU\..Trusted Domains: motricity.com ([outlook] https in Trusted sites)
O15 - HKCU\..Trusted Domains: netflix.com ([]* in Trusted sites)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {2A0B9B82-D5C8-4D3D-8338-AD55B23662B1} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\cachecleaner.cab (F5 Networks CacheCleaner)
O16 - DPF: {2BCDB465-81F9-41CB-832C-8037A4064446} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\urxvpn.cab (F5 Networks VPN Manager)
O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} http://picasaweb.google.com/s/v/58.17/uploader2.cab (UploadListView Class)
O16 - DPF: {41EF3CD2-D8CC-4438-84B1-280BB4E77C8E} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\f5tunsrv.cab (F5 Networks Dynamic Application Tunnel Control)
O16 - DPF: {45B69029-F3AB-4204-92DE-D5140C3E8E74} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\InstallerControl.cab (F5 Networks Auto Update)
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} https://support.dell.com/systemprofiler/SysProExe.CAB (WMI Class)
O16 - DPF: {57C76689-F052-487B-A19F-855AFDDF28EE} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\f5InspectionHost.cab (F5 Networks Policy Agent Host Class)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A3E21079-7F41-4125-9EBB-FD44CFCC0AC1} https://www.mesh.com/0.9.4014.13/TSWeb.cab (WLCTSCControl Class)
O16 - DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} http://support.dell.com/systemprofiler/DellSystemLite.CAB (DellSystemLite.Scanner)
O16 - DPF: {CC85ACDF-B277-486F-8C70-2C9B2ED2A4E7} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\urxshost.cab (F5 Networks SuperHost Class)
O16 - DPF: {E0FF21FA-B857-45C5-8621-F120A0C17FF2} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\urxhost.cab (F5 Networks Host Control)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E615C9EA-AD69-4AE9-83C9-9D906A0ACA6D} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\f5syschk.cab (F5 Networks OS Policy Agent)
O16 - DPF: {E6BB2089-163F-466B-812A-748096614DFD} http://cainternetsecurity.net/scanner/cascanner.cab (CAScanner Control)
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} http://download.mcafee.com/molbin/iss-loc/…852/mcfscan.cab (McFreeScan Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Program Files\Soluto\soluto.exe /userinit) - C:\Program Files\Soluto\soluto.exe (Soluto)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll File not found
O20 - Winlogon\Notify\psfus: DllName - C:\Windows\system32\psqlpwd.dll - C:\Windows\System32\psqlpwd.dll (UPEK Inc.)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\XPS_NB_1280x864_NewBlue.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\XPS_NB_1280x864_NewBlue.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\Windows\System32\livessp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = secfile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)
NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)

Drivers32: msacm.ac3acm - C:\Windows\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: VIDC.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

========== Files/Folders - Created Within 30 Days ==========

[2010/09/28 21:56:26 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Users\Ganesh\Desktop\OTL.exe
[2010/09/28 09:42:21 | 000,000,000 | —D | C] – C:\Users\Ganesh\AppData\Local\Adobe
[2010/09/25 19:28:00 | 000,000,000 | —D | C] – C:\Users\Ganesh\AppData\Local\Apple
[2010/09/19 00:56:25 | 000,000,000 | —D | C] – C:\Windows\System32\%LOCALAPPDATA%
[2010/09/19 00:18:04 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DivX Shared
[2010/09/19 00:16:03 | 000,000,000 | —D | C] – C:\ProgramData\DivX
[2010/09/15 10:00:43 | 000,000,000 | —D | C] – C:\Windows\PCHEALTH
[2010/09/04 14:37:43 | 000,000,000 | —D | C] – C:\Program Files\iPod
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/09/28 22:02:12 | 005,505,024 | -HS- | M] () – C:\Users\Ganesh\NTUSER.DAT
[2010/09/28 22:00:00 | 000,000,426 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{6BA1906C-24ED-48ED-B27E-B95ED6DE1510}.job
[2010/09/28 21:56:33 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\Ganesh\Desktop\OTL.exe
[2010/09/28 21:48:58 | 000,011,104 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/09/28 21:48:58 | 000,011,104 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/09/28 21:41:32 | 000,055,326 | —- | M] () – C:\ProgramData\nvModes.001
[2010/09/28 21:41:27 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/09/28 21:41:20 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/09/28 21:41:16 | 2414,395,392 | -HS- | M] () – C:\hiberfil.sys
[2010/09/28 21:40:00 | 000,000,860 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-735267809-354239087-596126657-1000Core.job
[2010/09/28 21:39:39 | 003,443,507 | -H– | M] () – C:\Users\Ganesh\AppData\Local\IconCache.db
[2010/09/28 21:39:20 | 000,284,915 | —- | M] () – C:\Users\Ganesh\Desktop\gmer.zip
[2010/09/28 21:16:22 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-735267809-354239087-596126657-1000UA.job
[2010/09/23 00:03:03 | 000,000,759 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2010/09/23 00:02:32 | 000,002,004 | -H– | M] () – C:\Users\Ganesh\Documents\Default.rdp
[2010/09/22 22:58:26 | 000,011,658 | —- | M] () – C:\Users\Ganesh\Documents\chit.xlsx
[2010/09/14 15:26:34 | 000,000,759 | —- | M] () – C:\Windows\System32\drivers\etc\hosts.bak
[2010/09/10 21:17:30 | 000,000,418 | RHS- | M] () – C:\ProgramData\ntuser.pol
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/28 21:39:17 | 000,284,915 | —- | C] () – C:\Users\Ganesh\Desktop\gmer.zip
[2010/09/22 22:58:24 | 000,011,658 | —- | C] () – C:\Users\Ganesh\Documents\chit.xlsx
[2010/06/22 20:53:46 | 000,000,098 | —- | C] () – C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2010/06/11 14:00:18 | 000,055,326 | —- | C] () – C:\ProgramData\nvModes.dat
[2010/06/11 14:00:18 | 000,055,326 | —- | C] () – C:\ProgramData\nvModes.001
[2010/06/09 12:45:30 | 000,000,418 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2010/06/04 20:06:42 | 000,007,597 | —- | C] () – C:\Users\Ganesh\AppData\Local\Resmon.ResmonCfg
[2010/05/08 10:48:37 | 000,087,552 | —- | C] () – C:\Windows\System32\cpwmon2k.dll
[2010/02/17 11:06:18 | 000,000,004 | —- | C] () – C:\Users\Ganesh\AppData\Roaming\avdrn.dat
[2010/02/07 22:09:27 | 000,003,584 | —- | C] () – C:\Users\Ganesh\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/07/13 16:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 16:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/06/28 04:59:45 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/05/04 15:03:00 | 000,059,904 | —- | C] () – C:\Windows\System32\zlib1.dll
[2009/05/04 14:53:28 | 000,286,720 | —- | C] () – C:\Windows\System32\libcurl.dll
[2009/05/04 14:53:10 | 000,143,360 | —- | C] () – C:\Windows\System32\libexpatw.dll
[2009/02/07 21:54:34 | 000,164,352 | —- | C] () – C:\Windows\System32\unrar.dll
[2009/02/07 21:54:30 | 000,755,027 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2009/02/07 21:54:29 | 000,159,839 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2009/02/07 21:54:26 | 000,007,680 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2009/02/07 21:54:26 | 000,000,547 | —- | C] () – C:\Windows\System32\ff_vfw.dll.manifest
[2009/02/07 21:50:59 | 000,395,776 | —- | C] () – C:\Windows\System32\libmplayer.dll
[2009/02/07 21:50:59 | 000,262,144 | —- | C] () – C:\Windows\System32\TomsMoComp_ff.dll
[2009/02/07 21:50:59 | 000,112,640 | —- | C] () – C:\Windows\System32\libmpeg2_ff.dll
[2009/02/07 21:50:58 | 002,255,360 | —- | C] () – C:\Windows\System32\libavcodec.dll
[2008/11/21 14:47:52 | 003,596,288 | —- | C] () – C:\Windows\System32\qt-dx331.dll
[2008/11/21 14:45:16 | 000,000,416 | —- | C] () – C:\Windows\System32\dtu100.dll.manifest
[2008/04/20 21:29:29 | 000,000,742 | —- | C] () – C:\Windows\ODBC.INI
[2008/03/30 19:19:07 | 000,054,342 | —- | C] () – C:\Users\Ganesh\AppData\Roaming\nvModes.001
[2008/03/29 23:43:10 | 000,054,342 | —- | C] () – C:\Users\Ganesh\AppData\Roaming\nvModes.dat
[2008/03/24 14:55:15 | 000,167,936 | —- | C] () – C:\Windows\System32\nvccoin.dll
[2008/03/24 14:55:14 | 000,016,480 | —- | C] () – C:\Windows\System32\rixdicon.dll
[2007/07/25 16:40:02 | 000,999,424 | —- | C] () – C:\Windows\System32\WLIHVUI.dll
[2003/09/16 08:52:28 | 000,147,456 | —- | C] () – C:\Windows\System32\vorbis.dll
[2003/09/16 08:43:31 | 000,884,736 | —- | C] () – C:\Windows\System32\vorbisenc.dll
[2003/09/16 08:41:43 | 000,045,056 | —- | C] () – C:\Windows\System32\ogg.dll

========== LOP Check ==========

[2009/11/04 02:30:50 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\ActionVoip
[2009/11/04 02:30:51 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Anonymizer
[2009/11/04 02:30:51 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Any DVD Converter Professional
[2010/01/28 11:26:34 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/01/29 14:40:54 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Cropper
[2009/11/04 02:30:51 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\DiskAid
[2009/12/27 14:05:29 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\GARMIN
[2009/11/04 02:30:58 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\JonDo
[2009/11/04 02:31:01 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Jumblo
[2009/11/04 02:31:56 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Notepad++
[2009/11/04 02:31:56 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\NProf
[2009/11/04 02:31:56 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\NUnit
[2010/06/29 20:37:05 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Opera
[2009/11/04 02:31:56 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Participatory Culture Foundation
[2009/11/04 02:31:57 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\PCF-VLC
[2010/06/04 15:23:48 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Protection Center
[2009/11/04 02:31:59 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\SciTech
[2010/07/23 19:28:25 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Softland
[2009/11/04 02:32:01 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\STOIK
[2009/11/04 02:32:01 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Subversion
[2010/07/11 20:56:57 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\TeamViewer
[2009/10/25 18:58:31 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\tmp
[2010/06/04 18:43:06 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\uTorrent
[2009/11/04 02:32:03 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Xtend2.71305F52FFD36D9BDDE00284EF6181AE6688276A.1
[2009/07/13 21:53:46 | 000,024,386 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/09/28 22:00:00 | 000,000,426 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{6BA1906C-24ED-48ED-B27E-B95ED6DE1510}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/06/10 14:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/07/13 18:38:58 | 000,383,562 | RHS- | M] () – C:\bootmgr
[2009/11/04 01:34:28 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2009/06/10 14:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2008/03/24 14:55:23 | 000,004,594 | RH– | M] () – C:\dell.sdr
[2010/09/28 21:41:16 | 2414,395,392 | -HS- | M] () – C:\hiberfil.sys
[2010/09/28 21:41:17 | 3219,193,856 | -HS- | M] () – C:\pagefile.sys
[2010/09/24 00:06:41 | 000,070,764 | —- | M] () – C:\TDSSKiller.2.4.2.1_24.09.2010_00.06.03_log.txt
[2009/01/04 19:47:21 | 000,001,106 | —- | M] () – C:\WirelessDiagLog.csv
[2008/08/25 23:26:11 | 000,000,152 | —- | M] () – C:\YServer.txt

< %systemroot%\Fonts\*.com >
[2009/07/13 21:52:25 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 21:52:25 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 21:52:25 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 21:52:25 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 14:31:19 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/13 18:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2007/04/09 13:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll
[2006/10/26 20:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
[2009/07/13 18:16:19 | 000,029,696 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2008/07/18 11:34:32 | 000,586,240 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 21:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/04/06 16:36:51 | 000,000,286 | -HS- | M] () – C:\Users\Ganesh\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini
[2009/11/04 07:54:58 | 000,000,221 | -HS- | M] () – C:\Users\Ganesh\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/09/28 21:56:33 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\Ganesh\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >
[2009/07/04 09:34:03 | 000,061,224 | —- | M] () – C:\Users\Ganesh\GoToAssistDownloadHelper.exe

< %systemroot%\ADDINS\*.* >
[2009/06/10 14:20:04 | 000,000,802 | —- | M] () – C:\Windows\addins\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2010/08/04 14:33:25 | 000,000,402 | -HS- | M] () – C:\Users\Ganesh\Favorites\desktop.ini
[2010/06/04 15:19:04 | 000,000,007 | —- | M] () – C:\Users\Ganesh\Favorites\_favdata.dat

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2010/06/22 20:53:47 | 000,000,098 | —- | M] () – C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2010/09/10 21:17:30 | 000,000,418 | RHS- | M] () – C:\ProgramData\ntuser.pol
[2010/09/28 21:41:32 | 000,055,326 | —- | M] () – C:\ProgramData\nvModes.001

