What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

malware - "Antimalware" installed - hijackthis log

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Running Windows 7… I think viewing streaming video exposed me to the malware. "Antimalware" seemed to install itself and start popping up warnings beyond belief.

Ran "Malwarebytes" program to partially remove problem, but still appears to be issues… Any help would be appreciated!

HiJackThis log below…

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:19:14 PM, on 9/27/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Roxio Creator 2009 Ultimate\5.0\CPMonitor.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\VMware\VMware Player\hqtray.exe
C:\Program Files\Symantec AntiVirus\VPTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
C:\Users\DP\AppData\Roaming\Google\Google Talk\googletalk.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\AIM\aim.exe
C:\Users\DP\AppData\Local\Temp\system.exe
C:\Users\DP\AppData\Local\Temp\cmd.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Users\DP\AppData\Local\Temp\gdi32.exe
C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
C:\Users\DP\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Users\DP\AppData\Local\Spoon\3.21.0.22\Spoon-Sandbox.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Users\DP\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\DP\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Java\jre6\bin\jp2launcher.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe
O1 - Hosts: ::1 localhost
O1 - Hosts: 76.12.154.81 jfrob-vps
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: IE Developer Toolbar BHO - {CC7E636D-39AA-49b6-B511-65413DA137A1} - C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [DNS7reminder] "C:\Program Files\Nuance\NaturallySpeaking10\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking10\Ereg.ini
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatchTray11.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [VMware hqtray] "C:\Program Files\VMware\VMware Player\hqtray.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\DP\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [googletalk] C:\Users\DP\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [LvdPndiejlkc] C:\Users\DP\AppData\Local\Temp\cmd.exe
O4 - HKCU\..\Run: [LvdPndiejlk+] C:\Users\DP\AppData\Local\Temp\gdi32.exe
O4 - HKCU\..\Run: [LvdPndiejlud] C:\Users\DP\AppData\Local\Temp\system.exe
O4 - HKCU\..\Run: [LvdPndiejlud(Windows; U; Windows NT 5.1; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5] C:\Users\DP\AppData\Local\Temp\system.exe
O4 - HKCU\..\Run: [LvdPndiejlud(Windows; U; Windows NT 6.0; en-US; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1] C:\Users\DP\AppData\Local\Temp\system.exe
O4 - HKCU\..\Run: [LvdPndiejlud(Windows; U; Windows NT 5.1; en-US; rv:1.9) Gecko/2008052906 Firefox/3.0] C:\Users\DP\AppData\Local\Temp\system.exe
O4 - HKCU\..\Run: [LvdPndiejlkc(Windows; U; Windows NT 5.1; en-US; rv:1.9) Gecko/2008052906 Firefox/3.0] C:\Users\DP\AppData\Local\Temp\cmd.exe
O4 - HKCU\..\Run: [LvdPndiejlk+(Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.0.249.89 Safari/532.5] C:\Users\DP\AppData\Local\Temp\gdi32.exe
O4 - HKCU\..\Run: [LvdPndiejlkc(Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3] C:\Users\DP\AppData\Local\Temp\cmd.exe
O4 - HKCU\..\Run: [LvdPndiejlud(Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3] C:\Users\DP\AppData\Local\Temp\system.exe
O4 - HKCU\..\Run: [LvdPndiejlkc(Windows; U; Windows NT 5.1; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5] C:\Users\DP\AppData\Local\Temp\cmd.exe
O4 - Startup: Dropbox.lnk = DP\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Audible Download Manager.lnk = C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
O4 - Global Startup: Google Calendar Sync.lnk = C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: IE Developer Toolbar - {48FFE35F-36D9-44bd-A6CC-1D34414EAC0D} - C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CE0A1836-1875-45AC-A4AA-974CA6AA8A09}: NameServer = 192.168.1.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Roxio SAIB Service (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) - Unknown owner - C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c94d9236b2ec51) (gupdate1c94d9236b2ec51) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Roxio UPnP Renderer 11 - Sonic Solutions - C:\Program Files\Roxio Creator 2009 Ultimate\Digital Home 11\RoxioUPnPRenderer11.exe
O23 - Service: Roxio Upnp Server 11 - Sonic Solutions - C:\Program Files\Roxio Creator 2009 Ultimate\Digital Home 11\RoxioUpnpService11.exe
O23 - Service: LiveShare P2P Server 11 (RoxLiveShare11) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\11.0\SharedCOM\RoxLiveShare11.exe
O23 - Service: RoxMediaDB11 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\11.0\SharedCOM\RoxMediaDB11.exe
O23 - Service: Roxio Hard Drive Watcher 11 (RoxWatch11) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatch11.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Player\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Player\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe

–
End of file - 13388 bytes
Post #2
Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post


Please do the following.

  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under Custom Scan paste this in

    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • You may need two posts to fit them both in.







[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If GMER won't run try with devices unchecked.If still no go try in safe mode.



In your next reply please post the following.
  • Both OTL logs
  • GMER log
Post #4
Please do not attach logs unless requested,use copy/paste.



Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2



**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.
Post #5
Apologies… one of your instructions said "attach it in your reply" so I thought I should attach the text files… here is the combo fix result: ComboFix 10-09-27.05 - David Pagini 09/28/2010 21:22:38.2.4 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.3326.1741 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Symantec AntiVirus *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C} SP: Symantec AntiVirus *disabled* (Updated) {6C85A515-B91D-4D2B-AF18-40984A4A8493} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\data c:\data\EConfDB\EConfDB.mdf c:\data\EConfDB\EConfDB_log.ldf c:\users\David Pagini\AppData\Local\{6261FF81-E58C-43F0-90C2-47350A2AE383} c:\users\David Pagini\AppData\Local\{6261FF81-E58C-43F0-90C2-47350A2AE383}\chrome.manifest c:\users\David Pagini\AppData\Local\{6261FF81-E58C-43F0-90C2-47350A2AE383}\chrome\content\_cfg.js c:\users\David Pagini\AppData\Local\{6261FF81-E58C-43F0-90C2-47350A2AE383}\chrome\content\overlay.xul c:\users\David Pagini\AppData\Local\{6261FF81-E58C-43F0-90C2-47350A2AE383}\install.rdf c:\users\David Pagini\AppData\Roaming\22944F8A9F19E8393D6707EA101487A4 c:\users\David Pagini\AppData\Roaming\22944F8A9F19E8393D6707EA101487A4\enemies-names.txt c:\users\David Pagini\AppData\Roaming\22944F8A9F19E8393D6707EA101487A4\local.ini c:\users\David Pagini\AppData\Roaming\22944F8A9F19E8393D6707EA101487A4\lsrslt.ini c:\windows\system32\spool\prtprocs\w32x86\XPDPP_A.DLL Infected copy of c:\windows\explorer.exe was found and disinfected Restored copy from - c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe Infected copy of c:\windows\System32\wininit.exe was found and disinfected Restored copy from - c:\windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe Infected copy of c:\windows\explorer.exe was found and disinfected Restored copy from - c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe . ((((((((((((((((((((((((( Files Created from 2010-08-28 to 2010-09-29 ))))))))))))))))))))))))))))))) . 2010-09-29 01:31 . 2010-09-29 01:31 ——– d—–w- c:\users\Mcx1\AppData\Local\temp 2010-09-29 01:31 . 2010-09-29 01:31 ——– d—–w- c:\users\Guest\AppData\Local\temp 2010-09-29 01:31 . 2010-09-29 01:31 ——– d—–w- c:\users\Default\AppData\Local\temp 2010-09-28 01:52 . 2010-09-28 01:52 ——– d—–w- c:\program files\Trend Micro 2010-09-27 04:16 . 2010-09-27 10:45 120 —-a-w- c:\users\David Pagini\AppData\Local\Ygadafu.dat 2010-09-27 04:16 . 2010-09-27 04:16 0 —-a-w- c:\users\David Pagini\AppData\Local\Qbutu.bin 2010-09-27 04:08 . 2010-09-27 04:08 ——– d—–w- c:\users\David Pagini\AppData\Local\Opera 2010-09-27 02:29 . 2010-09-27 02:29 ——– d—–w- c:\windows\PCHEALTH 2010-09-27 02:11 . 2010-09-27 02:11 ——– d—–w- c:\users\David Pagini\AppData\Roaming\Genieo 2010-09-27 02:11 . 2010-09-27 02:11 ——– d—–w- c:\programdata\Update 2010-09-14 21:55 . 2010-08-21 05:32 316928 —-a-w- c:\windows\system32\spoolsv.exe 2010-09-06 18:36 . 2010-09-06 18:37 ——– d—–w- c:\program files\iTunes 2010-09-06 18:36 . 2010-09-06 18:36 ——– d—–w- c:\program files\iPod . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-09-29 01:30 . 2009-01-23 04:24 ——– d—–w- c:\users\David Pagini\AppData\Roaming\Skype 2010-09-29 01:29 . 2009-02-05 00:16 ——– d—–w- c:\users\David Pagini\AppData\Roaming\uTorrent 2010-09-29 01:16 . 2009-01-23 04:25 ——– d—–w- c:\users\David Pagini\AppData\Roaming\skypePM 2010-09-29 01:16 . 2009-11-16 15:14 ——– d—–w- c:\users\David Pagini\AppData\Roaming\Dropbox 2010-09-27 02:29 . 2008-11-23 17:26 ——– d—–w- c:\programdata\Microsoft Help 2010-09-27 02:11 . 2010-09-27 02:11 143 —-a-w- c:\users\David Pagini\AppData\Roaming\hgksfg.bat 2010-09-19 04:40 . 2008-11-27 01:58 ——– d—–w- c:\programdata\Roxio 2010-09-16 02:31 . 2010-08-23 00:05 ——– d—–w- c:\program files\QuickTime 2010-09-13 03:46 . 2008-11-29 02:14 ——– d—–w- c:\program files\Microsoft Silverlight 2010-09-09 00:22 . 2008-11-23 17:39 ——– d—–w- c:\program files\Safari 2010-09-06 21:02 . 2009-02-23 18:17 ——– d—–w- c:\programdata\DVD Shrink 2010-09-06 18:36 . 2008-11-23 14:45 ——– d—–w- c:\program files\Common Files\Apple 2010-07-29 06:30 . 2010-08-12 01:17 197632 —-a-w- c:\windows\system32\ir32_32.dll 2010-07-29 06:30 . 2010-08-12 01:17 82944 —-a-w- c:\windows\system32\iccvid.dll 2009-06-10 21:26 . 2009-07-14 02:04 9633792 –sha-r- c:\windows\Fonts\StaticCache.dat 2009-07-14 01:14 . 2009-07-13 23:42 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2009-08-13 22:55 85768 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2009-08-13 22:55 85768 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2009-08-13 22:55 85768 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2009-08-13 22:55 85768 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2009-08-13 22:55 85768 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2009-08-13 22:55 85768 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2009-08-13 22:55 85768 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2009-08-13 22:55 85768 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2009-08-13 22:55 85768 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 94208 —-a-w- c:\users\David Pagini\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 94208 —-a-w- c:\users\David Pagini\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 94208 —-a-w- c:\users\David Pagini\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AnyDVD"="c:\program files\SlySoft\AnyDVD\AnyDVDtray.exe" [2008-03-07 1694656] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2009-07-14 144384] "Google Update"="c:\users\David Pagini\AppData\Local\Google\Update\GoogleUpdate.exe" [2008-11-23 133104] "googletalk"="c:\users\David Pagini\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2008-10-24 79136] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856] "Skype"="c:\program files\Skype\\Phone\Skype.exe" [2010-09-02 13351304] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-02-05 219952] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 221184] "AIM"="c:\program files\AIM\aim.exe" [2006-08-01 67112] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-08 47904] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-02-01 115560] "DNS7reminder"="c:\program files\Nuance\NaturallySpeaking10\Ereg\Ereg.exe" [2007-04-16 259624] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "RoxWatchTray"="c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatchTray11.exe" [2008-08-14 240112] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472] "VirtualCloneDrive"="c:\program files\VirtualCloneDrive\VCDDaemon.exe" [2009-05-26 85160] "VMware hqtray"="c:\program files\VMware\VMware Player\hqtray.exe" [2009-08-15 64048] "vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2008-10-23 136080] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888] c:\users\David Pagini\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\David Pagini\AppData\Roaming\Dropbox\bin\Dropbox.exe [2010-2-26 21979992] OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-11-24 113664] Audible Download Manager.lnk - c:\program files\Audible\Bin\AudibleDownloadHelper.exe [2009-9-23 1791320] Google Calendar Sync.lnk - c:\program files\Google\Google Calendar Sync\GoogleCalendarSync.exe [2008-10-2 546288] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) [HKLM\~\startupfolder\C:^Users^David Pagini^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Spoon Sandbox Manager 3.21.lnk] path=c:\users\David Pagini\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spoon Sandbox Manager 3.21.lnk backup=c:\windows\pss\Spoon Sandbox Manager 3.21.lnk.Startup backupExtension=.Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CPMonitor] 2009-04-20 15:10 84464 —-a-w- c:\program files\Roxio Creator 2009 Ultimate\5.0\CPMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LvNWPiejlud (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3] c:\users\DAVIDP~1\AppData\Local\Temp\system.exe [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LvNWPiejlud (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.3) Gecko/2008092417 Firefox/3.0.3] c:\users\DAVIDP~1\AppData\Local\Temp\system.exe [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LvNWPiejlupc(Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1] c:\users\DAVIDP~1\AppData\Local\Temp\sysedit.exe [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LvNWPiejlupc(Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3] c:\users\DAVIDP~1\AppData\Local\Temp\sysedit.exe [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe] 2008-12-09 10:12 234856 —-a-w- c:\program files\TomTom\HOME 2\HOMERunner.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate1c94d9236b2ec51;Google Update Service (gupdate1c94d9236b2ec51);c:\program files\Google\Update\GoogleUpdate.exe [2008-11-23 133104] R2 Roxio Upnp Server 11;Roxio Upnp Server 11;c:\program files\Roxio Creator 2009 Ultimate\Digital Home 11\RoxioUpnpService11.exe [2008-08-14 367088] R2 RoxLiveShare11;LiveShare P2P Server 11;c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxLiveShare11.exe [2008-08-14 309744] R2 RoxWatch11;Roxio Hard Drive Watcher 11;c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatch11.exe [2008-08-14 170480] R3 Roxio UPnP Renderer 11;Roxio UPnP Renderer 11;c:\program files\Roxio Creator 2009 Ultimate\Digital Home 11\RoxioUPnPRenderer11.exe [2008-08-14 313840] R3 RoxMediaDB11;RoxMediaDB11;c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxMediaDB11.exe [2009-01-09 1122304] R3 SavRoam;SavRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [2008-10-23 121744] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-04-19 1343400] R4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2007-02-22 2808664] S0 SahdIa32;HDD Filter Driver;c:\windows\System32\Drivers\SahdIa32.sys [2008-08-01 20464] S0 SaibIa32;Volume Filter Driver;c:\windows\System32\Drivers\SaibIa32.sys [2008-08-01 15856] S1 SaibVd32;Virtual Disk Driver;c:\windows\system32\Drivers\SaibVd32.sys [2008-08-01 25584] S2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\program files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe [2008-08-01 125424] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 176128] S2 vmci;VMware vmci;c:\windows\system32\Drivers\vmci.sys [2009-08-15 54960] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-06-03 102448] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] iissvcs REG_MULTI_SZ w3svc was apphost REG_MULTI_SZ apphostsvc . Contents of the 'Scheduled Tasks' folder 2010-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2008-11-23 17:37] 2010-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2008-11-23 17:37] 2010-09-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2527318067-1796310006-3798171769-1000Core.job - c:\users\David Pagini\AppData\Local\Google\Update\GoogleUpdate.exe [2008-11-23 17:38] 2010-09-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2527318067-1796310006-3798171769-1000UA.job - c:\users\David Pagini\AppData\Local\Google\Update\GoogleUpdate.exe [2008-11-23 17:38] 2010-09-03 c:\windows\Tasks\NatSpeak Periodic Acoustic Optimization.job - c:\program files\Nuance\NaturallySpeaking10\Program\schedmgr.exe [2009-03-17 01:17] 2010-09-03 c:\windows\Tasks\NatSpeak Periodic Language Model Optimization.job - c:\program files\Nuance\NaturallySpeaking10\Program\schedmgr.exe [2009-03-17 01:17] . . ——- Supplementary Scan ——- . uStart Page = about:blank uInternet Settings,ProxyOverride = *.local IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000 TCP: {CE0A1836-1875-45AC-A4AA-974CA6AA8A09} = 192.168.1.1 FF - ProfilePath - c:\users\David Pagini\AppData\Roaming\Mozilla\Firefox\Profiles\gc8q8ljz.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff36\gears.dll FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll FF - component: c:\users\David Pagini\AppData\Roaming\Mozilla\Firefox\Profiles\gc8q8ljz.default\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}\platform\WINNT_x86-msvc\components\WeaveCrypto.dll FF - component: c:\users\David Pagini\AppData\Roaming\Mozilla\Firefox\Profiles\gc8q8ljz.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npsharedview.dll FF - plugin: c:\users\David Pagini\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll FF - plugin: c:\users\David Pagini\AppData\Local\Spoon\3.21.0.22\npMozillaSpoonPlugin.dll FF - plugin: c:\users\David Pagini\AppData\Roaming\Move Networks\plugins\npqmp071701000002.dll FF - plugin: c:\users\David Pagini\AppData\Roaming\Move Networks\plugins\npqmp071705000014.dll FF - plugin: c:\users\David Pagini\AppData\Roaming\Mozilla\Firefox\Profiles\gc8q8ljz.