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-09-15 17:00:57

< End of report >

Extras.txt
OTL Extras logfile created on: 9/28/2010 10:02:20 PM - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\Ganesh\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 54.00% Memory free
6.00 Gb Paging File | 4.00 Gb Available in Paging File | 73.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 173.71 Gb Total Space | 36.25 Gb Free Space | 20.87% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.90 Gb Free Space | 59.01% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GANESHLPT2
Current User Name: Ganesh
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = Opera.HTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~1\MICROS~4\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0046FA01-C5B9-4985-BACB-398DC480FC05}" = Adobe Photoshop CS3
"{00B8E278-E260-43F9-A2A1-9705578D5294}" = Microsoft Web Farm Framework Version 1 for IIS 7
"{02555039-4DFE-4C9C-902A-6D1E4BB973AF}" = NUnit 2.4.8
"{03D5ED9B-5181-43A3-82A4-3D30B0F3F8BB}" = PHP 5.2.9-2
"{048F77FE-17A6-4662-85D2-982C4C7AFE0C}" = Terminals
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{05EC21B8-4593-3037-A781-A6B5AFFCB19D}" = Microsoft Windows SDK for Visual Studio 2008 .NET Framework Tools
"{082BDF7B-4810-4599-BF0D-E3AC44EC8524}" = Microsoft ASP.NET 2.0 AJAX Extensions 1.0
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{085EF870-C825-4A51-9933-0506B30FF07D}" = Find As You Type for Internet Explorer 1.3
"{08A2E0FA-6BFC-4BFC-B8EA-8FBBB7DB1EA6}" = Microsoft URL Rewrite Module 1.1 for IIS 7
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{0F756CD9-4A1E-409B-B101-601DDC4C03AA}" = QualxServ Service Agreement
"{125EB8DD-8316-4559-9951-E969929381BD}" = Dell Premium Remote Control
"{1389C6A4-4965-4AEC-9175-08B54A10FA48}" = Microsoft SQL Server 2005 Mobile [ENU] Developer Tools
"{15F4085A-BC98-4590-AFFD-03BBBE49524E}" = Garmin Communicator Plugin
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{184E7118-0295-43C4-B72C-1D54AA75AAF7}" = Windows Live Mail
"{1BB649F1-20BA-4A98-8E75-C55146647D04}" = Soluto
"{1D2C96C3-A3F3-49E7-B839-95279DED837F}" = Opera 10.60
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{2012098D-EEE9-4769-8DD3-B038050854D4}" = Microsoft Silverlight 3 SDK
"{2349E6AA-CFCA-4D17-B633-3ECDA92E38CD}" = Internet Information Services (IIS) 7.0 Manager
"{23959E96-A80F-4172-A655-210E9BB7BFBE}" = MSDN Library for Visual Studio 2005
"{241F2BF7-69EB-42A4-9156-96B2426C7504}" = Microsoft SQL Server Compact 3.5 for Devices ENU
"{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2
"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0
"{291B3A3B-F808-45B8-8113-DF232FCB6C82}" = Microsoft .NET Compact Framework 3.5
"{29278000-5686-4DF8-A285-76D2AC05F82C}" = AdventureWorksLT
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2A0A6470-FD0F-4F45-9B11-85F3167DB943}" = Nokia Flashing Cable Driver
"{2D4F6BE3-6FEF-4FE9-9D01-1406B220D08C}" = Windows Live Photo Gallery
"{2D87E961-577B-492B-AD54-1368680FB9A7}" = Bing Maps 3D
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{2E5C075E-11AB-4BDD-918C-7B9A68953FF8}" = Microsoft SQL Server Compact 3.5 Design Tools ENU
"{2EEC2A94-7204-45C6-93BB-67EAEB19E4D6}" = Safari
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{328019A7-0012-401D-96A2-4CDDD02675A8}" = Garmin POI Loader
"{342D4AD7-EC4C-4EC8-AEA6-E70F5905A490}" = SQL Server System CLR Types
"{34A350D1-64FB-36D8-9D0C-1CD8E392DBA5}" = Google Talk Plugin
"{350FB27C-CF62-4EF3-AF9D-70FF313FE221}" = iTunes
"{388E4B09-3E71-4649-8921-F44A3A2954A7}" = Microsoft Visual Studio 2005 Tools for Office Runtime
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{401B18E1-7CBE-426D-8656-EF35260C7B67}" = Live Mesh Remote Desktop Service
"{437AB8E0-FB69-4222-B280-A64F3DE22591}" = Microsoft Visual Studio 2005 Professional Edition - ENU
"{44D4AF75-6870-41F5-9181-662EA05507E1}" = Microsoft Document Explorer 2005
"{48F95CE7-69D9-4967-81F7-D763CABFBD53}" = Debugging Tools for Windows (x86)
"{4B719A70-F14A-4f5c-90B5-346B24B7FFF1}" = Windows 7 Upgrade Advisor
"{4F44B5AE-82A6-4A8A-A3E3-E24D489728E3}" = Microsoft SQL Server 2008 Native Client
"{508CE775-4BA4-4748-82DF-FE28DA9F03B0}" = Windows Live Messenger
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{56B4002F-671C-49F4-984C-C760FE3806B5}" = Microsoft SQL Server VSS Writer
"{58D379F7-62BC-4748-8237-FE071ECE797C}" = Microsoft SQL Server 2005 Tools
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FD88490-011C-4DF1-B886-F298D955171B}" = MySQL Connector Net 5.2.5
"{63DB9CCD-2B56-4217-9A3D-507AC78320CA}" = mWMI
"{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
"{64c5b887-b5ee-42b8-8596-78905a6b5f1f}" = Microsoft Windows SDK for Visual Studio 2008 SDK Reference Assemblies and IntelliSense
"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator
"{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}" = Garmin USB Drivers
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{6753B40C-0FBD-3BED-8A9D-0ACAC2DCD85D}" = Microsoft Document Explorer 2008
"{68234B05-DEE0-4241-96F6-6EF0EBB5B89E}" = IIS Advanced Logging
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6C531060-84FB-4F96-8F33-29DF020632EB}" = Microsoft .NET Compact Framework 1.0 SP3 Developer
"{6C9F6D23-E9AD-43C9-B43A-011562AAF876}" = Windows Mobile 5.0 SDK R2 for Pocket PC
"{6CB234A8-06EE-4CA8-90D2-45186B8806B4}" = Microsoft Web Platform Installer 2.0 Beta
"{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{72950CC2-B95A-49DC-83E5-9BB34A77CCD6}" = IIS Database Manager Release Candidate
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7729EC8B-AC5F-47A9-B825-C2BFB19A295C}" = Microsoft External Cache Version 1 for IIS 7
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{7D95B533-4BA1-4EED-8096-EFCB6DD6B95F}" = AdventureWorksDB
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{7F1A9B02-5BFE-FCC1-4B38-DEB7B8E7DAFE}" = Xtend2 - Alpha 16
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{842FAF7C-50EF-4463-9B8F-6222E1384D7D}" = Microsoft Windows SDK for Visual Studio 2008 Headers and Libraries
"{8569B4A4-BF60-4A28-A4A9-20B159F07CA6}" = Microsoft Office Live Meeting 2005 Replay Wrapper
"{89CEAE14-DD0F-448E-9554-15781EC9DB24}" = Product Documentation Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8C6BB412-D3A8-4AAE-A01B-35B681789D68}" = mHelp
"{8CC51051-9B69-4F70-BBE6-F68DA834C05C}" = Nokia Software Updater
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{8FB53850-246A-3507-8ADE-0060093FFEA6}" = Visual Studio Tools for the Office system 3.0 Runtime
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ULTIMATER_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ULTIMATER_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ULTIMATER_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-0021-0000-0000-0000000FF1CE}" = Microsoft Office Visual Web Developer 2007
"{90120000-0021-0000-0000-0000000FF1CE}_VisualWebDeveloper_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0021-0409-0000-0000000FF1CE}" = Microsoft Office Visual Web Developer MUI (English) 2007
"{90120000-0021-0409-0000-0000000FF1CE}_VisualWebDeveloper_{E1044ED2-E4AD-4B39-B500-31109750F6B4}" = Microsoft Office SharePoint Designer 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ULTIMATER_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ULTIMATER_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{90850409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{91120000-002E-0000-0000-0000000FF1CE}" = Microsoft Office Ultimate 2007
"{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{9176251A-4CC1-4DDB-B343-B487195EB397}" = Windows Live Writer
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{9611E624-0539-46A4-B481-A44BB8CCC860}" = IIS Media Services 2.0
"{9656F3AC-6BA9-43F0-ABED-F214B5DAB27B}" = Windows Mobile 5.0 SDK R2 for Smartphone
"{9A33B83D-FFC4-44CF-BEEF-632DECEF2FCD}" = Microsoft SQL Server Database Publishing Wizard 1.2
"{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}" = OutlookAddinSetup
"{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}" = MediaDirect
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{9E2EB8B9-A938-47A2-AB22-6EEEDC7DC44D}" = Cropper
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver
"{A2289997-10A3-48F2-AA03-99180D761661}" = Fingerprint Reader Suite 5.6
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A4394612-D02F-11DC-9BFF-D18556D89593}" = Microsoft ASP.NET MVC 1.0
"{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}" = Windows Live installer
"{A90036CE-E7B2-4C42-B52D-B2843BC31884}" = AdventureWorksBI
"{AA467959-A1D6-4F45-90CD-11DC57733F32}" = Crystal Reports Basic for Visual Studio 2008
"{ABB6AC00-F1D8-4EBF-8128-830D090B76C0}" = Microsoft SQL Server 2000 Sample Database Scripts
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.4
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AE41BE84-761C-0F5E-451B-3D145E8A8840}" = Acrobat.com
"{B0F9497C-52B4-4686-8E73-74D866BBDF59}" = Microsoft SQL Server 2005 (SQLEXPRESS)
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B268E9A1-04A9-40D0-9866-846BE2B74BA7}" = Microsoft Windows SDK for Visual Studio 2008 Win32 Tools
"{B32E7732-B2FB-3FD0-81AC-6025B1104C66}" = Microsoft Device Emulator version 3.0 - ENU
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BA4DA261-CB60-4690-B202-44998DFC6986}" = Microsoft SQL Server 2008 Setup Support Files
"{BCC899FE-2DAA-460C-A5FB-60291E73D9C3}" = Microsoft SQL Server Compact 3.5 ENU
"{BD68F46D-8A82-4664-8E68-F87C55BDEFD4}" = Microsoft SQL Server Native Client
"{BF7E46AB-0A5B-4B43-B53C-0E340044FE51}" = Microsoft Application Request Routing Version 2 for IIS 7 Beta 1
"{C1DBECBB-6A81-483C-9D27-D9F121D12EBC}" = Web Deployment Tool Release Candidate 1
"{C3F19A5F-35A8-4FDB-A6ED-0F4CE398DA48}" = Nokia Connectivity Cable Driver
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C4972073-2BFE-475D-8441-564EA97DA161}" = QuickSet
"{CAA376AF-0DE8-4FCA-942E-C6AC579B94B3}" = Microsoft Windows SDK for Visual Studio 2008 Tools
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CB8D173D-B856-4356-B5C4-809998A98833}" = Garmin BaseCamp
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CDD71FFC-2865-4020-A531-8FDB11F24937}" = DataStructures20
"{CEF7211D-CE3A-44C4-B321-D84A2099AE94}" = Comcast Desktop Software (v1.2.0.9)
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D1BB4446-AE9C-4256-9A7F-4D46604D2462}" = Adobe Setup
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D7769185-9A7C-48D4-8874-5388743A1DE2}" = Music, Photos & Videos Launcher
"{D7DAD1E4-45F4-3B2B-899A-EA728167EC4F}" = Microsoft Visual Studio 2008 Professional Edition - ENU
"{D87149B3-7A1D-4548-9CBF-032B791E5908}" = Desktop Doctor
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DCB4E1D9-B187-4B54-971E-1478485C9A53}" = Live Mesh
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DDF6E319-BCD9-4FE3-9D69-26B2F47BEF7C}" = Microsoft SQL Server 2005 Samples
"{E4C14C2F-3E75-4359-93FD-C4DC3DCAE373}" = Microsoft SQL Server Driver for PHP 1.0
"{E62A1F01-07B7-4541-A835-EE5B0BF064C2}" = Microsoft Antimalware
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{EB900AF8-CC61-4E15-871B-98D1EA3E8025}" = QuickTime
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE
"{EDDF99D9-9FE3-4871-A7DB-D1522C51EE9A}" = Microsoft .NET Compact Framework 2.0 SP2
"{EE67AE22-12F8-4E9F-B9C7-D72E5ED61625}" = Architecture Journal Reader
"{EF98A02A-1748-4762-9B7D-5ED1600520D5}" = Microsoft Security Essentials
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F43867C9-68FD-46C7-B0AF-214356305B5E}" = Microsoft SQL Server Management Studio Express
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"{F5D7FAB5-A1FD-4DD3-983E-4155B09D7102}" = mCore
"{F5E87B12-3C27-452F-8E78-21D42164FD83}" = Microsoft SQL Server 2008 Management Objects
"{F761359C-9CED-45AE-9A51-9D6605CD55C4}" = Evernote
"{FCC07EEA-FA18-4A21-9105-9666603C6885}" = McAfee Virtual Technician
"{FF29527A-44CD-3422-945E-981A13584000}" = VC Runtimes MSI
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"7-Zip" = 7-Zip 4.58 beta
"ActionVoip_is1" = ActionVoip
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_2ac78060bc5856b0c1cf873bb919b58" = Adobe Photoshop CS3
"Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
"Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Advanced Video FX Engine" = Advanced Video FX Engine
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Creative OEM002" = Laptop Integrated Webcam Driver (1.04.01.1011)
"CutePDF Writer Installation" = CutePDF Writer 2.8
"Dell Webcam Central" = Dell Webcam Central
"DivX Setup.divx.com" = DivX Setup
"doPDF 7 printer_is1" = doPDF 7.1 printer
"Fiddler2" = Fiddler2
"FormatFactory" = FormatFactory 2.30
"GoToAssist" = GoToAssist 8.0.0.514
"HijackThis" = HijackThis 2.0.2
"JonDoUninstall" = JonDo
"Jumblo_is1" = Jumblo
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 4.0.7
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Document Explorer 2005" = Microsoft Document Explorer 2005
"Microsoft Document Explorer 2008" = Microsoft Document Explorer 2008
"Microsoft Security Essentials" = Microsoft Security Essentials
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Microsoft Visual Studio 2005 Professional Edition - ENU" = Microsoft Visual Studio 2005 Professional Edition - ENU
"Microsoft Visual Studio 2005 Tools for Office Runtime" = Visual Studio 2005 Tools for Office Second Edition Runtime
"Microsoft Visual Studio 2008 Professional Edition - ENU" = Microsoft Visual Studio 2008 Professional Edition - ENU
"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)
"MSDN Library for Visual Studio 2005" = MSDN Library for Visual Studio 2005
"N360" = Norton Security Suite
"Notepad++" = Notepad++
"NProf-0.10_is1" = NProf 0.10
"NVIDIA Drivers" = NVIDIA Drivers
"Picasa 3" = Picasa 3
"ProInst" = Intel® PROSet/Wireless Software
"RealPlayer 12.0" = RealPlayer
"TeamViewer 5" = TeamViewer 5
"ULTIMATER" = Microsoft Office Ultimate 2007
"Vim 7.2" = Vim 7.2 (self-installing)
"VirtualCloneDrive" = VirtualCloneDrive
"Visual Studio Tools for the Office system 3.0 Runtime" = Visual Studio Tools for the Office system 3.0 Runtime
"VisualWebDeveloper" = Microsoft Visual Studio Web Authoring Component
"VLC media player" = VideoLAN VLC media player 0.8.6h
"WildTangent dell Master Uninstall" = Dell Games
"WinGimp-2.0_is1" = GIMP 2.4.6
"WinRAR archiver" = WinRAR archiver
"Xtend2.71305F52FFD36D9BDDE00284EF6181AE6688276A.1" = Xtend2 - Alpha 16
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Software Update" = Yahoo! Software Update

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"309a46b1dc89b774" = Dell Driver Download Manager
"Competition Arena" = Competition Arena
"f031ef6ac137efc5" = Dell Driver Download Manager - 1
"Google Chrome" = Google Chrome
"HuluDesktop" = Hulu Desktop
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >
Post #4
Here is the log from gmer.txt file, Please let me known if you got all the info you need. Thanks once again for helping me.

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-28 23:16:18
Windows 6.1.7600
Running: gmer.exe; Driver: C:\Users\Ganesh\AppData\Local\Temp\fwlyaaow.sys


—- System - GMER 1.0.15 —-

SSDT 89495E00 ZwAlertResumeThread
SSDT 89617568 ZwAlertThread
SSDT 889E7368 ZwAllocateVirtualMemory
SSDT 885FD950 ZwAlpcConnectPort
SSDT 88996B98 ZwAssignProcessToJobObject
SSDT 891AD048 ZwCreateMutant
SSDT 88BD6968 ZwCreateSymbolicLinkObject
SSDT 88CF3050 ZwCreateThread
SSDT 88B9AB10 ZwCreateThreadEx
SSDT 88B22AA0 ZwDebugActiveProcess
SSDT 896190B0 ZwDuplicateObject
SSDT 895FCA78 ZwFreeVirtualMemory
SSDT 8908D9C8 ZwImpersonateAnonymousToken
SSDT 88FE9588 ZwImpersonateThread
SSDT 885FDFD0 ZwLoadDriver
SSDT 8961FBF8 ZwMapViewOfSection
SSDT 896EC008 ZwOpenEvent
SSDT 88BF4D38 ZwOpenProcess
SSDT 892260A0 ZwOpenProcessToken
SSDT 8973FFD0 ZwOpenSection
SSDT 894A30A0 ZwOpenThread
SSDT 88B3F308 ZwProtectVirtualMemory
SSDT 8948EB60 ZwResumeThread
SSDT 88C9B988 ZwSetContextThread
SSDT 890820B0 ZwSetInformationProcess
SSDT 89690FA8 ZwSetSystemInformation
SSDT 896283B8 ZwSuspendProcess
SSDT 892E3B68 ZwSuspendThread
SSDT 88B28AE0 ZwTerminateProcess
SSDT 88C827B0 ZwTerminateThread
SSDT 8896A050 ZwUnmapViewOfSection
SSDT 88F63E30 ZwWriteVirtualMemory

INT 0x1F \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83230AF8
INT 0x37 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83230104
INT 0xC1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 832303F4
INT 0xD1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83218634
INT 0xD2 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83218898
INT 0xDF \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 832301DC
INT 0xE1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83230958
INT 0xE3 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 832306F8
INT 0xFD \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83230F2C
INT 0xFE \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 832311A8

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 82E49599 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82E6DF52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, …] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!RtlSidHashLookup + 224 82E75734 8 Bytes [00, 5E, 49, 89, 68, 75, 61, …]
.text ntkrnlpa.exe!RtlSidHashLookup + 23C 82E7574C 4 Bytes [68, 73, 9E, 88]
.text ntkrnlpa.exe!RtlSidHashLookup + 248 82E75758 4 Bytes [50, D9, 5F, 88] {PUSH EAX; FSTP DWORD [EDI-0x78]}
.text ntkrnlpa.exe!RtlSidHashLookup + 29C 82E757AC 4 Bytes [98, 6B, 99, 88]
.text ntkrnlpa.exe!RtlSidHashLookup + 318 82E75828 4 Bytes [48, D0, 1A, 89]
.text …
.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x9242D320, 0x3F5147, 0xE8000020]
.text peauth.sys A4E30C9D 1 Byte [04]
.text peauth.sys A4E30C9D 28 Bytes [04, 27, D0, A9, 12, 26, A2, …]
.text peauth.sys A4E30CC1 1 Byte [04]
.text peauth.sys A4E30CC1 28 Bytes [04, 27, D0, A9, 12, 26, A2, …]
PAGE peauth.sys A4E36B9B 72 Bytes [60, 77, 08, 4A, C8, 53, FE, …]
PAGE …

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Internet Explorer\iexplore.exe[3028] ntdll.dll!wcsncmp + 33B 77C2F620 7 Bytes JMP 03CE003A
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!CreateDialogParamW 77629BFF 5 Bytes JMP 65BCC570 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!EnableWindow 7762A72E 5 Bytes JMP 65BCC4EB C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!GetAsyncKeyState 7762C09A 5 Bytes JMP 65B8D6E9 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!UnhookWindowsHookEx 7762CC7B 5 Bytes JMP 65C8835E C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!CallNextHookEx 7762CC8F 5 Bytes JMP 65C69D5C C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!CreateWindowExW 77630E51 5 Bytes JMP 65C78157 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!SetWindowsHookExW 7763210A 5 Bytes JMP 65C24633 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!GetKeyState 77634FDA 5 Bytes JMP 65BCD762 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!IsDialogMessageW 77636F06 5 Bytes JMP 65B94284 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!CreateDialogParamA 77643E79 5 Bytes JMP 65DA0571 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!IsDialogMessage 7764407A 5 Bytes JMP 65D9FE12 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!CreateDialogIndirectParamA 77649110 5 Bytes JMP 65DA05A8 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!CreateDialogIndirectParamW 776508AD 5 Bytes JMP 65DA05DF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!DialogBoxIndirectParamW 77654AA7 5 Bytes JMP 65D9F970 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!EndDialog 7765555C 5 Bytes JMP 65B95AE9 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!DialogBoxParamW 7765564A 5 Bytes JMP 65B94BA7 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!SetKeyboardState 77656B52 5 Bytes JMP 65DA0177 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!SendInput 77657055 5 Bytes JMP 65DA0D3C C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!SetCursorPos 7766C1D8 5 Bytes JMP 65DA0D94 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!DialogBoxParamA 7766CF6A 5 Bytes JMP 65D9F90D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!DialogBoxIndirectParamA 7766D29C 5 Bytes JMP 65D9F9D3 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!MessageBoxIndirectA 7767E8C9 5 Bytes JMP 65D9F8A2 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!MessageBoxIndirectW 7767E9C3 5 Bytes JMP 65D9F837 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!MessageBoxExA 7767EA29 5 Bytes JMP 65D9F7D5 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!MessageBoxExW 7767EA4D 5 Bytes JMP 65D9F773 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] USER32.dll!keybd_event 7767EC9B 5 Bytes JMP 65DA10C7 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] SHELL32.dll!SHChangeNotification_Lock + 45BA 765DB440 4 Bytes [11, 36, 0C, 63] {ADC [ESI], ESI; OR AL, 0x63}
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] SHELL32.dll!SHChangeNotification_Lock + 45C2 765DB448 8 Bytes [5F, 35, 0C, 63, D0, 73, 0B, …]
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] ole32.dll!OleLoadFromStream 77425B88 5 Bytes JMP 65D9FCCE C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] ole32.dll!CoGetContextToken + 5C0 7745A2CF 7 Bytes JMP 03CE03D9
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] ole32.dll!CoCreateInstance 774757FC 5 Bytes JMP 65C78C45 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3028] ole32.dll!CoCreateInstance + 3E 7747583A 7 Bytes JMP 03CE0323
.text C:\Program Files\Internet Explorer\iexplore.exe[5540] USER32.dll!CreateWindowExW 77630E51 5 Bytes JMP 65C78157 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5540] USER32.dll!DialogBoxIndirectParamW 77654AA7 5 Bytes JMP 65D9F970 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5540] USER32.dll!DialogBoxParamW 7765564A 5 Bytes JMP 65B94BA7 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5540] USER32.dll!DialogBoxParamA 7766CF6A 5 Bytes JMP 65D9F90D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5540] USER32.dll!DialogBoxIndirectParamA 7766D29C 5 Bytes JMP 65D9F9D3 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5540] USER32.dll!MessageBoxIndirectA 7767E8C9 5 Bytes JMP 65D9F8A2 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5540] USER32.dll!MessageBoxIndirectW 7767E9C3 5 Bytes JMP 65D9F837 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5540] USER32.dll!MessageBoxExA 7767EA29 5 Bytes JMP 65D9F7D5 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5540] USER32.dll!MessageBoxExW 7767EA4D 5 Bytes JMP 65D9F773 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] ntdll.dll!wcsncmp + 33B 77C2F620 7 Bytes JMP 0529003A
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!CreateDialogParamW 77629BFF 5 Bytes JMP 65BCC570 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!EnableWindow 7762A72E 5 Bytes JMP 65BCC4EB C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!GetAsyncKeyState 7762C09A 5 Bytes JMP 65B8D6E9 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!UnhookWindowsHookEx 7762CC7B 5 Bytes JMP 65C8835E C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!CallNextHookEx 7762CC8F 5 Bytes JMP 65C69D5C C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!CreateWindowExW 77630E51 5 Bytes JMP 65C78157 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!SetWindowsHookExW 7763210A 5 Bytes JMP 65C24633 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!GetKeyState 77634FDA 5 Bytes JMP 65BCD762 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!IsDialogMessageW 77636F06 5 Bytes JMP 65B94284 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!CreateDialogParamA 77643E79 5 Bytes JMP 65DA0571 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!IsDialogMessage 7764407A 5 Bytes JMP 65D9FE12 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!CreateDialogIndirectParamA 77649110 5 Bytes JMP 65DA05A8 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!CreateDialogIndirectParamW 776508AD 5 Bytes JMP 65DA05DF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!DialogBoxIndirectParamW 77654AA7 5 Bytes JMP 65D9F970 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!EndDialog 7765555C 5 Bytes JMP 65B95AE9 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!DialogBoxParamW 7765564A 5 Bytes JMP 65B94BA7 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!SetKeyboardState 77656B52 5 Bytes JMP 65DA0177 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!SendInput 77657055 5 Bytes JMP 65DA0D3C C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!SetCursorPos 7766C1D8 5 Bytes JMP 65DA0D94 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!DialogBoxParamA 7766CF6A 5 Bytes JMP 65D9F90D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!DialogBoxIndirectParamA 7766D29C 5 Bytes JMP 65D9F9D3 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!MessageBoxIndirectA 7767E8C9 5 Bytes JMP 65D9F8A2 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!MessageBoxIndirectW 7767E9C3 5 Bytes JMP 65D9F837 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!MessageBoxExA 7767EA29 5 Bytes JMP 65D9F7D5 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!MessageBoxExW 7767EA4D 5 Bytes JMP 65D9F773 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] USER32.dll!keybd_event 7767EC9B 5 Bytes JMP 65DA10C7 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] SHELL32.dll!SHChangeNotification_Lock + 45BA 765DB440 4 Bytes [11, 36, 0C, 63] {ADC [ESI], ESI; OR AL, 0x63}
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] SHELL32.dll!SHChangeNotification_Lock + 45C2 765DB448 8 Bytes [5F, 35, 0C, 63, D0, 73, 0B, …]
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] ole32.dll!OleLoadFromStream 77425B88 5 Bytes JMP 65D9FCCE C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] ole32.dll!CoGetContextToken + 5C0 7745A2CF 7 Bytes JMP 052903D9
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] ole32.dll!CoCreateInstance 774757FC 5 Bytes JMP 65C78C45 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5588] ole32.dll!CoCreateInstance + 3E 7747583A 7 Bytes JMP 05290323

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\tdx \Device\Tcp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

Device \Driver\ACPI_HAL \Device\00000065 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\tdx \Device\Udp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\tdx \Device\RawIp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SOFTWARE\Microsoft\Windows Search\UsnNotifier\Windows\Catalogs\SystemIndex@{4F0C9FE7-F9AA-11DC-81E3-806E6F6E6963} 13778528928

—- EOF - GMER 1.0.15 —-

Attachments:

Post #5
Please do the following.


Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:Otl
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

:Commands
[emptytemp]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )




Next



Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2



**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.
Post #6
I have run OTL and comboFix and following are the logs

OTL.txt

OTL logfile created on: 9/29/2010 9:52:39 PM - Run 2
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\Ganesh\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 61.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 173.71 Gb Total Space | 36.46 Gb Free Space | 20.99% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.90 Gb Free Space | 59.01% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GANESHLPT2
Current User Name: Ganesh
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Ganesh\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\Soluto\SolutoService.exe (Soluto)
PRC - C:\Program Files\Soluto\Soluto.exe (Soluto)
PRC - C:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Norton Security Suite\Engine\4.2.0.12\ccsvchst.exe (Symantec Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\inetsrv\WMSvc.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
PRC - c:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Windows\System32\stacsv.exe (IDT, Inc.)
PRC - C:\Windows\System32\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - c:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe (Microsoft Corporation)
PRC - C:\Windows\OEM02Mon.exe (Creative Technology Ltd.)
PRC - C:\Program Files\Fingerprint Reader Suite\upeksvr.exe (UPEK Inc.)
PRC - C:\Program Files\Fingerprint Reader Suite\psqltray.exe (UPEK Inc.)
PRC - C:\Tools\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)


========== Modules (SafeList) ==========

MOD - C:\Users\Ganesh\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation)
MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (MBackMonitor) – C:\Program Files\McAfee\MBK\MBackMonitor.exe File not found
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (TeamViewer5) – C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (SolutoService) – C:\Program Files\Soluto\SolutoService.exe (Soluto)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (N360) – C:\Program Files\Norton Security Suite\Engine\4.2.0.12\ccSvcHst.exe (Symantec Corporation)
SRV - (wlcrasvc) – C:\Program Files\Live Mesh\Remote Desktop\wlcrasvc.exe (Microsoft Corporation)
SRV - (wlidsvc) – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (WwanSvc) – C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) – C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) – C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) – C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) – C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (RpcEptMapper) – C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (PNRPsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) – C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) – C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) – C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (WAS) – C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (W3SVC) – C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (ftpsvc) – C:\Windows\System32\inetsrv\ftpsvc.dll (Microsoft Corporation)
SRV - (Dhcp) – C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) – C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) – C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX Installer (AxInstSV) – C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppHostSvc) – C:\Windows\System32\inetsrv\apphostsvc.dll (Microsoft Corporation)
SRV - (AppIDSvc) – C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (WMSVC) – C:\Windows\System32\inetsrv\WMSvc.exe (Microsoft Corporation)
SRV - (sppsvc) – C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
SRV - (IISADMIN) – C:\Windows\System32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (MSSQL$SQLEXPRESS) SQL Server (SQLEXPRESS) – c:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (MsDepSvc) – C:\Program Files\IIS\Microsoft Web Deploy\MsDepSvc.exe (Microsoft Corporation)
SRV - (SQLWriter) – c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
SRV - (SQLBrowser) – c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
SRV - (MSSQLServerADHelper) – c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (sprtsvc_ddoctorv2) SupportSoft Sprocket Service (ddoctorv2) – C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (STacSV) – C:\Windows\System32\stacsv.exe (IDT, Inc.)
SRV - (AESTFilters) – C:\Windows\System32\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (msvsmon90) – C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe (Microsoft Corporation)
SRV - (WLSetupSvc) – C:\Program Files\Windows Live\installer\WLSetupSvc.exe (Microsoft Corporation)
SRV - (usnjsvc) – C:\Program Files\Windows Live\Messenger\usnsvc.exe (Microsoft Corporation)
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (EvtEng) Intel® – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (RegSrvc) Intel® – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (msftesql$SQLEXPRESS) SQL Server FullText Search (SQLEXPRESS) – c:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe (Microsoft Corporation)
SRV - (DSBrokerService) – C:\Program Files\DellSupport\brkrsvc.exe ()
SRV - (msvsmon80) – c:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe (Microsoft Corporation)
SRV - (WMPControllerService) – C:\DELL\Utilities\Dell Premium Remote Control\WMPControllerService.exe (Gyration, Inc.)


========== Driver Services (SafeList) ==========

DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100929.021\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100929.021\NAVENG.SYS (Symantec Corporation)
DRV - (BHDrvx86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20100901.003\BHDrvx86.sys (Symantec Corporation)
DRV - (PCGenFAM) – C:\Windows\system32\DRIVERS\PCGenFAM.sys (Soluto LTD.)
DRV - (SymEvent) – C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (IDSVix86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100929.001\IDSvix86.sys (Symantec Corporation)
DRV - (SYMTDIv) – C:\Windows\System32\Drivers\N360\0402000.00C\SYMTDIV.SYS (Symantec Corporation)
DRV - (SymIRON) – C:\Windows\system32\drivers\N360\0402000.00C\Ironx86.SYS (Symantec Corporation)
DRV - (SymEFA) – C:\Windows\system32\drivers\N360\0402000.00C\SYMEFA.SYS (Symantec Corporation)
DRV - (SRTSP) – C:\Windows\System32\Drivers\N360\0402000.00C\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\system32\drivers\N360\0402000.00C\SRTSPX.SYS (Symantec Corporation)
DRV - (MpFilter) – C:\Windows\System32\drivers\MpFilter.sys (Microsoft Corporation)
DRV - (MpNWMon) – C:\Windows\System32\drivers\MpNWMon.sys (Microsoft Corporation)
DRV - (ccHP) – C:\Windows\system32\drivers\N360\0402000.00C\ccHPx86.sys (Symantec Corporation)
DRV - (KSecPkg) – C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (SymDS) – C:\Windows\system32\drivers\N360\0402000.00C\SYMDS.SYS (Symantec Corporation)
DRV - (urvpndrv) – C:\Windows\System32\drivers\covpnwlh.sys (F5 Networks, Inc.)
DRV - (f5ipfw) – C:\Windows\System32\drivers\urfltwlh.sys (F5 Networks)
DRV - (mfehidk) – C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfesmfk) – C:\Windows\System32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (cmdide) – C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) – C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) – C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) – C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) – C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) – C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) – C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) – C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) – C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) – C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) – C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) – C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) – C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) – C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) – C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) – C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) – C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) – C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) – C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) – C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) – C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) – C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) – C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) – C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vmbus) – C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (vhdmp) – C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (vdrvroot) – C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (WIMMount) – C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) – C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) – C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) – C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) – C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) – C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) – C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) – C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) – C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) – C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) – C:\Windows\System32\drivers\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) – C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) – C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) – C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) – C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwifibus) – C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) – C:\Windows\System32\drivers\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) – C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (mshidkmdf) – C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) – C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) – C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) – C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) – C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (discache) – C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (HidBatt) – C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation)
DRV - (AcpiPmi) – C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) – C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) – C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) – C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) – C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (yukonw7) – C:\Windows\System32\drivers\yk62x86.sys (Marvell)
DRV - (netw5v32) Intel® – C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation)
DRV - (b57nd60x) – C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (ebdrv) – C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) – C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (CtClsFlt) – C:\Windows\System32\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV - (CtAudDrv) – C:\Windows\System32\drivers\CtAudDrv.sys (Creative Technology Ltd.)
DRV - (IdcPHid) IdeaCom HID Touch Screen Driver (PS/2) – C:\Windows\System32\drivers\idcphid.sys (IdeaCom Technology Inc.)
DRV - (TcUsb) – C:\Windows\System32\drivers\tcusb.sys (UPEK Inc.)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (MCSTRM) – C:\Windows\System32\drivers\mcstrm.sys (RealNetworks, Inc.)
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (OEM02Dev) – C:\Windows\System32\drivers\OEM02Dev.sys (Creative Technology Ltd.)
DRV - (iaStor) – C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (iaNvStor) Intel® – C:\Windows\system32\drivers\ianvstor.sys (Intel Corporation)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (rismxdp) – C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimmptsk) – C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rimsptsk) – C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (ElbyCDIO) – C:\Windows\System32\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV - (OEM02Vfx) – C:\Windows\System32\drivers\OEM02Vfx.sys (EyePower Games Pte. Ltd.)
DRV - (dsunidrv) – C:\Windows\System32\drivers\dsunidrv.sys (Gteko Ltd.)
DRV - (ElbyDelay) – C:\Windows\System32\drivers\ElbyDelay.sys (Elaborate Bytes AG)
DRV - (DSproct) – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys (Gteko Ltd.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.live.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Live Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledItems: {3191E4CE-790E-42be-B2E0-223475263B7E}:6030.2008.0904.1938
FF - prefs.js..extensions.enabledItems: {DBBB3167-6E81-400f-BBFD-BD8921726F52}:6030.2008.0904.1940
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..browser.startup.homepage: "http://www.xfinity.com/?cid=xfactiv_tech_main"
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"


FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Fiddler2\FiddlerHook [2010/03/08 20:50:17 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\IPSFFPlgn\ [2010/06/11 11:31:43 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\coFFPlgn\ [2010/06/09 12:48:49 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/16 23:05:57 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/19 00:26:29 | 000,000,000 | —D | M]

[2009/11/04 02:31:45 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Extensions
[2010/07/12 16:33:32 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\3nadhxl6.default\extensions
[2009/11/04 02:31:46 | 000,000,000 | —D | M] (F5 Networks Cache Cleaner Plugin) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\3nadhxl6.default\extensions\{3191E4CE-790E-42be-B2E0-223475263B7E}
[2010/07/12 16:33:32 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\3nadhxl6.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/11/04 02:31:47 | 000,000,000 | —D | M] (F5 Networks Host Plugin) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\3nadhxl6.default\extensions\{DBBB3167-6E81-400f-BBFD-BD8921726F52}
[2010/09/28 23:46:11 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions
[2009/11/04 02:31:49 | 000,000,000 | —D | M] (CS Lite) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{00084897-021a-4361-8423-083407a033e0}
[2010/02/28 01:37:31 | 000,000,000 | —D | M] (Image Zoom) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}
[2010/05/21 08:34:58 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/01/31 17:58:13 | 000,000,000 | —D | M] (Groowe Search Toolbar) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{268ad77e-cff8-42d7-b479-da60a7b93305}
[2010/09/24 00:14:48 | 000,000,000 | —D | M] (JonDoFox) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{437be45a-4114-11dd-b9ab-71d256d89593}
[2009/12/14 20:03:22 | 000,000,000 | —D | M] (ChatZilla) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
[2009/11/04 02:31:49 | 000,000,000 | —D | M] (Dr.Web anti-virus link checker) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{6614d11d-d21d-b211-ae23-815234e1ebb5}
[2009/11/04 02:31:50 | 000,000,000 | —D | M] (Copy Plain Text) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{723AAF16-AF1F-4404-A5D7-0BFE39766605}
[2010/09/24 00:14:56 | 000,000,000 | —D | M] (NoScript) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2009/11/04 02:31:50 | 000,000,000 | —D | M] (TabRenamizer) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{792BDDFE-2E7C-42ed-B18D-18154D2761BD}
[2009/11/04 02:31:50 | 000,000,000 | —D | M] (No name found) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{89736E8E-4B14-4042-8C75-AD00B6BD3900}
[2009/11/04 02:31:50 | 000,000,000 | —D | M] (MR Tech Toolkit) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{9669CC8F-B388-42FE-86F4-CB5E7F5A8BDC}(45)
[2009/11/04 02:31:50 | 000,000,000 | —D | M] (CacheIt!) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{98449521-9320-4257-aa35-9e1a39c8cbe0}
[2010/03/08 20:53:45 | 000,000,000 | —D | M] (Sage) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{a6ca9b3b-5e52-4f47-85d8-cca35bb57596}
[2010/07/16 01:00:34 | 000,000,000 | —D | M] (Calculator) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{AA052FD6-366A-4771-A591-0D8DC551585D}
[2009/11/04 02:31:51 | 000,000,000 | —D | M] (Temporary Inbox) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{ac1e10b8-206d-4746-a18e-0483852dc20b}
[2010/07/29 07:32:12 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2009/11/04 02:31:52 | 000,000,000 | —D | M] (Plain Text to Link) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{C90B0826-5A17-4970-A5BF-A43D22452E21}
[2009/11/04 02:31:52 | 000,000,000 | —D | M] (Media Pirate - The video downloader) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{cc265d3d-3f6f-0170-a78b-bbbaef7a868c}
[2009/11/04 02:31:52 | 000,000,000 | —D | M] (JSView) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{cf15270e-cf08-4def-b4ea-6a5ac23f3bca}
[2010/08/18 00:14:27 | 000,000,000 | —D | M] (Adblock Plus) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/05/21 08:34:57 | 000,000,000 | —D | M] (FoxClocks) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1}
[2009/11/04 02:31:55 | 000,000,000 | —D | M] (Menu Editor) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{EDA7B1D7-F793-4e03-B074-E6F303317FB0}
[2010/08/21 13:22:54 | 000,000,000 | —D | M] (ScribeFire) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{F807FACD-E46A-4793-B345-D58CB177673C}
[2010/09/16 23:07:14 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\[removed]
[2009/11/04 02:31:49 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\[removed]
[2009/11/04 02:31:49 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\elemhidehelper@adblockplus(44).org
[2010/07/21 00:49:08 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\[removed]
[2008/09/06 14:21:25 | 000,001,733 | —- | M] () – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\3nadhxl6.default\searchplugins\live-search.xml
[2010/09/16 23:05:55 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2007/02/22 19:19:12 | 000,165,248 | —- | M] (F5 Networks) – C:\Program Files\Mozilla Firefox\plugins\NPuroamHost.dll
[2008/12/30 05:13:42 | 000,000,897 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\livecom.png
[2008/12/30 05:13:42 | 000,001,015 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\livecom.src

O1 HOSTS File: ([2010/09/23 00:03:03 | 000,000,759 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Find as you type Helper) - {186A2813-D175-4cf8-B179-3873AC4E975C} - C:\Program Files\Ookii.org Find As You Type 1.3\InternetExplorerISearch.dll (Ookii.org)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Security Suite\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Security Suite\Engine\4.2.0.12\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Find as you type) - {4AE165F6-CCA4-4e9a-98CE-C2FE8B59F383} - C:\Program Files\Ookii.org Find As You Type 1.3\InternetExplorerISearch.dll (Ookii.org)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Find as you type) - {4AE165F6-CCA4-4E9A-98CE-C2FE8B59F383} - C:\Program Files\Ookii.org Find As You Type 1.3\InternetExplorerISearch.dll (Ookii.org)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O8 - Extra context menu item: Add to &Evernote - C:\Program Files\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - C:\Program Files\Fiddler2\Fiddler.exe (Eric Lawrence)
O9 - Extra 'Tools' menuitem : Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - C:\Program Files\Fiddler2\Fiddler.exe (Eric Lawrence)
O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: infospace.com ([bellevue] https in Trusted sites)
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: motricity.com ([bellevue] https in Trusted sites)
O15 - HKCU\..Trusted Domains: motricity.com ([outlook] https in Trusted sites)
O15 - HKCU\..Trusted Domains: netflix.com ([]* in Trusted sites)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {2A0B9B82-D5C8-4D3D-8338-AD55B23662B1} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\cachecleaner.cab (F5 Networks CacheCleaner)
O16 - DPF: {2BCDB465-81F9-41CB-832C-8037A4064446} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\urxvpn.cab (F5 Networks VPN Manager)
O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} http://picasaweb.google.com/s/v/58.17/uploader2.cab (UploadListView Class)
O16 - DPF: {41EF3CD2-D8CC-4438-84B1-280BB4E77C8E} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\f5tunsrv.cab (F5 Networks Dynamic Application Tunnel Control)
O16 - DPF: {45B69029-F3AB-4204-92DE-D5140C3E8E74} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\InstallerControl.cab (F5 Networks Auto Update)
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} https://support.dell.com/systemprofiler/SysProExe.CAB (WMI Class)
O16 - DPF: {57C76689-F052-487B-A19F-855AFDDF28EE} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\f5InspectionHost.cab (F5 Networks Policy Agent Host Class)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A3E21079-7F41-4125-9EBB-FD44CFCC0AC1} https://www.mesh.com/0.9.4014.13/TSWeb.cab (WLCTSCControl Class)
O16 - DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} http://support.dell.com/systemprofiler/DellSystemLite.CAB (DellSystemLite.Scanner)
O16 - DPF: {CC85ACDF-B277-486F-8C70-2C9B2ED2A4E7} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\urxshost.cab (F5 Networks SuperHost Class)
O16 - DPF: {E0FF21FA-B857-45C5-8621-F120A0C17FF2} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\urxhost.cab (F5 Networks Host Control)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E615C9EA-AD69-4AE9-83C9-9D906A0ACA6D} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\f5syschk.cab (F5 Networks OS Policy Agent)
O16 - DPF: {E6BB2089-163F-466B-812A-748096614DFD} http://cainternetsecurity.net/scanner/cascanner.cab (CAScanner Control)
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} http://download.mcafee.com/molbin/iss-loc/…852/mcfscan.cab (McFreeScan Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Program Files\Soluto\soluto.exe /userinit) - C:\Program Files\Soluto\soluto.exe (Soluto)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll File not found
O20 - Winlogon\Notify\psfus: DllName - C:\Windows\system32\psqlpwd.dll - C:\Windows\System32\psqlpwd.dll (UPEK Inc.)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\XPS_NB_1280x864_NewBlue.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\XPS_NB_1280x864_NewBlue.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\Windows\System32\livessp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = secfile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/09/29 21:21:48 | 000,000,000 | —D | C] – C:\_OTL
[2010/09/29 21:21:13 | 000,000,000 | —D | C] – C:\Users\Ganesh\Desktop\Run1
[2010/09/29 10:31:46 | 000,190,976 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\ks.sys
[2010/09/28 21:56:26 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Users\Ganesh\Desktop\OTL.exe
[2010/09/28 21:48:05 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2010/09/28 09:42:21 | 000,000,000 | —D | C] – C:\Users\Ganesh\AppData\Local\Adobe
[2010/09/25 19:28:00 | 000,000,000 | —D | C] – C:\Users\Ganesh\AppData\Local\Apple
[2010/09/19 00:56:25 | 000,000,000 | —D | C] – C:\Windows\System32\%LOCALAPPDATA%
[2010/09/19 00:18:04 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DivX Shared
[2010/09/19 00:16:03 | 000,000,000 | —D | C] – C:\ProgramData\DivX
[2010/09/15 10:00:43 | 000,000,000 | —D | C] – C:\Windows\PCHEALTH
[2010/09/04 14:37:43 | 000,000,000 | —D | C] – C:\Program Files\iPod
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/09/29 21:55:00 | 000,000,426 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{6BA1906C-24ED-48ED-B27E-B95ED6DE1510}.job
[2010/09/29 21:54:44 | 005,505,024 | -HS- | M] () – C:\Users\Ganesh\NTUSER.DAT
[2010/09/29 21:41:00 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-735267809-354239087-596126657-1000UA.job
[2010/09/29 21:40:00 | 000,000,860 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-735267809-354239087-596126657-1000Core.job
[2010/09/29 21:33:22 | 000,011,104 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/09/29 21:33:22 | 000,011,104 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/09/29 21:26:34 | 000,055,326 | —- | M] () – C:\ProgramData\nvModes.001
[2010/09/29 21:26:02 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/09/29 21:25:48 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/09/29 21:25:41 | 2414,395,392 | -HS- | M] () – C:\hiberfil.sys
[2010/09/29 21:19:37 | 003,858,327 | —- | M] () – C:\Users\Ganesh\Desktop\ComboFix.exe
[2010/09/29 10:26:34 | 687,227,495 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/09/28 21:56:33 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\Ganesh\Desktop\OTL.exe
[2010/09/28 21:39:39 | 003,443,507 | -H– | M] () – C:\Users\Ganesh\AppData\Local\IconCache.db
[2010/09/28 21:39:20 | 000,284,915 | —- | M] () – C:\Users\Ganesh\Desktop\gmer.zip
[2010/09/23 00:03:03 | 000,000,759 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2010/09/23 00:02:32 | 000,002,004 | -H– | M] () – C:\Users\Ganesh\Documents\Default.rdp
[2010/09/22 22:58:26 | 000,011,658 | —- | M] () – C:\Users\Ganesh\Documents\chit.xlsx
[2010/09/14 15:26:34 | 000,000,759 | —- | M] () – C:\Windows\System32\drivers\etc\hosts.bak
[2010/09/10 21:17:30 | 000,000,418 | RHS- | M] () – C:\ProgramData\ntuser.pol
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/29 21:19:32 | 003,858,327 | —- | C] () – C:\Users\Ganesh\Desktop\ComboFix.exe
[2010/09/28 22:11:05 | 000,293,376 | —- | C] () – C:\Users\Ganesh\Desktop\gmer.exe
[2010/09/28 21:39:17 | 000,284,915 | —- | C] () – C:\Users\Ganesh\Desktop\gmer.zip
[2010/09/22 22:58:24 | 000,011,658 | —- | C] () – C:\Users\Ganesh\Documents\chit.xlsx
[2010/06/22 20:53:46 | 000,000,098 | —- | C] () – C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2010/06/11 14:00:18 | 000,055,326 | —- | C] () – C:\ProgramData\nvModes.dat
[2010/06/11 14:00:18 | 000,055,326 | —- | C] () – C:\ProgramData\nvModes.001
[2010/06/09 12:45:30 | 000,000,418 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2010/06/04 20:06:42 | 000,007,597 | —- | C] () – C:\Users\Ganesh\AppData\Local\Resmon.ResmonCfg
[2010/05/08 10:48:37 | 000,087,552 | —- | C] () – C:\Windows\System32\cpwmon2k.dll
[2010/02/17 11:06:18 | 000,000,004 | —- | C] () – C:\Users\Ganesh\AppData\Roaming\avdrn.dat
[2010/02/07 22:09:27 | 000,003,584 | —- | C] () – C:\Users\Ganesh\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/07/13 16:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 16:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/06/28 04:59:45 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/05/04 15:03:00 | 000,059,904 | —- | C] () – C:\Windows\System32\zlib1.dll
[2009/05/04 14:53:28 | 000,286,720 | —- | C] () – C:\Windows\System32\libcurl.dll
[2009/05/04 14:53:10 | 000,143,360 | —- | C] () – C:\Windows\System32\libexpatw.dll
[2009/02/07 21:54:34 | 000,164,352 | —- | C] () – C:\Windows\System32\unrar.dll
[2009/02/07 21:54:30 | 000,755,027 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2009/02/07 21:54:29 | 000,159,839 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2009/02/07 21:54:26 | 000,007,680 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2009/02/07 21:54:26 | 000,000,547 | —- | C] () – C:\Windows\System32\ff_vfw.dll.manifest
[2009/02/07 21:50:59 | 000,395,776 | —- | C] () – C:\Windows\System32\libmplayer.dll
[2009/02/07 21:50:59 | 000,262,144 | —- | C] () – C:\Windows\System32\TomsMoComp_ff.dll
[2009/02/07 21:50:59 | 000,112,640 | —- | C] () – C:\Windows\System32\libmpeg2_ff.dll
[2009/02/07 21:50:58 | 002,255,360 | —- | C] () – C:\Windows\System32\libavcodec.dll
[2008/11/21 14:47:52 | 003,596,288 | —- | C] () – C:\Windows\System32\qt-dx331.dll
[2008/11/21 14:45:16 | 000,000,416 | —- | C] () – C:\Windows\System32\dtu100.dll.manifest
[2008/04/20 21:29:29 | 000,000,742 | —- | C] () – C:\Windows\ODBC.INI
[2008/03/30 19:19:07 | 000,054,342 | —- | C] () – C:\Users\Ganesh\AppData\Roaming\nvModes.001
[2008/03/29 23:43:10 | 000,054,342 | —- | C] () – C:\Users\Ganesh\AppData\Roaming\nvModes.dat
[2008/03/24 14:55:15 | 000,167,936 | —- | C] () – C:\Windows\System32\nvccoin.dll
[2008/03/24 14:55:14 | 000,016,480 | —- | C] () – C:\Windows\System32\rixdicon.dll
[2007/07/25 16:40:02 | 000,999,424 | —- | C] () – C:\Windows\System32\WLIHVUI.dll
[2003/09/16 08:52:28 | 000,147,456 | —- | C] () – C:\Windows\System32\vorbis.dll
[2003/09/16 08:43:31 | 000,884,736 | —- | C] () – C:\Windows\System32\vorbisenc.dll
[2003/09/16 08:41:43 | 000,045,056 | —- | C] () – C:\Windows\System32\ogg.dll
< End of report >

ComboFix log


ComboFix 10-09-29.01 - Ganesh 09/29/2010 22:03:33.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.3070.1631 [GMT -7:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Protection Center
c:\users\Ganesh\AppData\Roaming\avdrn.dat
c:\users\Ganesh\FAVORI~1\_favdata.dat
c:\users\Ganesh\Favorites\_favdata.dat
c:\users\Ganesh\GoToAssistDownloadHelper.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_usnjsvc


((((((((((((((((((((((((( Files Created from 2010-08-28 to 2010-09-30 )))))))))))))))))))))))))))))))
.