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}\plugins\npGarmin.dll FF - plugin: c:\users\David Pagini\AppData\Roaming\Mozilla\plugins\npatgpc.dll FF - plugin: c:\users\David Pagini\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll FF - plugin: c:\users\David Pagini\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ —- FIREFOX POLICIES —- FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . - - - - ORPHANS REMOVED - - - - HKLM-Run-Malwarebytes Anti-Malware (reboot) - c:\program files\Malwarebytes' Anti-Malware\mbam.exe MSConfigStartUp-Dcubunufuqoseje - c:\users\David Pagini\AppData\Local\ugoluwen.dll MSConfigStartUp-Gxajejigu - c:\users\David Pagini\AppData\Local\wiats0.dll MSConfigStartUp-LvdPndiejlk+ - c:\users\David Pagini\AppData\Local\Temp\gdi32.exe MSConfigStartUp-LvdPndiejlkc - c:\users\David Pagini\AppData\Local\Temp\cmd.exe MSConfigStartUp-LvdPndiejlud - c:\users\David Pagini\AppData\Local\Temp\system.exe MSConfigStartUp-LvNWPiejlk+ - c:\users\DAVIDP~1\AppData\Local\Temp\gdi32.exe MSConfigStartUp-LvNWPiejlkc - c:\users\DAVIDP~1\AppData\Local\Temp\cmd.exe MSConfigStartUp-533 - c:\users\DAVIDP~1\AppData\Local\Temp\cmd.exe MSConfigStartUp-3.6 - c:\users\DAVIDP~1\AppData\Local\Temp\win32.exe MSConfigStartUp-3.0 - c:\users\DAVIDP~1\AppData\Local\Temp\win32.exe MSConfigStartUp-LvNWPiejlud - c:\users\DAVIDP~1\AppData\Local\Temp\system.exe MSConfigStartUp-532 - c:\users\DAVIDP~1\AppData\Local\Temp\sysedit.exe MSConfigStartUp-uPc+nVMThfngpucJsiv - c:\users\DAVIDP~1\AppData\Local\Temp\fuvthiwi.dll MSConfigStartUp-uPc+nVMThfngtRaGuo - c:\users\DAVIDP~1\AppData\Local\Temp\rvkj99.dll . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Common Client\ccService\Channels] @Denied: (C D) (Everyone) "{3464E97D-E30B-4CD6-8F33-992A7BD3E923}"="{B6E4817C-EB87-4B8D-9680-69E623845743}" "{451E1007-508C-448F-9AA5-143A2744BDB8}"="{8B0B8E8F-9282-4A8D-B88B-2E39346548B6}" "{6BB3F0FC-D28F-4F19-ACF8-D50F7B8E8007}"="{EFF6A75C-B446-4E12-916F-4DBA9320C4F4}" "{7E40E590-CF9D-4822-99EE-D97E1327D582}"="{B6E4817C-EB87-4B8D-9680-69E623845743}" "{80671E38-E1DD-4049-88F7-3F775362715B}"="{E3AEF4A3-0B4E-4E88-8271-D827F876B6FD}" "{B0D0C984-276D-4236-9E95-A1689B2DFB13}"="{E3AEF4A3-0B4E-4E88-8271-D827F876B6FD}" "{B9862A5D-E1FF-44DC-BDD8-3822CB435603}"="{B6E4817C-EB87-4B8D-9680-69E623845743}" "{C3D972E0-FCBE-46D7-BDD9-3D5FB3384C3A}"="{EFF6A75C-B446-4E12-916F-4DBA9320C4F4}" "{1BA8D014-1F70-44EC-8ACF-C620A13396EA}"="{D0533DA4-C0BE-4AEC-9F80-D29FF7555DCB}" "{7B30CCEE-B129-4EE7-8FD2-50F93875B7A5}"="{CB019B1A-DFDF-4CA8-8A9E-5BFE7A80EA3F}" "{9D826315-15D6-4F39-93D1-8127CB8055FD}"="{67F5B535-1467-4DAE-9B64-96A3B394A927}" "{1F8DAA4F-F4B3-46A0-A4C7-9123DFB823A8}"="{67F5B535-1467-4DAE-9B64-96A3B394A927}" "{5F7C6089-12A0-4A07-9977-F871B172A437}"="{CEF74018-29B5-4C83-BAFC-AFC0333BE30B}" "{DD2B7329-59D5-4A4A-A8FA-7CB2D88CB811}"="{CEF74018-29B5-4C83-BAFC-AFC0333BE30B}" "{29BC308D-35C8-495A-BA92-A5A71F0D2C8F}"="{8A329109-C068-4959-A4F6-B692C6A124C0}" "{3037C582-9E5F-4D3C-AEEF-BEB726DAA112}"="{8A329109-C068-4959-A4F6-B692C6A124C0}" "{24101373-321A-42E1-BC12-6BA6DB016214}"="{6EB233BB-87D1-43EA-9E9F-A0FB141FEA86}" "{E7E65362-EEA8-4C99-B108-8C4323C27E81}"="{6EB233BB-87D1-43EA-9E9F-A0FB141FEA86}" "{05308A84-C82A-459E-A5D5-4ED2AE93E474}"="{9E8CF9C1-A30D-45C4-9A51-7827E534882A}" "{FDDDECF5-B968-41B9-AC62-8E0F9D7E6B6A}"="{9E8CF9C1-A30D-45C4-9A51-7827E534882A}" "{F734F9CA-8B1C-42F3-9C01-805972249A8A}"="{32DE461B-18B9-4FD2-9826-448DEE1C62E4}" "{D4DC7EB9-79F2-4DFC-B419-13DC2F9AB5F7}"="{32DE461B-18B9-4FD2-9826-448DEE1C62E4}" "{1810D697-CFFB-4C80-BF58-37FB68CB590F}"="{F111CE6D-5207-4312-8603-774332144467}" "{226E8B50-C530-4298-865C-A70413E06953}"="{F111CE6D-5207-4312-8603-774332144467}" "{F393B263-8103-48AA-946F-2B3D57930059}"="{AF4C88E8-F0DA-474B-8AF4-FA2C3F816622}" "{01B7169C-7D52-4A70-BE98-B41776B709C0}"="{AF4C88E8-F0DA-474B-8AF4-FA2C3F816622}" "{1ED7EA92-03F4-4FD5-821D-FB9836634348}"="{597E5DC7-1D26-4C14-B242-E33D4C185CA4}" "{82CB1B2E-30C1-4B0F-982C-A7E71D0AAA81}"="{597E5DC7-1D26-4C14-B242-E33D4C185CA4}" "{79B37300-8D5A-4BBD-85BE-135FF3668AFF}"="{32BBA37A-346D-4B34-B3E0-6A92F15ED002}" "{46747ED1-1C36-4ADA-8A71-C0771236F03B}"="{32BBA37A-346D-4B34-B3E0-6A92F15ED002}" "{5B4F728F-7B9B-4C00-8DE7-A82E2D9E06D0}"="{97A63106-5848-4D71-85EF-A6F3FB552BF0}" "{78610E8F-267E-4FC6-BC97-3F00082AB9F4}"="{97A63106-5848-4D71-85EF-A6F3FB552BF0}" "{42D3D9D4-6D94-4CC0-9D27-FABDE8CEB553}"="{97A63106-5848-4D71-85EF-A6F3FB552BF0}" "{931AAFCF-B4DE-4901-803F-2E465BFF3E03}"="{B0F9686B-039F-4DC8-A6D8-C587B5CE26E7}" "{6978B49B-74C7-466F-A132-800B2351AFB0}"="{B84E5337-1763-4186-9949-6FED17C3941B}" "{BEC83CA8-CF97-46DC-8DE3-16BDDD672D3B}"="{B84E5337-1763-4186-9949-6FED17C3941B}" "{A4A6EE37-4312-4998-92F6-12D0D36D282A}"="{5C6C790C-FD09-48A7-8291-42081EA7426E}" "{6FE7B24B-D6B1-4758-80A8-CA2680C5A6D7}"="{5C6C790C-FD09-48A7-8291-42081EA7426E}" "{4C4B164A-A73A-4F81-A56C-9B767DC35832}"="{CC2D6197-BB54-4DC5-9819-F7296922C74B}" "{F245FD00-9063-4480-8F61-B1ECCBDC0579}"="{CC2D6197-BB54-4DC5-9819-F7296922C74B}" "{D9DAD9B4-FE80-46CA-B4FA-BC76DEFFA7DB}"="{CC2D6197-BB54-4DC5-9819-F7296922C74B}" "{64ABF481-AC4A-47DF-B2B6-4E6E92FCAE54}"="{35408A3C-4DE1-45F3-98B5-41DFD0FA3CEA}" "{B0C850C8-05E7-42E4-AA25-203E6CD8E9CC}"="{C921FD8F-FA50-4602-94E4-FE6FB7C3F610}" "{CAFBD21C-198E-4E0C-805B-86BEDFE579AC}"="{C921FD8F-FA50-4602-94E4-FE6FB7C3F610}" "{21484D6B-B5DF-4364-A343-3E8B7C1E9B01}"="{9639BEA1-801E-4DF4-8A13-C3F35E99B889}" "{183B19C5-6542-4EF2-80BE-589A89B4BA2B}"="{9639BEA1-801E-4DF4-8A13-C3F35E99B889}" "{1BC64595-C272-4A83-8BB0-F75E63B76482}"="{F3B8B3B2-0225-463F-A360-5DC6796FC047}" "{FEF12BB2-70AB-4130-9CF5-E8E14B14CFE5}"="{F3B8B3B2-0225-463F-A360-5DC6796FC047}" "{6DB2BBAD-1511-45A3-B837-E3DE31CE0705}"="{F3B8B3B2-0225-463F-A360-5DC6796FC047}" "{54F1B1D7-A996-4C13-B984-8A1D0F3FEF6A}"="{8E94D209-3351-4937-91B7-8A8E93E9E9B4}" "{9AA63369-AAF2-4632-BAF9-7AFFC291841D}"="{8E94D209-3351-4937-91B7-8A8E93E9E9B4}" "{3BF7ECCE-2448-49C8-AF61-2E24CE0AA23F}"="{713FA741-E8C1-4EC4-9ED5-F3F6CE5BD8C8}" "{590C708B-CFAA-42CF-96FA-F279201F6A4A}"="{CF233A11-22B7-4800-8594-D1B1DDE626F3}" "{12AE0A92-222C-48F2-B5DB-FCAC8F2CE07A}"="{CF233A11-22B7-4800-8594-D1B1DDE626F3}" "{92BB0019-4110-47AE-891A-42426B58A94E}"="{9C08E0AC-92EB-40F7-A4BB-78AB31E82E83}" "{7C555323-B2AA-4540-B794-7CF6C8B90FA6}"="{9C08E0AC-92EB-40F7-A4BB-78AB31E82E83}" "{A0C20664-FAD9-4E5F-9C2C-415B8DCC809E}"="{D0569C11-5D8E-437B-9807-C59E3C0D13CF}" "{C0BAAE89-95EC-4D6B-AA21-954034FBD9BB}"="{D0569C11-5D8E-437B-9807-C59E3C0D13CF}" "{08013516-A048-4A9F-9AB7-EFA90C353B6D}"="{C3559726-34E2-425E-9A11-E729F31CD388}" "{C7C75C24-D769-49F1-8403-63F1820F167C}"="{C3559726-34E2-425E-9A11-E729F31CD388}" "{94CF6D74-FBB7-40CE-9EE6-85FC539667E5}"="{C3559726-34E2-425E-9A11-E729F31CD388}" "{436F9D63-AFF4-430B-8A5B-139143D9361D}"="{2B37A003-0CC1-4075-93CE-302F4064BBEE}" "{EC9F28F6-2E29-4716-B15A-C2ADF4F4E2E7}"="{41C34055-DDE8-423F-9F24-FE6F380F4039}" "{3AF2FFD0-