2010-09-30 04:59 . 2010-09-30 04:59 ——– d—–w- C:\32788R22FWJFW
2010-09-30 04:21 . 2010-09-30 04:21 ——– d—–w- C:\_OTL
2010-09-29 17:31 . 2010-03-04 03:57 190976 —-a-w- c:\windows\system32\drivers\ks.sys
2010-09-29 04:48 . 2010-06-19 06:15 2048 —-a-w- c:\windows\system32\tzres.dll
2010-09-28 16:42 . 2010-09-28 16:42 ——– d—–w- c:\users\Ganesh\AppData\Local\Adobe
2010-09-26 02:28 . 2010-09-26 02:28 ——– d—–w- c:\users\Ganesh\AppData\Local\Apple
2010-09-19 07:56 . 2010-09-19 07:56 ——– d—–w- c:\windows\system32\%LOCALAPPDATA%
2010-09-19 07:27 . 2010-09-19 07:27 57344 —-a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-09-19 07:26 . 2010-09-19 07:16 185640 —-a-w- c:\programdata\DivX\Setup\finishPlugin.dll
2010-09-19 07:26 . 2010-09-19 07:16 1062184 —-a-w- c:\programdata\DivX\Setup\Resource.dll
2010-09-19 07:26 . 2010-09-19 07:15 850200 —-a-w- c:\programdata\DivX\Setup\DivXSetup.exe
2010-09-19 07:26 . 2008-12-06 09:55 125936 —-a-w- c:\programdata\DivX\DivX7\DivX Converter\DivXConverterUninstall.exe
2010-09-19 07:26 . 2010-09-19 07:26 56765 —-a-w- c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-09-19 07:26 . 2010-09-19 07:26 56997 —-a-w- c:\programdata\DivX\WebPlayer\Uninstaller.exe
2010-09-19 07:26 . 2010-09-19 07:26 53600 —-a-w- c:\programdata\DivX\Update\Uninstaller.exe
2010-09-19 07:26 . 2010-09-19 07:26 57691 —-a-w- c:\programdata\DivX\Player\Uninstaller.exe
2010-09-19 07:25 . 2010-09-19 07:25 84063 —-a-w- c:\programdata\DivX\TransferWizard\Uninstaller.exe
2010-09-19 07:16 . 2010-09-19 07:16 144696 —-a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.exe
2010-09-19 07:16 . 2010-09-19 07:26 ——– d—–w- c:\programdata\DivX
2010-09-15 17:00 . 2010-09-15 17:00 ——– d—–w- c:\windows\PCHEALTH
2010-09-14 19:50 . 2010-08-21 05:32 316928 —-a-w- c:\windows\system32\spoolsv.exe
2010-09-04 21:37 . 2010-09-04 21:37 ——– d—–w- c:\program files\iPod
2010-09-04 21:30 . 2010-09-04 21:30 73000 —-a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 10.0.0.68\SetupAdmin.exe
2010-08-31 19:11 . 2010-08-31 19:11 3401880 —-a-w- c:\users\Ganesh\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
2010-08-31 18:55 . 2010-08-31 18:55 275096 —-a-w- c:\users\Ganesh\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
2010-08-31 18:39 . 2010-08-31 18:39 3734536 —-a-w- c:\users\Ganesh\AppData\Roaming\Mozilla\plugins\Google Talk Plugin Extras\d3dx9_36.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-30 05:15 . 2008-07-29 04:02 0 –sha-w- c:\windows\SD65FC7D1.tmp
2010-09-30 04:25 . 2008-04-01 06:25 ——– d—–w- c:\program files\Microsoft Silverlight
2010-09-25 07:03 . 2009-05-21 21:20 ——– d—–w- c:\program files\Microsoft SDKs
2010-09-19 07:26 . 2008-05-29 07:12 ——– d—–w- c:\program files\DivX
2010-09-19 07:26 . 2008-08-02 08:31 ——– d—–w- c:\users\Ganesh\AppData\Roaming\DivX
2010-09-15 17:00 . 2010-06-07 19:26 ——– d—–w- c:\programdata\Microsoft Help
2010-09-04 21:39 . 2010-06-23 02:27 ——– d—–w- c:\program files\iTunes
2010-09-04 21:37 . 2009-05-07 02:48 ——– d—–w- c:\program files\Common Files\Apple
2010-08-21 20:35 . 2010-08-21 20:34 ——– d—–w- c:\program files\QuickTime
2010-08-21 20:32 . 2009-07-28 03:25 ——– d—–w- c:\program files\Safari
2010-08-21 20:31 . 2010-08-21 20:31 72488 —-a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.33.17.8\SetupAdmin.exe
2010-08-12 04:07 . 2007-11-14 08:00 45648 ——w- c:\windows\system32\drivers\pxhelp20.sys
2010-07-29 06:30 . 2010-08-12 17:13 197632 —-a-w- c:\windows\system32\ir32_32.dll
2010-07-29 06:30 . 2010-08-12 17:13 82944 —-a-w- c:\windows\system32\iccvid.dll
2010-07-24 03:54 . 2010-07-24 03:54 987 —-a-w- c:\windows\gvimdiff.bat
2010-07-24 03:54 . 2010-07-24 03:54 987 —-a-w- c:\windows\gview.bat
2010-07-24 03:54 . 2010-07-24 03:54 987 —-a-w- c:\windows\evim.bat
2010-07-24 03:54 . 2010-07-24 03:54 979 —-a-w- c:\windows\gvim.bat
2010-07-24 03:54 . 2010-07-24 03:54 688 —-a-w- c:\windows\vimtutor.bat
2010-07-24 03:54 . 2010-07-24 03:54 662 —-a-w- c:\windows\vimdiff.bat
2010-07-24 03:54 . 2010-07-24 03:54 662 —-a-w- c:\windows\view.bat
2010-07-24 03:54 . 2010-07-24 03:54 658 —-a-w- c:\windows\vim.bat
2010-07-05 17:37 . 2010-07-24 02:28 22856 —-a-w- c:\windows\system32\dopdfmn7.dll
2010-07-05 17:37 . 2010-07-24 02:28 19784 —-a-w- c:\windows\system32\dopdfmi7.dll
2008-10-28 19:41 . 2010-04-11 00:21 238896 —-a-w- c:\program files\mozilla firefox\plugins\CrazyTalk4Native.dll
2008-10-28 19:41 . 2010-04-11 00:21 210320 —-a-w- c:\program files\mozilla firefox\plugins\ctdomemhelper.dll
2008-10-28 19:41 . 2010-04-11 00:21 83248 —-a-w- c:\program files\mozilla firefox\plugins\ctframeplayerobject.dll
2008-10-28 19:41 . 2010-04-11 00:21 431512 —-a-w- c:\program files\mozilla firefox\plugins\ctplayerobject.dll
2008-10-28 19:41 . 2010-04-11 00:21 464176 —-a-w- c:\program files\mozilla firefox\plugins\imagickrt.dll
2008-10-28 19:41 . 2010-04-11 00:21 144688 —-a-w- c:\program files\mozilla firefox\plugins\rlcontentclass.dll
2008-10-28 19:41 . 2010-04-11 00:21 210224 —-a-w- c:\program files\mozilla firefox\plugins\RLMusicPacker.dll
2008-10-28 19:41 . 2010-04-11 00:21 111920 —-a-w- c:\program files\mozilla firefox\plugins\RLMusicUnpacker.dll
2008-10-28 19:41 . 2010-04-11 00:21 218416 —-a-w- c:\program files\mozilla firefox\plugins\RLVoicePacker.dll
2008-10-28 19:41 . 2010-04-11 00:21 173360 —-a-w- c:\program files\mozilla firefox\plugins\RLVoiceUnpacker.dll
2010-04-11 00:21 . 2010-04-11 00:21 74 –sh–r- c:\windows\CT4CET.bin
2009-06-10 21:26 . 2009-07-14 02:04 9633792 –sha-r- c:\windows\Fonts\StaticCache.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2007-04-17 04:13 721408 —-a-w- c:\program files\Fingerprint Reader Suite\farchns.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2007-04-17 04:13 721408 —-a-w- c:\program files\Fingerprint Reader Suite\farchns.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-09-07 159744]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-10-03 178712]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-06-01 1093208]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2007-04-17 04:04 86528 —-a-w- c:\windows\System32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 CtAudDrv;Provides advanced audio effects for audio devices.;c:\windows\system32\Drivers\CtAudDrv.sys [2009-05-28 134144]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2009-06-15 143968]
R3 f5ipfw;F5 Networks StoneWall Filter;c:\windows\system32\drivers\urfltwlh.sys [2009-10-10 13952]
R3 IdcPHid;IdeaCom HID Touch Screen Driver (PS/2);c:\windows\system32\DRIVERS\idcphid.sys [2008-12-11 16256]
R3 MsDepSvc;Web Deployment Agent Service;c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe [2009-04-09 42888]
R3 msftesql$SQLEXPRESS;SQL Server FullText Search (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe [2007-06-22 95592]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-04-24 1343400]
R3 wlcrasvc;Live Mesh Remote Desktop;c:\program files\Live Mesh\Remote Desktop\wlcrasvc.exe [2009-08-22 44880]
R3 WMPControllerService;WMPControllerService;c:\dell\Utilities\Dell Premium Remote Control\WMPControllerService.exe [2006-12-07 499712]
R3 WMSVC;Web Management Service;c:\windows\system32\inetsrv\wmsvc.exe [2009-07-14 9728]
R4 iaNvStor;Intel® Turbo Memory Controller;c:\windows\system32\drivers\ianvstor.sys [2007-09-07 209408]
R4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2007-02-23 2808664]
S0 PCGenFAM;PCGenFAM;c:\windows\system32\DRIVERS\PCGenFAM.sys [2010-06-18 179656]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0402000.00C\SYMDS.SYS [2009-10-15 328752]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0402000.00C\SYMEFA.SYS [2010-04-22 173104]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20100901.003\BHDrvx86.sys [2010-08-31 692272]
S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0402000.00C\ccHPx86.sys [2010-02-26 501888]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100929.001\IDSvix86.sys [2010-05-28 344112]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0402000.00C\Ironx86.SYS [2010-04-29 116784]
S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\N360\0402000.00C\SYMTDIV.SYS [2010-05-06 339504]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-12-03 73728]
S2 ftpsvc;Microsoft FTP Service;c:\windows\system32\svchost.exe [2009-07-14 20992]
S2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\4.2.0.12\ccSvcHst.exe [2010-02-26 126392]
S2 SolutoService;Soluto PCGenome Core Service;c:\program files\Soluto\SolutoService.exe [2010-06-18 338464]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-07-06 173352]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-06-09 102448]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-03-26 42368]
S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\DRIVERS\covpnwlh.sys [2009-10-10 34944]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296]


— Other Services/Drivers In Memory —

*Deregistered* - MPFP

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
ftpsvc REG_MULTI_SZ ftpsvc
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
.
Contents of the 'Scheduled Tasks' folder

2010-09-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-735267809-354239087-596126657-1000Core.job
- c:\users\Ganesh\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-30 03:15]

2010-09-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-735267809-354239087-596126657-1000UA.job
- c:\users\Ganesh\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-30 03:15]

2010-09-30 c:\windows\Tasks\User_Feed_Synchronization-{6BA1906C-24ED-48ED-B27E-B95ED6DE1510}.job
- c:\windows\system32\msfeedssync.exe [2010-08-12 06:19]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: Add to &Evernote - c:\program files\Evernote\Evernote3.5\enbar.dll/2000
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: {{E0B8C461-F8FB-49b4-8373-FE32E92528A6} - {BC0E0A5D-AB5A-4fa4-A5FA-280E1D58EEEE} - c:\program files\Evernote\Evernote3.5\enbar.dll
Trusted Zone: infospace.com\bellevue
Trusted Zone: internet
Trusted Zone: mcafee.com
Trusted Zone: motricity.com\bellevue
Trusted Zone: motricity.com\outlook
Trusted Zone: netflix.com
DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} - hxxp://picasaweb.google.com/s/v/58.17/uploader2.cab
DPF: {A3E21079-7F41-4125-9EBB-FD44CFCC0AC1} - hxxps://www.mesh.com/0.9.4014.13/TSWeb.cab
DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} - hxxp://support.dell.com/systemprofiler/DellSystemLite.CAB
DPF: {E6BB2089-163F-466B-812A-748096614DFD} - hxxp://cainternetsecurity.net/scanner/cascanner.cab
FF - ProfilePath - c:\users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\
FF - prefs.js: browser.search.selectedEngine - Cuil
FF - prefs.js: browser.startup.homepage - hxxp://www.xfinity.com/?cid=xfactiv_tech_main
FF - prefs.js: keyword.enabled - false
FF - prefs.js: network.proxy.ftp - 127.0.0.1
FF - prefs.js: network.proxy.ftp_port - 4001
FF - prefs.js: network.proxy.gopher - 127.0.0.1
FF - prefs.js: network.proxy.gopher_port - 4001
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 4001
FF - prefs.js: network.proxy.ssl - 127.0.0.1
FF - prefs.js: network.proxy.ssl_port - 4001
FF - prefs.js: network.proxy.type - 0
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\IPSFFPlgn\components\IPSFFPl.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Microsoft\Web Platform Installer\NPWPIDetector.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npRLCT4Player.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPuroamHost.dll
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll
FF - plugin: c:\users\Ganesh\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\users\Ganesh\AppData\Local\HuluDesktop\instances\0.9.14.1\nphdplg.dll
FF - plugin: c:\users\Ganesh\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\users\Ganesh\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
FF - user.js: capability.policy.policynames - allowclipboard
FF - user.js: capability.policy.allowclipboard.sites -
FF - user.js: capability.policy.allowclipboard.Clipboard.cutcopy - allAccess
FF - user.js: capability.policy.allowclipboard.Clipboard.paste - allAccess);user_pref(yahoo.ytff.general.dontshowhpoffer, truec:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

Notify-GoToAssist - c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll
SafeBoot-mcmscsvc
SafeBoot-MCODS
AddRemove-{09760D42-E223-42AD-8C3E-55B47D0DDAC3} - c:\programdata\Uninstall\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}\setup.exe
AddRemove-Competition Arena - c:\windows\system32\javaws.exe
AddRemove-Octoshape add-in for Adobe Flash Player - c:\users\Ganesh\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe



[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MsDepSvc]
"ImagePath"="\"c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe\" -runService:MsDepSvc"
–

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msftesql$SQLEXPRESS]
"ImagePath"="\"c:\program files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe\" -s:MSSQL.2 -f:SQLEXPRESS"
–

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\N360]
"ImagePath"="\"c:\program files\Norton Security Suite\Engine\4.2.0.12\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\4.2.0.12\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(576)
c:\windows\system32\psqlpwd.DLL
c:\program files\Fingerprint Reader Suite\homefus2.dll
c:\program files\Fingerprint Reader Suite\infra.dll

- - - - - - - > 'Explorer.exe'(5412)
c:\program files\Fingerprint Reader Suite\farchns.dll
c:\program files\Fingerprint Reader Suite\infra.dll
c:\windows\system32\CRYPTUI.dll
c:\windows\system32\NetworkExplorer.dll
c:\windows\system32\msutb.dll
c:\program files\Norton Security Suite\Engine\4.2.0.12\ccGEvt.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\nvvsvc.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Microsoft Security Essentials\MsMpEng.exe
c:\windows\system32\rundll32.exe
c:\program files\Fingerprint Reader Suite\upeksvr.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\system32\STacSV.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\system32\taskhost.exe
c:\program files\Soluto\soluto.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\system32\sppsvc.exe
c:\program files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
c:\windows\system32\DllHost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\System32\rundll32.exe
c:\windows\System32\rundll32.exe
c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe
c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Microsoft Security Essentials\MpCmdRun.exe
.
**************************************************************************
.
Completion time: 2010-09-29 22:24:21 - machine was rebooted
ComboFix-quarantined-files.txt 2010-09-30 05:24

Pre-Run: 38,781,149,184 bytes free
Post-Run: 38,483,664,896 bytes free

- - End Of File - - 6C63310B32498E54F5B94715CA4C5BEA
Post #7
You are running two Antivirus,Microsoft Security Essentials and Norton,you should only have one installed so please remove one of these as they can conflict.



Please download Malwarebytes from Here or Here

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the log please




Next


I need you to run the following scan: Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.
Post #8
Here are the logs mbam log file Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4722 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 9/30/2010 8:38:18 AM mbam-log-2010-09-30 (08-38-18).txt Scan type: Quick scan Objects scanned: 173235 Time elapsed: 11 minute(s), 53 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 2 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\24d1ca9a-a864-4f7b-86fe-495eb56529d8 (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\7bde84a2-f58f-46ec-9eac-f1f90fead080 (Malware.Trace) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ESETS LOG ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK Please let me known what else needs to be done. BTW thanks for helping me.
Post #9
Is that log all the ESET scan produced,did it say it found any threats?



COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below: 

    File:: 
c:\windows\SD65FC7D1.tmp

DirLook::
c:\windows\system32\%LOCALAPPDATA%
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • If you need help to disable your protection programs see here.
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.






Also pleasee tell me how the computer is running now.
Post #10
Yes, thats all the log has and after the scan it didnt detected and viruses. Machine seems to running fine. Here is the log after dragging CFScript ontot ComboFix ComboFix 10-10-01.01 - Ganesh 10/01/2010 20:30:59.2.2 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.3070.1659 [GMT -7:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Ganesh\Desktop\CFScript.txt FILE :: "c:\windows\SD65FC7D1.tmp" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\SD65FC7D1.tmp . . . . Failed to delete . ((((((((((((((((((((((((( Files Created from 2010-09-02 to 2010-10-02 ))))))))))))))))))))))))))))))) . 2010-10-02 03:40 . 2010-10-02 03:40 ——– d—–w- c:\users\TestAcc\AppData\Local\temp 2010-10-02 03:40 . 2010-10-02 03:40 ——– d—–w- c:\users\Public\AppData\Local\temp 2010-10-02 03:40 . 2010-10-02 03:40 ——– d—–w- c:\users\NewUser\AppData\Local\temp 2010-10-02 03:40 . 2010-10-02 03:40 ——– d—–w- c:\users\Default\AppData\Local\temp 2010-09-30 15:21 . 2010-04-29 22:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-09-30 15:21 . 2010-09-30 15:21 ——– d—–w- c:\programdata\Malwarebytes 2010-09-30 15:21 . 2010-04-29 22:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-09-30 15:21 . 2010-09-30 15:38 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-09-30 04:21 . 2010-09-30 04:21 ——– d—–w- C:\_OTL 2010-09-29 17:31 . 2010-03-04 03:57 190976 —-a-w- c:\windows\system32\drivers\ks.sys 2010-09-29 04:48 . 2010-06-19 06:15 2048 —-a-w- c:\windows\system32\tzres.dll 2010-09-28 16:42 . 2010-09-28 16:42 ——– d—–w- c:\users\Ganesh\AppData\Local\Adobe 2010-09-26 02:28 . 2010-09-26 02:28 ——– d—–w- c:\users\Ganesh\AppData\Local\Apple 2010-09-19 07:56 . 2010-09-19 07:56 ——– d—–w- c:\windows\system32\%LOCALAPPDATA% 2010-09-19 07:27 . 2010-09-19 07:27 57344 —-a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll 2010-09-19 07:26 . 2010-09-19 07:16 185640 —-a-w- c:\programdata\DivX\Setup\finishPlugin.dll 2010-09-19 07:26 . 2010-09-19 07:16 1062184 —-a-w- c:\programdata\DivX\Setup\Resource.dll 2010-09-19 07:26 . 2010-09-19 07:15 850200 —-a-w- c:\programdata\DivX\Setup\DivXSetup.exe 2010-09-19 07:26 . 2008-12-06 09:55 125936 —-a-w- c:\programdata\DivX\DivX7\DivX Converter\DivXConverterUninstall.exe 2010-09-19 07:26 . 2010-09-19 07:26 56765 —-a-w- c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe 2010-09-19 07:26 . 2010-09-19 07:26 56997 —-a-w- c:\programdata\DivX\WebPlayer\Uninstaller.exe 2010-09-19 07:26 . 2010-09-19 07:26 53600 —-a-w- c:\programdata\DivX\Update\Uninstaller.exe 2010-09-19 07:26 . 2010-09-19 07:26 57691 —-a-w- c:\programdata\DivX\Player\Uninstaller.exe 2010-09-19 07:25 . 2010-09-19 07:25 84063 —-a-w- c:\programdata\DivX\TransferWizard\Uninstaller.exe 2010-09-19 07:16 . 2010-09-19 07:16 144696 —-a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.exe 2010-09-19 07:16 . 2010-09-19 07:26 ——– d—–w- c:\programdata\DivX 2010-09-15 17:00 . 2010-09-15 17:00 ——– d—–w- c:\windows\PCHEALTH 2010-09-14 19:50 . 2010-08-21 05:32 316928 —-a-w- c:\windows\system32\spoolsv.exe 2010-09-04 21:37 . 2010-09-04 21:37 ——– d—–w- c:\program files\iPod 2010-09-04 21:30 . 2010-09-04 21:30 73000 —-a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 10.0.0.68\SetupAdmin.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-10-01 05:55 . 2008-08-02 08:31 ——– d—–w- c:\users\Ganesh\AppData\Roaming\DivX 2010-09-30 05:15 . 2008-07-29 04:02 0 —-a-w- c:\windows\SD65FC7D1.tmp 2010-09-30 04:25 . 2008-04-01 06:25 ——– d—–w- c:\program files\Microsoft Silverlight 2010-09-25 07:03 . 2009-05-21 21:20 ——– d—–w- c:\program files\Microsoft SDKs 2010-09-19 07:26 . 2008-05-29 07:12 ——– d—–w- c:\program files\DivX 2010-09-15 17:00 . 2010-06-07 19:26 ——– d—–w- c:\programdata\Microsoft Help 2010-09-04 21:39 . 2010-06-23 02:27 ——– d—–w- c:\program files\iTunes 2010-09-04 21:37 . 2009-05-07 02:48 ——– d—–w- c:\program files\Common Files\Apple 2010-08-31 19:11 . 2010-08-31 19:11 3401880 —-a-w- c:\users\Ganesh\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll 2010-08-31 18:55 . 2010-08-31 18:55 275096 —-a-w- c:\users\Ganesh\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll 2010-08-31 18:39 . 2010-08-31 18:39 3734536 —-a-w- c:\users\Ganesh\AppData\Roaming\Mozilla\plugins\Google Talk Plugin Extras\d3dx9_36.dll 2010-08-21 20:35 . 2010-08-21 20:34 ——– d—–w- c:\program files\QuickTime 2010-08-21 20:32 . 2009-07-28 03:25 ——– d—–w- c:\program files\Safari 2010-08-21 20:31 . 2010-08-21 20:31 72488 —-a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.33.17.8\SetupAdmin.exe 2010-08-12 04:07 . 2007-11-14 08:00 45648 ——w- c:\windows\system32\drivers\pxhelp20.sys 2010-07-29 06:30 . 2010-08-12 17:13 197632 —-a-w- c:\windows\system32\ir32_32.dll 2010-07-29 06:30 . 2010-08-12 17:13 82944 —-a-w- c:\windows\system32\iccvid.dll 2010-07-24 03:54 . 2010-07-24 03:54 987 —-a-w- c:\windows\gvimdiff.bat 2010-07-24 03:54 . 2010-07-24 03:54 987 —-a-w- c:\windows\gview.bat 2010-07-24 03:54 . 2010-07-24 03:54 987 —-a-w- c:\windows\evim.bat 2010-07-24 03:54 . 2010-07-24 03:54 979 —-a-w- c:\windows\gvim.bat 2010-07-24 03:54 . 2010-07-24 03:54 688 —-a-w- c:\windows\vimtutor.bat 2010-07-24 03:54 . 2010-07-24 03:54 662 —-a-w- c:\windows\vimdiff.bat 2010-07-24 03:54 . 2010-07-24 03:54 662 —-a-w- c:\windows\view.bat 2010-07-24 03:54 . 2010-07-24 03:54 658 —-a-w- c:\windows\vim.bat 2010-07-05 17:37 . 2010-07-24 02:28 22856 —-a-w- c:\windows\system32\dopdfmn7.dll 2010-07-05 17:37 . 2010-07-24 02:28 19784 —-a-w- c:\windows\system32\dopdfmi7.dll 2008-10-28 19:41 . 2010-04-11 00:21 238896 —-a-w- c:\program files\mozilla firefox\plugins\CrazyTalk4Native.dll 2008-10-28 19:41 . 2010-04-11 00:21 210320 —-a-w- c:\program files\mozilla firefox\plugins\ctdomemhelper.dll 2008-10-28 19:41 . 2010-04-11 00:21 83248 —-a-w- c:\program files\mozilla firefox\plugins\ctframeplayerobject.dll 2008-10-28 19:41 . 2010-04-11 00:21 431512 —-a-w- c:\program files\mozilla firefox\plugins\ctplayerobject.dll 2008-10-28 19:41 . 2010-04-11 00:21 464176 —-a-w- c:\program files\mozilla firefox\plugins\imagickrt.dll 2008-10-28 19:41 . 2010-04-11 00:21 144688 —-a-w- c:\program files\mozilla firefox\plugins\rlcontentclass.dll 2008-10-28 19:41 . 2010-04-11 00:21 210224 —-a-w- c:\program files\mozilla firefox\plugins\RLMusicPacker.dll 2008-10-28 19:41 . 2010-04-11 00:21 111920 —-a-w- c:\program files\mozilla firefox\plugins\RLMusicUnpacker.dll 2008-10-28 19:41 . 2010-04-11 00:21 218416 —-a-w- c:\program files\mozilla firefox\plugins\RLVoicePacker.dll 2008-10-28 19:41 . 2010-04-11 00:21 173360 —-a-w- c:\program files\mozilla firefox\plugins\RLVoiceUnpacker.dll 2010-04-11 00:21 . 2010-04-11 00:21 74 –sh–r- c:\windows\CT4CET.bin 2009-06-10 21:26 . 2009-07-14 02:04 9633792 –sha-r- c:\windows\Fonts\StaticCache.dat . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . —- Directory of c:\windows\system32\%LOCALAPPDATA% —- 2010-09-19 07:56 . 2010-09-19 07:56 757375 —-a-w- c:\windows\system32\%LOCALAPPDATA%\CrashDumps\upeksvr.exe.1620.dmp ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay] @="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}" [HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}] 2007-04-17 04:13 721408 —-a-w- c:\program files\Fingerprint Reader Suite\farchns.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen] @="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}" [HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}] 2007-04-17 04:13 721408 —-a-w- c:\program files\Fingerprint Reader Suite\farchns.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-09-07 159744] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-10-03 178712] "MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-06-01 1093208] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160] "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "DisableCAD"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus] 2007-04-17 04:04 86528 —-a-w- c:\windows\System32\psqlpwd.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer"=wdmaud.drv [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli psqlpwd Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R3 CtAudDrv;Provides advanced audio effects for audio devices.;c:\windows\system32\Drivers\CtAudDrv.sys [2009-05-28 134144] R3 f5ipfw;F5 Networks StoneWall Filter;c:\windows\system32\drivers\urfltwlh.sys [2009-10-10 13952] R3 IdcPHid;IdeaCom HID Touch Screen Driver (PS/2);c:\windows\system32\DRIVERS\idcphid.sys [2008-12-11 16256] R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-03-26 42368] R3 MsDepSvc;Web Deployment Agent Service;c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe [2009-04-09 42888] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-04-24 1343400] R3 wlcrasvc;Live Mesh Remote Desktop;c:\program files\Live Mesh\Remote Desktop\wlcrasvc.exe [2009-08-22 44880] R3 WMPControllerService;WMPControllerService;c:\dell\Utilities\Dell Premium Remote Control\WMPControllerService.exe [2006-12-07 499712] R4 iaNvStor;Intel® Turbo Memory Controller;c:\windows\system32\drivers\ianvstor.sys [2007-09-07 209408] R4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2007-02-23 2808664] S0 PCGenFAM;PCGenFAM;c:\windows\system32\DRIVERS\PCGenFAM.sys [2010-06-18 179656] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0402000.00C\SYMDS.SYS [2009-10-15 328752] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0402000.00C\SYMEFA.SYS [2010-04-22 173104] S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20100901.003\BHDrvx86.sys [2010-08-31 692272] S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0402000.00C\ccHPx86.sys [2010-02-26 501888] S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100930.005\IDSvix86.sys [2010-05-28 344112] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0402000.00C\Ironx86.SYS [2010-04-29 116784] S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\N360\0402000.00C\SYMTDIV.SYS [2010-05-06 339504] S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-12-03 73728] S2 ftpsvc;Microsoft FTP Service;c:\windows\system32\svchost.exe [2009-07-14 20992] S2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\4.2.0.12\ccSvcHst.exe [2010-02-26 126392] S2 SolutoService;Soluto PCGenome Core Service;c:\program files\Soluto\SolutoService.exe [2010-06-18 338464] S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-07-06 173352] S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2009-06-15 143968] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-06-09 102448] S3 msftesql$SQLEXPRESS;SQL Server FullText Search (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe [2007-06-22 95592] S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168] S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\DRIVERS\covpnwlh.sys [2009-10-10 34944] S3 WMSVC;Web Management Service;c:\windows\system32\inetsrv\wmsvc.exe [2009-07-14 9728] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296] — Other Services/Drivers In Memory — *Deregistered* - MPFP [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] ftpsvc REG_MULTI_SZ ftpsvc iissvcs REG_MULTI_SZ w3svc was apphost REG_MULTI_SZ apphostsvc . Contents of the 'Scheduled Tasks' folder 2010-10-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-735267809-354239087-596126657-1000Core.job - c:\users\Ganesh\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-30 03:15] 2010-10-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-735267809-354239087-596126657-1000UA.job - c:\users\Ganesh\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-30 03:15] 2010-10-02 c:\windows\Tasks\User_Feed_Synchronization-{6BA1906C-24ED-48ED-B27E-B95ED6DE1510}.job - c:\windows\system32\msfeedssync.exe [2010-08-12 06:19] . . ——- Supplementary Scan ——- . uStart Page = about:blank uInternet Settings,ProxyOverride = *.local IE: Add to &Evernote - c:\program files\Evernote\Evernote3.5\enbar.dll/2000 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000 IE: {{E0B8C461-F8FB-49b4-8373-FE32E92528A6} - {BC0E0A5D-AB5A-4fa4-A5FA-280E1D58EEEE} - c:\program files\Evernote\Evernote3.5\enbar.dll Trusted Zone: infospace.com\bellevue Trusted Zone: internet Trusted Zone: mcafee.com Trusted Zone: motricity.com\bellevue Trusted Zone: motricity.com\outlook Trusted Zone: netflix.com DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} - hxxp://picasaweb.google.com/s/v/58.17/uploader2.cab DPF: {A3E21079-7F41-4125-9EBB-FD44CFCC0AC1} - hxxps://www.mesh.com/0.9.4014.13/TSWeb.cab DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} - hxxp://support.dell.com/systemprofiler/DellSystemLite.CAB DPF: {E6BB2089-163F-466B-812A-748096614DFD} - hxxp://cainternetsecurity.net/scanner/cascanner.cab FF - ProfilePath - c:\users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\ FF - prefs.js: browser.search.selectedEngine - Cuil FF - prefs.js: browser.startup.homepage - hxxp://www.xfinity.com/?cid=xfactiv_tech_main FF - prefs.js: keyword.enabled - false FF - prefs.js: network.proxy.ftp - 127.0.0.1 FF - prefs.js: network.proxy.ftp_port - 4001 FF - prefs.js: network.proxy.gopher - 127.0.0.1 FF - prefs.js: network.proxy.gopher_port - 4001 FF - prefs.js: network.proxy.http - 127.0.0.1 FF - prefs.js: network.proxy.http_port - 4001 FF - prefs.js: network.proxy.ssl - 127.0.0.1 FF - prefs.js: network.proxy.ssl_port - 4001 FF - prefs.js: network.proxy.type - 0 FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\coFFPlgn\components\coFFPlgn.dll FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\IPSFFPlgn\components\IPSFFPl.dll FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll FF - plugin: c:\program files\Microsoft\Web Platform Installer\NPWPIDetector.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npRLCT4Player.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPuroamHost.dll FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll FF - plugin: c:\users\Ganesh\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll FF - plugin: c:\users\Ganesh\AppData\Local\HuluDesktop\instances\0.9.14.1\nphdplg.dll FF - plugin: c:\users\Ganesh\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll FF - plugin: c:\users\Ganesh\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ —- FIREFOX POLICIES —- FF - user.js: capability.policy.policynames - allowclipboard FF - user.js: capability.policy.allowclipboard.sites - FF - user.js: capability.policy.allowclipboard.Clipboard.cutcopy - allAccess FF - user.js: capability.policy.allowclipboard.Clipboard.paste - allAccess);user_pref(yahoo.ytff.general.dontshowhpoffer, truec:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MsDepSvc] "ImagePath"="\"c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe\" -runService:MsDepSvc" – [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msftesql$SQLEXPRESS] "ImagePath"="\"c:\program files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe\" -s:MSSQL.2 -f:SQLEXPRESS" – [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\N360] "ImagePath"="\"c:\program files\Norton Security Suite\Engine\4.2.0.12\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\4.2.0.12\diMaster.dll\" /prefetch:1" . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ——————— DLLs Loaded Under Running Processes ——————— - - - - - - - > 'lsass.exe'(576) c:\windows\system32\psqlpwd.DLL c:\program files\Fingerprint Reader Suite\homefus2.dll c:\program files\Fingerprint Reader Suite\infra.dll - - - - - - - > 'Explorer.exe'(440) c:\program files\Fingerprint Reader Suite\farchns.dll c:\program files\Fingerprint Reader Suite\infra.dll c:\windows\system32\prnfldr.dll c:\windows\System32\netshell.dll c:\users\Ganesh\AppData\Local\Temp\catchme.dll . ———————— Other Running Processes ———————— . c:\windows\system32\nvvsvc.exe c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe c:\program files\Microsoft Security Essentials\MsMpEng.exe c:\windows\system32\rundll32.exe c:\program files\Fingerprint Reader Suite\upeksvr.exe c:\program files\Intel\Wireless\Bin\EvtEng.exe c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files\Intel\Wireless\Bin\RegSrvc.exe c:\windows\system32\STacSV.exe c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe c:\windows\system32\taskhost.exe c:\program files\Soluto\soluto.exe c:\windows\system32\conhost.exe c:\windows\system32\DllHost.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe c:\windows\System32\rundll32.exe c:\windows\System32\rundll32.exe c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe c:\program files\Microsoft Office\Office12\GrooveMonitor.exe c:\program files\Dell\MediaDirect\PCMService.exe c:\program files\Fingerprint Reader Suite\psqltray.exe c:\tools\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe c:\program files\Common Files\Real\Update_OB\realsched.exe c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe c:\windows\OEM02Mon.exe c:\windows\ehome\ehmsas.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Microsoft Office\Office12\GrooveAuditService.exe c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe c:\program files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe c:\windows\servicing\TrustedInstaller.exe c:\windows\system32\taskmgr.exe . ************************************************************************** . Completion time: 2010-10-01 20:50:35 - machine was rebooted ComboFix-quarantined-files.txt 2010-10-02 03:50 ComboFix2.txt 2010-09-30 05:24 Pre-Run: 39,426,732,032 bytes free Post-Run: 39,400,685,568 bytes free - - End Of File - - B9B367E995771368076DBBA10D522C57
Post #12
Here its is OTL log