8F10-436F-9614-DFE8130330B6}"="{41C34055-DDE8-423F-9F24-FE6F380F4039}" "{17333884-3D42-4872-BBB4-FE3D853341D8}"="{4E61784F-4D0E-4C4D-9E92-80F5698503CD}" "{AF2C5D73-F1A2-453D-A397-87A64EF9CBB8}"="{4E61784F-4D0E-4C4D-9E92-80F5698503CD}" "{8F231E93-485D-41EE-96A6-129C415C2F4B}"="{BFE13188-1ACB-4C06-81D5-9F11B4317638}" "{65F706DC-B177-4A8B-B5AF-7AB5EE1299B7}"="{BFE13188-1ACB-4C06-81D5-9F11B4317638}" "{9DEBAB58-2684-461E-90C7-52324162DC4B}"="{525CE3FE-4789-45CE-A2FE-1D5339F1D0A2}" "{12E98E2B-4484-4EC6-B91B-9AF7E21A77EF}"="{525CE3FE-4789-45CE-A2FE-1D5339F1D0A2}" "{137FC62C-1A24-4F37-A7A2-781B04C8BE36}"="{C98CFFE4-D9E2-45C7-8488-9DDFA8F43AFA}" "{8A8819B1-BAE0-4545-BCFB-56EF7F054EAC}"="{C98CFFE4-D9E2-45C7-8488-9DDFA8F43AFA}" "{80BDB29A-1932-4304-ADAB-E8F13D7E9979}"="{3CFBBA6D-8378-47A3-9F2E-321F7B0C2D6F}" "{68C54786-8466-439B-91C5-A20BA3E15DBB}"="{3CFBBA6D-8378-47A3-9F2E-321F7B0C2D6F}" "{1E13F767-1AC7-49BC-A6EF-F7E994B80645}"="{EC584CC0-DA30-438D-BF59-524109E3E6C8}" "{C107C456-0E9D-42BB-AEFA-BE778AB8418B}"="{81339890-235A-44CE-9446-BFF257DA38FE}" "{42DF5B73-D70E-4C2C-BF98-6B478ED214C4}"="{81339890-235A-44CE-9446-BFF257DA38FE}" "{E60CD88E-27D9-4C9D-9523-C85DA2D3EC0F}"="{E6BC8F90-6DC9-45AF-BC9F-E66A4005B79C}" "{ECE534FB-D6DA-4C67-A0C2-69226A974192}"="{E6BC8F90-6DC9-45AF-BC9F-E66A4005B79C}" "{0BEFA56D-163A-4E61-8A14-DAB0ED7B4280}"="{CE9E5383-1F93-4A87-A562-7BE4F9789539}" "{AF53D0F1-7676-4309-9D54-20C62E062B4A}"="{CE9E5383-1F93-4A87-A562-7BE4F9789539}" "{D80CED05-7B24-42BC-A31A-51D18C2D6F04}"="{389B4C12-874D-454A-81E8-B271A483F0F5}" "{1E6DA476-5EFE-4A45-BFF7-2A89B743F1C0}"="{389B4C12-874D-454A-81E8-B271A483F0F5}" "{E26EA2E6-64ED-4272-BE85-7F99CCEBD0A7}"="{1A52425E-FBBB-43F6-8E82-491369EC25D4}" "{00CB2C87-9BE3-419F-AB49-7A306FE63386}"="{1A52425E-FBBB-43F6-8E82-491369EC25D4}" "{4390C4B8-6178-401E-B98F-54C1A9EADB20}"="{531C313E-FCD1-4534-A973-17857228131D}" "{624D6235-0E10-46EC-8731-BD737623C08A}"="{531C313E-FCD1-4534-A973-17857228131D}" "{FF80B929-4931-4DC7-8B1D-C1D0E0C9D3CD}"="{3BD6C47F-F4BA-4B3C-9A37-EF83EFCBF40F}" "{A4947428-4272-4EA1-B43E-C695EB966DCB}"="{3BD6C47F-F4BA-4B3C-9A37-EF83EFCBF40F}" "{7293E3ED-8F42-430A-8809-2E3D74CD5668}"="{3BD6C47F-F4BA-4B3C-9A37-EF83EFCBF40F}" "{25189C72-993B-4457-8B44-8840EF9A0E9D}"="{B8A25F7D-79DE-4D50-949F-E8CA2AD1E143}" "{09F47DF5-0915-4CE1-948C-2D1672534BE2}"="{8D27BFA5-0642-49F1-89F8-7E72446A6CAA}" "{EFDE3060-348F-46E9-9829-D7E88E129918}"="{8D27BFA5-0642-49F1-89F8-7E72446A6CAA}" "{B0470F53-FED4-445D-B3CA-BF81392D22F3}"="{DA09D297-B79C-4DD2-897F-642B598D4ABA}" "{F3066FAC-911F-4777-9E6F-2B06B5640660}"="{DA09D297-B79C-4DD2-897F-642B598D4ABA}" "{F3D05AA7-E446-418F-AD3A-CEED2348F112}"="{66A0C724-775F-44BA-8E54-37325B18A69C}" "{9A82D187-470D-48D1-8F68-3744944CD213}"="{66A0C724-775F-44BA-8E54-37325B18A69C}" "ccSvcHst_ccSetMgr"="{E48AEBEB-CA2B-4A1C-858C-43F6C0793FAE}" "SNDServiceRequestChannel"="{E48AEBEB-CA2B-4A1C-858C-43F6C0793FAE}" "SNDLocationChannel"="{E48AEBEB-CA2B-4A1C-858C-43F6C0793FAE}" "ccSettingsService"="{E48AEBEB-CA2B-4A1C-858C-43F6C0793FAE}" "ccSvcHst_ccEvtMgr"="{E48AEBEB-CA2B-4A1C-858C-43F6C0793FAE}" "ccEvtCli"="{E48AEBEB-CA2B-4A1C-858C-43F6C0793FAE}" "{9A9B5E1C-7CAB-471A-A980-71FE43218BB6}"="{C4C1034B-24A0-4A49-AA0E-4F5992BCE7B8}" "{4372222F-26F8-469A-8E29-D72C0C454D52}"="{C4C1034B-24A0-4A49-AA0E-4F5992BCE7B8}" "{BB89D499-B611-4B04-AF75-D22FEADAE56B}"="{C4C1034B-24A0-4A49-AA0E-4F5992BCE7B8}" "{8DD18F13-C838-469C-BFAA-62127C1BF736}"="{B0758CF8-215B-4252-A19C-979168EEE83A}" "{508AEE84-FDA8-4E8F-BBF4-DF78E6CAD267}"="{B0758CF8-215B-4252-A19C-979168EEE83A}" "{416E1A46-39BD-42A3-AF32-B57BE4E681FF}"="{B0758CF8-215B-4252-A19C-979168EEE83A}" "{051032EE-FF3A-42A7-BD42-261D743CC061}"="{19023E1D-4EED-4D5C-B092-AEF3F5613FA5}" "{54DBBAD0-815E-4A1D-887B-7C56C42996F5}"="{181C8B83-D11B-4BA2-84CE-5113D01A8671}" "{4EBE14D7-9BDD-453C-84CD-EB3E5039A700}"="{181C8B83-D11B-4BA2-84CE-5113D01A8671}" "{A2D31297-AB45-4F7A-ABB6-49866B6961A3}"="{9F093C7E-342E-4B7C-8233-5F101377BC4A}" "{4B31CDB8-41A4-49C2-9268-433D71BD94E2}"="{9F093C7E-342E-4B7C-8233-5F101377BC4A}" "{670B1B92-E088-44F5-9E8C-A5B702FB797B}"="{A8482AB7-D9E4-4FB8-8AC5-2479683E922C}" "{D7AB8E97-FAE6-4019-83D4-2AFC1A645C5B}"="{A8482AB7-D9E4-4FB8-8AC5-2479683E922C}" "{B49C209C-FAAD-472A-8D7C-F3032C676336}"="{A8482AB7-D9E4-4FB8-8AC5-2479683E922C}" "{F35CA932-1961-4703-A251-F5FB6979B651}"="{AF807C26-75C9-47DD-B8A1-1FE97C60DD88}" "{3BE01883-5766-46D1-976B-42167878A597}"="{A6B4792D-91F0-4039-82C2-F46264E40C60}" "{AD5BAA22-FEC3-4DB7-B723-A08D5813DD73}"="{A6B4792D-91F0-4039-82C2-F46264E40C60}" "{B77BC20C-1E1D-40BD-96E3-E0116FE83E03}"="{E48AEBEB-CA2B-4A1C-858C-43F6C0793FAE}" "{073DBDA7-3F71-43A3-9A1A-095CEC7FFDAE}"="{E48AEBEB-CA2B-4A1C-858C-43F6C0793FAE}" "{10F797E4-AB13-403E-8283-994913E719D0}"="{44AD37DD-3A5B-4B3E-B8F5-CCA00C0114CB}" "{590E7D7E-CEA8-4289-9ABD-6585C3C9B30F}"="{44AD37DD-3A5B-4B3E-B8F5-CCA00C0114CB}" "{EA689F1F-BAC7-4787-932A-0957AB525312}"="{44AD37DD-3A5B-4B3E-B8F5-CCA00C0114CB}" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ——————— DLLs Loaded Under Running Processes ——————— - - - - - - - > 'Explorer.exe'(2116) c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll c:\program files\TortoiseSVN\bin\TortoiseStub.dll c:\program files\TortoiseSVN\bin\TortoiseSVN.dll c:\program files\TortoiseSVN\bin\intl3_tsvn.dll c:\users\David Pagini\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll c:\windows\system32\msi.dll . ———————— Other Running Processes ———————— . c:\windows\system32\atieclxx.exe c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Common Files\Symantec Shared\ccSvcHst.exe c:\program files\Symantec AntiVirus\DefWatch.exe c:\windows\system32\inetsrv\inetinfo.exe c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe c:\windows\system32\taskhost.exe c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe c:\program files\Symantec AntiVirus\Rtvscan.exe c:\program files\VMware\VMware Player\vmware-authd.exe c:\windows\system32\conhost.exe c:\windows\system32\sppsvc.exe c:\program files\Internet Explorer\IELowutil.exe c:\program files\TortoiseSVN\bin\TSVNCache.exe c:\program files\Windows Media Player\wmpnetwk.exe . ************************************************************************** . Completion time: 2010-09-28 21:40:45 - machine was rebooted ComboFix-quarantined-files.txt 2010-09-29 01:40 ComboFix2.txt 2009-02-03 04:53 Pre-Run: 43,169,116,160 bytes free Post-Run: 52,939,993,088 bytes free - - End Of File - - 58B2C366A4B33D5FECE80EEE586768F4
Post #6
COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below: 

    Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LvNWPiejlud (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LvNWPiejlud (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.3) Gecko/2008092417 Firefox/3.0.3]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LvNWPiejlupc(Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LvNWPiejlupc(Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3]

File::
c:\users\DAVIDP~1\AppData\Local\Temp\system.exe
c:\users\DAVIDP~1\AppData\Local\Temp\system.exe
c:\users\DAVIDP~1\AppData\Local\Temp\sysedit.exe
c:\users\DAVIDP~1\AppData\Local\Temp\sysedit.exe
c:\users\David Pagini\AppData\Local\Ygadafu.dat
c:\users\David Pagini\AppData\Local\Qbutu.bin
c:\users\David Pagini\AppData\Roaming\hgksfg.bat
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • If you need help to disable your protection programs see here.
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.








Next

Please download Malwarebytes from Here or Here

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the log please
Post #7
LOGS…

ComboFix:

ComboFix 10-09-28.03 - David Pagini 09/29/2010 15:12:30.3.4 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.3326.1922 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\David Pagini\Desktop\CFScript.txt
AV: Symantec AntiVirus *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
SP: Symantec AntiVirus *disabled* (Updated) {6C85A515-B91D-4D2B-AF18-40984A4A8493}
* Created a new restore point

FILE ::
"c:\users\David Pagini\AppData\Local\Qbutu.bin"
"c:\users\David Pagini\AppData\Local\Ygadafu.dat"
"c:\users\David Pagini\AppData\Roaming\hgksfg.bat"
"c:\users\DAVIDP~1\AppData\Local\Temp\sysedit.exe"
"c:\users\DAVIDP~1\AppData\Local\Temp\system.exe"
.
ADS - Windows: deleted 24 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\David Pagini\AppData\Local\Qbutu.bin
c:\users\David Pagini\AppData\Local\Ygadafu.dat
c:\users\David Pagini\AppData\Roaming\hgksfg.bat

.
((((((((((((((((((((((((( Files Created from 2010-08-28 to 2010-09-29 )))))))))))))))))))))))))))))))
.

2010-09-29 19:17 . 2010-09-29 19:17 ——– d—–w- c:\users\Public\AppData\Local\temp
2010-09-29 19:17 . 2010-09-29 19:17 ——– d—–w- c:\users\Mcx1\AppData\Local\temp
2010-09-29 19:17 . 2010-09-29 19:17 ——– d—–w- c:\users\Guest\AppData\Local\temp
2010-09-29 19:17 . 2010-09-29 19:17 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-09-28 02:17 . 2010-09-28 02:17 388096 —-a-r- c:\users\David Pagini\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-09-28 01:52 . 2010-09-28 01:52 ——– d—–w- c:\program files\Trend Micro
2010-09-27 04:08 . 2010-09-27 04:08 ——– d—–w- c:\users\David Pagini\AppData\Local\Opera
2010-09-27 02:29 . 2010-09-27 02:29 ——– d—–w- c:\windows\PCHEALTH
2010-09-27 02:11 . 2010-09-27 02:11 38257 —-a-w- c:\users\David Pagini\AppData\Roaming\Genieo\Application\Partner\uninstall\homeyNews\partner_uninstall.exe
2010-09-27 02:11 . 2010-09-27 02:11 ——– d—–w- c:\users\David Pagini\AppData\Roaming\Genieo
2010-09-27 02:11 . 2010-09-27 02:11 ——– d—–w- c:\programdata\Update
2010-09-19 10:45 . 2010-09-19 10:45 455552 —-a-w- c:\users\David Pagini\AppData\Roaming\Genieo\Application\Updater\genieo_temp\InstallHomeyNews.exe
2010-09-19 10:45 . 2010-09-19 10:45 318952 —-a-w- c:\users\David Pagini\AppData\Roaming\Genieo\Application\Updater\genieo_temp\homey_setup.exe
2010-09-14 21:55 . 2010-08-21 05:32 316928 —-a-w- c:\windows\system32\spoolsv.exe
2010-09-09 00:21 . 2010-09-09 00:21 72488 —-a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.33.18.5\SetupAdmin.exe
2010-09-06 19:07 . 2010-08-12 05:52 85464 —-a-w- c:\users\David Pagini\AppData\Roaming\Mozilla\Firefox\Profiles\gc8q8ljz.default\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}\platform\WINNT_x86-msvc\components\WeaveCrypto.dll
2010-09-06 19:07 . 2010-08-12 05:52 38872 —-a-w- c:\users\David Pagini\AppData\Roaming\Mozilla\Firefox\Profiles\gc8q8ljz.default\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}\platform\WINCE\components\WeaveCrypto.dll
2010-09-06 18:36 . 2010-09-06 18:37 ——– d—–w- c:\program files\iTunes
2010-09-06 18:36 . 2010-09-06 18:36 ——– d—–w- c:\program files\iPod
2010-09-06 18:33 . 2010-09-06 18:33 73000 —-a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 10.0.0.68\SetupAdmin.exe
2010-08-31 16:11 . 2010-08-31 16:11 3401880 —-a-w- c:\users\David Pagini\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
2010-08-31 15:55 . 2010-08-31 15:55 275096 —-a-w- c:\users\David Pagini\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
2010-08-31 15:39 . 2010-08-31 15:39 3734536 —-a-w- c:\users\David Pagini\AppData\Roaming\Mozilla\plugins\Google Talk Plugin Extras\d3dx9_36.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-29 01:30 . 2009-01-23 04:24 ——– d—–w- c:\users\David Pagini\AppData\Roaming\Skype
2010-09-29 01:29 . 2009-02-05 00:16 ——– d—–w- c:\users\David Pagini\AppData\Roaming\uTorrent
2010-09-29 01:16 . 2009-01-23 04:25 ——– d—–w- c:\users\David Pagini\AppData\Roaming\skypePM
2010-09-29 01:16 . 2009-11-16 15:14 ——– d—–w- c:\users\David Pagini\AppData\Roaming\Dropbox
2010-09-27 02:29 . 2008-11-23 17:26 ——– d—–w- c:\programdata\Microsoft Help
2010-09-19 04:40 . 2008-11-27 01:58 ——– d—–w- c:\programdata\Roxio
2010-09-16 02:31 . 2010-08-23 00:05 ——– d—–w- c:\program files\QuickTime
2010-09-13 03:46 . 2008-11-29 02:14 ——– d—–w- c:\program files\Microsoft Silverlight
2010-09-09 00:22 . 2008-11-23 17:39 ——– d—–w- c:\program files\Safari
2010-09-06 21:02 . 2009-02-23 18:17 ——– d—–w- c:\programdata\DVD Shrink
2010-09-06 18:36 . 2008-11-23 14:45 ——– d—–w- c:\program files\Common Files\Apple
2010-07-29 06:30 . 2010-08-12 01:17 197632 —-a-w- c:\windows\system32\ir32_32.dll
2010-07-29 06:30 . 2010-08-12 01:17 82944 —-a-w- c:\windows\system32\iccvid.dll
2010-07-29 03:26 . 2010-07-29 03:26 72488 —-a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.33.17.8\SetupAdmin.exe
2009-06-10 21:26 . 2009-07-14 02:04 9633792 –sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\users\David Pagini\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\users\David Pagini\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\users\David Pagini\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AnyDVD"="c:\program files\SlySoft\AnyDVD\AnyDVDtray.exe" [2008-03-07 1694656]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2009-07-14 144384]
"Google Update"="c:\users\David Pagini\AppData\Local\Google\Update\GoogleUpdate.exe" [2008-11-23 133104]
"googletalk"="c:\users\David Pagini\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2008-10-24 79136]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2010-09-02 13351304]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-02-05 219952]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 221184]
"AIM"="c:\program files\AIM\aim.exe" [2006-08-01 67112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-08 47904]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-02-01 115560]
"DNS7reminder"="c:\program files\Nuance\NaturallySpeaking10\Ereg\Ereg.exe" [2007-04-16 259624]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatchTray11.exe" [2008-08-14 240112]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"VirtualCloneDrive"="c:\program files\VirtualCloneDrive\VCDDaemon.exe" [2009-05-26 85160]
"VMware hqtray"="c:\program files\VMware\VMware Player\hqtray.exe" [2009-08-15 64048]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2008-10-23 136080]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]

c:\users\David Pagini\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\David Pagini\AppData\Roaming\Dropbox\bin\Dropbox.exe [2010-2-26 21979992]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-11-24 113664]
Audible Download Manager.lnk - c:\program files\Audible\Bin\AudibleDownloadHelper.exe [2009-9-23 1791320]
Google Calendar Sync.lnk - c:\program files\Google\Google Calendar Sync\GoogleCalendarSync.exe [2008-10-2 546288]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKLM\~\startupfolder\C:^Users^David Pagini^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Spoon Sandbox Manager 3.21.lnk]
path=c:\users\David Pagini\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spoon Sandbox Manager 3.21.lnk
backup=c:\windows\pss\Spoon Sandbox Manager 3.21.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CPMonitor]
2009-04-20 15:10 84464 —-a-w- c:\program files\Roxio Creator 2009 Ultimate\5.0\CPMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2008-12-09 10:12 234856 —-a-w- c:\program files\TomTom\HOME 2\HOMERunner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1c94d9236b2ec51;Google Update Service (gupdate1c94d9236b2ec51);c:\program files\Google\Update\GoogleUpdate.exe [2008-11-23 133104]
R2 Roxio Upnp Server 11;Roxio Upnp Server 11;c:\program files\Roxio Creator 2009 Ultimate\Digital Home 11\RoxioUpnpService11.exe [2008-08-14 367088]
R2 RoxLiveShare11;LiveShare P2P Server 11;c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxLiveShare11.exe [2008-08-14 309744]
R2 RoxWatch11;Roxio Hard Drive Watcher 11;c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatch11.exe [2008-08-14 170480]
R3 Roxio UPnP Renderer 11;Roxio UPnP Renderer 11;c:\program files\Roxio Creator 2009 Ultimate\Digital Home 11\RoxioUPnPRenderer11.exe [2008-08-14 313840]
R3 RoxMediaDB11;RoxMediaDB11;c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxMediaDB11.exe [2009-01-09 1122304]
R3 SavRoam;SavRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [2008-10-23 121744]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-04-19 1343400]
R4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2007-02-22 2808664]
S0 SahdIa32;HDD Filter Driver;c:\windows\System32\Drivers\SahdIa32.sys [2008-08-01 20464]
S0 SaibIa32;Volume Filter Driver;c:\windows\System32\Drivers\SaibIa32.sys [2008-08-01 15856]
S1 SaibVd32;Virtual Disk Driver;c:\windows\system32\Drivers\SaibVd32.sys [2008-08-01 25584]
S2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\program files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe [2008-08-01 125424]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 176128]
S2 vmci;VMware vmci;c:\windows\system32\Drivers\vmci.sys [2009-08-15 54960]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-06-03 102448]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
.
Contents of the 'Scheduled Tasks' folder