OTL logfile created on: 10/2/2010 11:55:41 AM - Run 3
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\Ganesh\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 60.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 173.71 Gb Total Space | 36.33 Gb Free Space | 20.92% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.90 Gb Free Space | 59.01% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GANESHLPT2
Current User Name: Ganesh
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Ganesh\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\Soluto\SolutoService.exe (Soluto)
PRC - C:\Program Files\Soluto\Soluto.exe (Soluto)
PRC - C:\Program Files\Norton Security Suite\Engine\4.2.0.12\ccsvchst.exe (Symantec Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe (Microsoft Corporation)
PRC - C:\Program Files\Internet Explorer\ielowutil.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Windows\System32\stacsv.exe (IDT, Inc.)
PRC - C:\Windows\System32\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\Program Files\Fingerprint Reader Suite\upeksvr.exe (UPEK Inc.)


========== Modules (SafeList) ==========

MOD - C:\Users\Ganesh\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation)
MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (MBackMonitor) – C:\Program Files\McAfee\MBK\MBackMonitor.exe File not found
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (TeamViewer5) – C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (SolutoService) – C:\Program Files\Soluto\SolutoService.exe (Soluto)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (N360) – C:\Program Files\Norton Security Suite\Engine\4.2.0.12\ccSvcHst.exe (Symantec Corporation)
SRV - (wlcrasvc) – C:\Program Files\Live Mesh\Remote Desktop\wlcrasvc.exe (Microsoft Corporation)
SRV - (wlidsvc) – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (WwanSvc) – C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) – C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) – C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) – C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) – C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (RpcEptMapper) – C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (PNRPsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) – C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) – C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) – C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (WAS) – C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (W3SVC) – C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (ftpsvc) – C:\Windows\System32\inetsrv\ftpsvc.dll (Microsoft Corporation)
SRV - (Dhcp) – C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) – C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) – C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX Installer (AxInstSV) – C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppHostSvc) – C:\Windows\System32\inetsrv\apphostsvc.dll (Microsoft Corporation)
SRV - (AppIDSvc) – C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (WMSVC) – C:\Windows\System32\inetsrv\WMSvc.exe (Microsoft Corporation)
SRV - (sppsvc) – C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
SRV - (IISADMIN) – C:\Windows\System32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (MSSQL$SQLEXPRESS) SQL Server (SQLEXPRESS) – c:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (MsDepSvc) – C:\Program Files\IIS\Microsoft Web Deploy\MsDepSvc.exe (Microsoft Corporation)
SRV - (SQLWriter) – c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
SRV - (SQLBrowser) – c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
SRV - (MSSQLServerADHelper) – c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (sprtsvc_ddoctorv2) SupportSoft Sprocket Service (ddoctorv2) – C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (STacSV) – C:\Windows\System32\stacsv.exe (IDT, Inc.)
SRV - (AESTFilters) – C:\Windows\System32\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (msvsmon90) – C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe (Microsoft Corporation)
SRV - (WLSetupSvc) – C:\Program Files\Windows Live\installer\WLSetupSvc.exe (Microsoft Corporation)
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (EvtEng) Intel® – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (RegSrvc) Intel® – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (msftesql$SQLEXPRESS) SQL Server FullText Search (SQLEXPRESS) – c:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe (Microsoft Corporation)
SRV - (DSBrokerService) – C:\Program Files\DellSupport\brkrsvc.exe ()
SRV - (msvsmon80) – c:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe (Microsoft Corporation)
SRV - (WMPControllerService) – C:\DELL\Utilities\Dell Premium Remote Control\WMPControllerService.exe (Gyration, Inc.)


========== Driver Services (SafeList) ==========

DRV - (catchme) – C:\Users\Ganesh\AppData\Local\Temp\catchme.sys File not found
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20101001.022\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20101001.022\NAVENG.SYS (Symantec Corporation)
DRV - (BHDrvx86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20100901.003\BHDrvx86.sys (Symantec Corporation)
DRV - (PCGenFAM) – C:\Windows\system32\DRIVERS\PCGenFAM.sys (Soluto LTD.)
DRV - (SymEvent) – C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (IDSVix86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100930.005\IDSvix86.sys (Symantec Corporation)
DRV - (SYMTDIv) – C:\Windows\System32\Drivers\N360\0402000.00C\SYMTDIV.SYS (Symantec Corporation)
DRV - (SymIRON) – C:\Windows\system32\drivers\N360\0402000.00C\Ironx86.SYS (Symantec Corporation)
DRV - (SymEFA) – C:\Windows\system32\drivers\N360\0402000.00C\SYMEFA.SYS (Symantec Corporation)
DRV - (SRTSP) – C:\Windows\System32\Drivers\N360\0402000.00C\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\system32\drivers\N360\0402000.00C\SRTSPX.SYS (Symantec Corporation)
DRV - (ccHP) – C:\Windows\system32\drivers\N360\0402000.00C\ccHPx86.sys (Symantec Corporation)
DRV - (KSecPkg) – C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (SymDS) – C:\Windows\system32\drivers\N360\0402000.00C\SYMDS.SYS (Symantec Corporation)
DRV - (urvpndrv) – C:\Windows\System32\drivers\covpnwlh.sys (F5 Networks, Inc.)
DRV - (f5ipfw) – C:\Windows\System32\drivers\urfltwlh.sys (F5 Networks)
DRV - (mfehidk) – C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfesmfk) – C:\Windows\System32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (cmdide) – C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) – C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) – C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) – C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) – C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) – C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) – C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) – C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) – C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) – C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) – C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) – C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) – C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) – C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) – C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) – C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) – C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) – C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) – C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) – C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) – C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) – C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) – C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) – C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vmbus) – C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (vhdmp) – C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (vdrvroot) – C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (WIMMount) – C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) – C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) – C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) – C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) – C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) – C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) – C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) – C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) – C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) – C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) – C:\Windows\System32\drivers\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) – C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) – C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) – C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) – C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwifibus) – C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) – C:\Windows\System32\drivers\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) – C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (mshidkmdf) – C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) – C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) – C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) – C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) – C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (discache) – C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (HidBatt) – C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation)
DRV - (AcpiPmi) – C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) – C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) – C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) – C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) – C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (yukonw7) – C:\Windows\System32\drivers\yk62x86.sys (Marvell)
DRV - (netw5v32) Intel® – C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation)
DRV - (b57nd60x) – C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (ebdrv) – C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) – C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (CtClsFlt) – C:\Windows\System32\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV - (CtAudDrv) – C:\Windows\System32\drivers\CtAudDrv.sys (Creative Technology Ltd.)
DRV - (IdcPHid) IdeaCom HID Touch Screen Driver (PS/2) – C:\Windows\System32\drivers\idcphid.sys (IdeaCom Technology Inc.)
DRV - (TcUsb) – C:\Windows\System32\drivers\tcusb.sys (UPEK Inc.)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (MCSTRM) – C:\Windows\System32\drivers\mcstrm.sys (RealNetworks, Inc.)
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (OEM02Dev) – C:\Windows\System32\drivers\OEM02Dev.sys (Creative Technology Ltd.)
DRV - (iaStor) – C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (iaNvStor) Intel® – C:\Windows\system32\drivers\ianvstor.sys (Intel Corporation)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (rismxdp) – C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimmptsk) – C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rimsptsk) – C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (ElbyCDIO) – C:\Windows\System32\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV - (OEM02Vfx) – C:\Windows\System32\drivers\OEM02Vfx.sys (EyePower Games Pte. Ltd.)
DRV - (dsunidrv) – C:\Windows\System32\drivers\dsunidrv.sys (Gteko Ltd.)
DRV - (ElbyDelay) – C:\Windows\System32\drivers\ElbyDelay.sys (Elaborate Bytes AG)
DRV - (DSproct) – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys (Gteko Ltd.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Live Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledItems: {3191E4CE-790E-42be-B2E0-223475263B7E}:6030.2008.0904.1938
FF - prefs.js..extensions.enabledItems: {DBBB3167-6E81-400f-BBFD-BD8921726F52}:6030.2008.0904.1940
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..browser.startup.homepage: "http://www.xfinity.com/?cid=xfactiv_tech_main"
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"


FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Fiddler2\FiddlerHook [2010/03/08 20:50:17 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\IPSFFPlgn\ [2010/06/11 11:31:43 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\coFFPlgn\ [2010/06/09 12:48:49 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/16 23:05:57 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/19 00:26:29 | 000,000,000 | —D | M]