2010-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-11-23 17:37]

2010-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-11-23 17:37]

2010-09-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2527318067-1796310006-3798171769-1000Core.job
- c:\users\David Pagini\AppData\Local\Google\Update\GoogleUpdate.exe [2008-11-23 17:38]

2010-09-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2527318067-1796310006-3798171769-1000UA.job
- c:\users\David Pagini\AppData\Local\Google\Update\GoogleUpdate.exe [2008-11-23 17:38]

2010-09-03 c:\windows\Tasks\NatSpeak Periodic Acoustic Optimization.job
- c:\program files\Nuance\NaturallySpeaking10\Program\schedmgr.exe [2009-03-17 01:17]

2010-09-03 c:\windows\Tasks\NatSpeak Periodic Language Model Optimization.job
- c:\program files\Nuance\NaturallySpeaking10\Program\schedmgr.exe [2009-03-17 01:17]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
TCP: {CE0A1836-1875-45AC-A4AA-974CA6AA8A09} = 192.168.1.1
FF - ProfilePath - c:\users\David Pagini\AppData\Roaming\Mozilla\Firefox\Profiles\gc8q8ljz.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff36\gears.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - component: c:\users\David Pagini\AppData\Roaming\Mozilla\Firefox\Profiles\gc8q8ljz.default\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}\platform\WINNT_x86-msvc\components\WeaveCrypto.dll
FF - component: c:\users\David Pagini\AppData\Roaming\Mozilla\Firefox\Profiles\gc8q8ljz.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Common Client\ccService\Channels]
@Denied: (C D) (Everyone)
"{3464E97D-E30B-4CD6-8F33-992A7BD3E923}"="{B6E4817C-EB87-4B8D-9680-69E623845743}"
"{451E1007-508C-448F-9AA5-143A2744BDB8}"="{8B0B8E8F-9282-4A8D-B88B-2E39346548B6}"
"{6BB3F0FC-D28F-4F19-ACF8-D50F7B8E8007}"="{EFF6A75C-B446-4E12-916F-4DBA9320C4F4}"
"{7E40E590-CF9D-4822-99EE-D97E1327D582}"="{B6E4817C-EB87-4B8D-9680-69E623845743}"
"{80671E38-E1DD-4049-88F7-3F775362715B}"="{E3AEF4A3-0B4E-4E88-8271-D827F876B6FD}"
"{B0D0C984-276D-4236-9E95-A1689B2DFB13}"="{E3AEF4A3-0B4E-4E88-8271-D827F876B6FD}"
"{B9862A5D-E1FF-44DC-BDD8-3822CB435603}"="{B6E4817C-EB87-4B8D-9680-69E623845743}"
"{C3D972E0-FCBE-46D7-BDD9-3D5FB3384C3A}"="{EFF6A75C-B446-4E12-916F-4DBA9320C4F4}"
"{1BA8D014-1F70-44EC-8ACF-C620A13396EA}"="{D0533DA4-C0BE-4AEC-9F80-D29FF7555DCB}"
"{7B30CCEE-B129-4EE7-8FD2-50F93875B7A5}"="{CB019B1A-DFDF-4CA8-8A9E-5BFE7A80EA3F}"
"{9D826315-15D6-4F39-93D1-8127CB8055FD}"="{67F5B535-1467-4DAE-9B64-96A3B394A927}"
"{1F8DAA4F-F4B3-46A0-A4C7-9123DFB823A8}"="{67F5B535-1467-4DAE-9B64-96A3B394A927}"
"{5F7C6089-12A0-4A07-9977-F871B172A437}"="{CEF74018-29B5-4C83-BAFC-AFC0333BE30B}"
"{DD2B7329-59D5-4A4A-A8FA-7CB2D88CB811}"="{CEF74018-29B5-4C83-BAFC-AFC0333BE30B}"
"{29BC308D-35C8-495A-BA92-A5A71F0D2C8F}"="{8A329109-C068-4959-A4F6-B692C6A124C0}"
"{3037C582-9E5F-4D3C-AEEF-BEB726DAA112}"="{8A329109-C068-4959-A4F6-B692C6A124C0}"
"{24101373-321A-42E1-BC12-6BA6DB016214}"="{6EB233BB-87D1-43EA-9E9F-A0FB141FEA86}"
"{E7E65362-EEA8-4C99-B108-8C4323C27E81}"="{6EB233BB-87D1-43EA-9E9F-A0FB141FEA86}"
"{05308A84-C82A-459E-A5D5-4ED2AE93E474}"="{9E8CF9C1-A30D-45C4-9A51-7827E534882A}"
"{FDDDECF5-B968-41B9-AC62-8E0F9D7E6B6A}"="{9E8CF9C1-A30D-45C4-9A51-7827E534882A}"
"{F734F9CA-8B1C-42F3-9C01-805972249A8A}"="{32DE461B-18B9-4FD2-9826-448DEE1C62E4}"
"{D4DC7EB9-79F2-4DFC-B419-13DC2F9AB5F7}"="{32DE461B-18B9-4FD2-9826-448DEE1C62E4}"
"{1810D697-CFFB-4C80-BF58-37FB68CB590F}"="{F111CE6D-5207-4312-8603-774332144467}"
"{226E8B50-C530-4298-865C-A70413E06953}"="{F111CE6D-5207-4312-8603-774332144467}"
"{F393B263-8103-48AA-946F-2B3D57930059}"="{AF4C88E8-F0DA-474B-8AF4-FA2C3F816622}"
"{01B7169C-7D52-4A70-BE98-B41776B709C0}"="{AF4C88E8-F0DA-474B-8AF4-FA2C3F816622}"
"{1ED7EA92-03F4-4FD5-821D-FB9836634348}"="{597E5DC7-1D26-4C14-B242-E33D4C185CA4}"
"{82CB1B2E-30C1-4B0F-982C-A7E71D0AAA81}"="{597E5DC7-1D26-4C14-B242-E33D4C185CA4}"
"{79B37300-8D5A-4BBD-85BE-135FF3668AFF}"="{32BBA37A-346D-4B34-B3E0-6A92F15ED002}"
"{46747ED1-1C36-4ADA-8A71-C0771236F03B}"="{32BBA37A-346D-4B34-B3E0-6A92F15ED002}"
"{5B4F728F