[2009/11/04 02:31:45 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Extensions
[2010/07/12 16:33:32 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\3nadhxl6.default\extensions
[2009/11/04 02:31:46 | 000,000,000 | —D | M] (F5 Networks Cache Cleaner Plugin) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\3nadhxl6.default\extensions\{3191E4CE-790E-42be-B2E0-223475263B7E}
[2010/07/12 16:33:32 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\3nadhxl6.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/11/04 02:31:47 | 000,000,000 | —D | M] (F5 Networks Host Plugin) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\3nadhxl6.default\extensions\{DBBB3167-6E81-400f-BBFD-BD8921726F52}
[2010/09/30 22:41:42 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions
[2009/11/04 02:31:49 | 000,000,000 | —D | M] (CS Lite) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{00084897-021a-4361-8423-083407a033e0}
[2010/02/28 01:37:31 | 000,000,000 | —D | M] (Image Zoom) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}
[2010/05/21 08:34:58 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/01/31 17:58:13 | 000,000,000 | —D | M] (Groowe Search Toolbar) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{268ad77e-cff8-42d7-b479-da60a7b93305}
[2010/09/24 00:14:48 | 000,000,000 | —D | M] (JonDoFox) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{437be45a-4114-11dd-b9ab-71d256d89593}
[2009/12/14 20:03:22 | 000,000,000 | —D | M] (ChatZilla) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
[2009/11/04 02:31:49 | 000,000,000 | —D | M] (Dr.Web anti-virus link checker) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{6614d11d-d21d-b211-ae23-815234e1ebb5}
[2009/11/04 02:31:50 | 000,000,000 | —D | M] (Copy Plain Text) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{723AAF16-AF1F-4404-A5D7-0BFE39766605}
[2010/09/24 00:14:56 | 000,000,000 | —D | M] (NoScript) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2009/11/04 02:31:50 | 000,000,000 | —D | M] (TabRenamizer) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{792BDDFE-2E7C-42ed-B18D-18154D2761BD}
[2009/11/04 02:31:50 | 000,000,000 | —D | M] (No name found) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{89736E8E-4B14-4042-8C75-AD00B6BD3900}
[2009/11/04 02:31:50 | 000,000,000 | —D | M] (MR Tech Toolkit) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{9669CC8F-B388-42FE-86F4-CB5E7F5A8BDC}(45)
[2009/11/04 02:31:50 | 000,000,000 | —D | M] (CacheIt!) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{98449521-9320-4257-aa35-9e1a39c8cbe0}
[2010/03/08 20:53:45 | 000,000,000 | —D | M] (Sage) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{a6ca9b3b-5e52-4f47-85d8-cca35bb57596}
[2010/07/16 01:00:34 | 000,000,000 | —D | M] (Calculator) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{AA052FD6-366A-4771-A591-0D8DC551585D}
[2009/11/04 02:31:51 | 000,000,000 | —D | M] (Temporary Inbox) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{ac1e10b8-206d-4746-a18e-0483852dc20b}
[2010/07/29 07:32:12 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2009/11/04 02:31:52 | 000,000,000 | —D | M] (Plain Text to Link) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{C90B0826-5A17-4970-A5BF-A43D22452E21}
[2009/11/04 02:31:52 | 000,000,000 | —D | M] (Media Pirate - The video downloader) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{cc265d3d-3f6f-0170-a78b-bbbaef7a868c}
[2009/11/04 02:31:52 | 000,000,000 | —D | M] (JSView) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{cf15270e-cf08-4def-b4ea-6a5ac23f3bca}
[2010/08/18 00:14:27 | 000,000,000 | —D | M] (Adblock Plus) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/05/21 08:34:57 | 000,000,000 | —D | M] (FoxClocks) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1}
[2009/11/04 02:31:55 | 000,000,000 | —D | M] (Menu Editor) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{EDA7B1D7-F793-4e03-B074-E6F303317FB0}
[2010/08/21 13:22:54 | 000,000,000 | —D | M] (ScribeFire) – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\{F807FACD-E46A-4793-B345-D58CB177673C}
[2010/09/16 23:07:14 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\[removed]
[2009/11/04 02:31:49 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\[removed]
[2009/11/04 02:31:49 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\elemhidehelper@adblockplus(44).org
[2010/07/21 00:49:08 | 000,000,000 | —D | M] – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\extensions\[removed]
[2008/09/06 14:21:25 | 000,001,733 | —- | M] () – C:\Users\Ganesh\AppData\Roaming\Mozilla\Firefox\Profiles\3nadhxl6.default\searchplugins\live-search.xml
[2010/09/16 23:05:55 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2007/02/22 19:19:12 | 000,165,248 | —- | M] (F5 Networks) – C:\Program Files\Mozilla Firefox\plugins\NPuroamHost.dll
[2008/12/30 05:13:42 | 000,000,897 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\livecom.png
[2008/12/30 05:13:42 | 000,001,015 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\livecom.src

O1 HOSTS File: ([2010/10/01 20:41:58 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Find as you type Helper) - {186A2813-D175-4cf8-B179-3873AC4E975C} - C:\Program Files\Ookii.org Find As You Type 1.3\InternetExplorerISearch.dll (Ookii.org)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Security Suite\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Security Suite\Engine\4.2.0.12\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Find as you type) - {4AE165F6-CCA4-4e9a-98CE-C2FE8B59F383} - C:\Program Files\Ookii.org Find As You Type 1.3\InternetExplorerISearch.dll (Ookii.org)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Find as you type) - {4AE165F6-CCA4-4E9A-98CE-C2FE8B59F383} - C:\Program Files\Ookii.org Find As You Type 1.3\InternetExplorerISearch.dll (Ookii.org)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to &Evernote - C:\Program Files\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - C:\Program Files\Fiddler2\Fiddler.exe (Eric Lawrence)
O9 - Extra 'Tools' menuitem : Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - C:\Program Files\Fiddler2\Fiddler.exe (Eric Lawrence)
O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: infospace.com ([bellevue] https in Trusted sites)
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: motricity.com ([bellevue] https in Trusted sites)
O15 - HKCU\..Trusted Domains: motricity.com ([outlook] https in Trusted sites)
O15 - HKCU\..Trusted Domains: netflix.com ([]* in Trusted sites)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {2A0B9B82-D5C8-4D3D-8338-AD55B23662B1} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\cachecleaner.cab (F5 Networks CacheCleaner)
O16 - DPF: {2BCDB465-81F9-41CB-832C-8037A4064446} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\urxvpn.cab (F5 Networks VPN Manager)
O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} http://picasaweb.google.com/s/v/58.17/uploader2.cab (UploadListView Class)
O16 - DPF: {41EF3CD2-D8CC-4438-84B1-280BB4E77C8E} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\f5tunsrv.cab (F5 Networks Dynamic Application Tunnel Control)
O16 - DPF: {45B69029-F3AB-4204-92DE-D5140C3E8E74} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\InstallerControl.cab (F5 Networks Auto Update)
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} https://support.dell.com/systemprofiler/SysProExe.CAB (WMI Class)
O16 - DPF: {57C76689-F052-487B-A19F-855AFDDF28EE} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\f5InspectionHost.cab (F5 Networks Policy Agent Host Class)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A3E21079-7F41-4125-9EBB-FD44CFCC0AC1} https://www.mesh.com/0.9.4014.13/TSWeb.cab (WLCTSCControl Class)
O16 - DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} http://support.dell.com/systemprofiler/DellSystemLite.CAB (DellSystemLite.Scanner)
O16 - DPF: {CC85ACDF-B277-486F-8C70-2C9B2ED2A4E7} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\urxshost.cab (F5 Networks SuperHost Class)
O16 - DPF: {E0FF21FA-B857-45C5-8621-F120A0C17FF2} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\urxhost.cab (F5 Networks Host Control)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E615C9EA-AD69-4AE9-83C9-9D906A0ACA6D} C:\Users\Ganesh\AppData\Local\Temp\f5tmp\f5syschk.cab (F5 Networks OS Policy Agent)
O16 - DPF: {E6BB2089-163F-466B-812A-748096614DFD} http://cainternetsecurity.net/scanner/cascanner.cab (CAScanner Control)
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} http://download.mcafee.com/molbin/iss-loc/…852/mcfscan.cab (McFreeScan Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Program Files\Soluto\soluto.exe /userinit) - C:\Program Files\Soluto\soluto.exe (Soluto)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\psfus: DllName - C:\Windows\system32\psqlpwd.dll - C:\Windows\System32\psqlpwd.dll (UPEK Inc.)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\XPS_NB_1280x864_NewBlue.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\XPS_NB_1280x864_NewBlue.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\Windows\System32\livessp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – Reg Error: Key error. File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/10/01 20:50:38 | 000,000,000 | —D | C] – C:\Windows\temp
[2010/10/01 20:42:05 | 000,000,000 | —D | C] – C:\$RECYCLE.BIN
[2010/10/01 20:26:31 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2010/09/30 08:21:50 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/09/30 08:21:49 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/09/30 08:21:49 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/09/30 08:21:48 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/09/29 22:00:03 | 000,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2010/09/29 22:00:02 | 000,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2010/09/29 22:00:02 | 000,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2010/09/29 21:59:53 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/09/29 21:59:33 | 000,000,000 | —D | C] – C:\Qoobox
[2010/09/29 21:21:48 | 000,000,000 | —D | C] – C:\_OTL
[2010/09/29 21:21:13 | 000,000,000 | —D | C] – C:\Users\Ganesh\Desktop\Run1
[2010/09/29 10:31:46 | 000,190,976 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\ks.sys
[2010/09/28 21:56:26 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Users\Ganesh\Desktop\OTL.exe
[2010/09/28 21:48:05 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2010/09/28 09:42:21 | 000,000,000 | —D | C] – C:\Users\Ganesh\AppData\Local\Adobe
[2010/09/25 19:28:00 | 000,000,000 | —D | C] – C:\Users\Ganesh\AppData\Local\Apple
[2010/09/19 00:56:25 | 000,000,000 | —D | C] – C:\Windows\System32\%LOCALAPPDATA%
[2010/09/19 00:18:04 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DivX Shared
[2010/09/19 00:16:03 | 000,000,000 | —D | C] – C:\ProgramData\DivX
[2010/09/15 10:00:43 | 000,000,000 | —D | C] – C:\Windows\PCHEALTH
[2010/09/04 14:37:43 | 000,000,000 | —D | C] – C:\Program Files\iPod
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/10/02 11:55:00 | 000,000,426 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{6BA1906C-24ED-48ED-B27E-B95ED6DE1510}.job
[2010/10/02 11:52:20 | 000,055,326 | —- | M] () – C:\ProgramData\nvModes.001
[2010/10/02 11:52:16 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/10/02 11:52:09 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/10/02 11:52:01 | 2414,395,392 | -HS- | M] () – C:\hiberfil.sys
[2010/10/02 11:51:23 | 005,505,024 | -HS- | M] () – C:\Users\Ganesh\NTUSER.DAT
[2010/10/02 11:50:07 | 003,469,595 | -H– | M] () – C:\Users\Ganesh\AppData\Local\IconCache.db
[2010/10/02 11:48:56 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-735267809-354239087-596126657-1000UA.job
[2010/10/01 21:40:00 | 000,000,860 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-735267809-354239087-596126657-1000Core.job
[2010/10/01 20:48:42 | 000,011,104 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/10/01 20:48:42 | 000,011,104 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/10/01 20:42:25 | 000,000,215 | —- | M] () – C:\Windows\system.ini
[2010/10/01 20:41:58 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2010/10/01 20:26:22 | 003,859,067 | R— | M] () – C:\Users\Ganesh\Desktop\ComboFix.exe
[2010/09/30 08:21:54 | 000,000,977 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/09/29 10:26:34 | 687,227,495 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/09/28 21:56:33 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\Ganesh\Desktop\OTL.exe
[2010/09/28 21:39:20 | 000,284,915 | —- | M] () – C:\Users\Ganesh\Desktop\gmer.zip
[2010/09/23 00:02:32 | 000,002,004 | -H– | M] () – C:\Users\Ganesh\Documents\Default.rdp
[2010/09/22 22:58:26 | 000,011,658 | —- | M] () – C:\Users\Ganesh\Documents\chit.xlsx
[2010/09/14 15:26:34 | 000,000,759 | —- | M] () – C:\Windows\System32\drivers\etc\hosts.bak
[2010/09/10 21:17:30 | 000,000,418 | RHS- | M] () – C:\ProgramData\ntuser.pol
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/30 08:21:54 | 000,000,977 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/09/29 22:00:03 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2010/09/29 22:00:03 | 000,077,312 | —- | C] () – C:\Windows\MBR.exe
[2010/09/29 22:00:02 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2010/09/29 22:00:02 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2010/09/29 22:00:02 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2010/09/29 21:19:32 | 003,859,067 | R— | C] () – C:\Users\Ganesh\Desktop\ComboFix.exe
[2010/09/28 22:11:05 | 000,293,376 | —- | C] () – C:\Users\Ganesh\Desktop\gmer.exe
[2010/09/28 21:39:17 | 000,284,915 | —- | C] () – C:\Users\Ganesh\Desktop\gmer.zip
[2010/09/22 22:58:24 | 000,011,658 | —- | C] () – C:\Users\Ganesh\Documents\chit.xlsx
[2010/06/22 20:53:46 | 000,000,098 | —- | C] () – C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2010/06/11 14:00:18 | 000,055,326 | —- | C] () – C:\ProgramData\nvModes.dat
[2010/06/11 14:00:18 | 000,055,326 | —- | C] () – C:\ProgramData\nvModes.001
[2010/06/09 12:45:30 | 000,000,418 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2010/06/04 20:06:42 | 000,007,597 | —- | C] () – C:\Users\Ganesh\AppData\Local\Resmon.ResmonCfg
[2010/05/08 10:48:37 | 000,087,552 | —- | C] () – C:\Windows\System32\cpwmon2k.dll
[2010/02/07 22:09:27 | 000,003,584 | —- | C] () – C:\Users\Ganesh\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/07/13 16:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 16:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/06/28 04:59:45 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/05/04 15:03:00 | 000,059,904 | —- | C] () – C:\Windows\System32\zlib1.dll
[2009/05/04 14:53:28 | 000,286,720 | —- | C] () – C:\Windows\System32\libcurl.dll
[2009/05/04 14:53:10 | 000,143,360 | —- | C] () – C:\Windows\System32\libexpatw.dll
[2009/02/07 21:54:34 | 000,164,352 | —- | C] () – C:\Windows\System32\unrar.dll
[2009/02/07 21:54:30 | 000,755,027 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2009/02/07 21:54:29 | 000,159,839 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2009/02/07 21:54:26 | 000,007,680 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2009/02/07 21:54:26 | 000,000,547 | —- | C] () – C:\Windows\System32\ff_vfw.dll.manifest
[2009/02/07 21:50:59 | 000,395,776 | —- | C] () – C:\Windows\System32\libmplayer.dll
[2009/02/07 21:50:59 | 000,262,144 | —- | C] () – C:\Windows\System32\TomsMoComp_ff.dll
[2009/02/07 21:50:59 | 000,112,640 | —- | C] () – C:\Windows\System32\libmpeg2_ff.dll
[2009/02/07 21:50:58 | 002,255,360 | —- | C] () – C:\Windows\System32\libavcodec.dll
[2008/11/21 14:47:52 | 003,596,288 | —- | C] () – C:\Windows\System32\qt-dx331.dll
[2008/11/21 14:45:16 | 000,000,416 | —- | C] () – C:\Windows\System32\dtu100.dll.manifest
[2008/04/20 21:29:29 | 000,000,742 | —- | C] () – C:\Windows\ODBC.INI
[2008/03/30 19:19:07 | 000,054,342 | —- | C] () – C:\Users\Ganesh\AppData\Roaming\nvModes.001
[2008/03/29 23:43:10 | 000,054,342 | —- | C] () – C:\Users\Ganesh\AppData\Roaming\nvModes.dat
[2008/03/24 14:55:15 | 000,167,936 | —- | C] () – C:\Windows\System32\nvccoin.dll
[2008/03/24 14:55:14 | 000,016,480 | —- | C] () – C:\Windows\System32\rixdicon.dll
[2007/07/25 16:40:02 | 000,999,424 | —- | C] () – C:\Windows\System32\WLIHVUI.dll
[2003/09/16 08:52:28 | 000,147,456 | —- | C] () – C:\Windows\System32\vorbis.dll
[2003/09/16 08:43:31 | 000,884,736 | —- | C] () – C:\Windows\System32\vorbisenc.dll
[2003/09/16 08:41:43 | 000,045,056 | —- | C] () – C:\Windows\System32\ogg.dll
< End of report >
Post #13
You appear clean of infections,please do the following.



ComboFix - Cleanup
Time for some housekeeping
  • Click Start…select Run from the menu.
  • Copy and paste the following into the text entry box:
    Combofix /Uninstall
  • Click the OK button. (See image below as reference.)
🖼Click to load external image (Posted Image)









Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.







Clean out your temp files.
Download Attribune's ATF Cleaner and save to your desktop.
Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.








Here are some recommendations to help you stay clean.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/



Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.

please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:
  • Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.


Thats it you are good to go.Safe surfing

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI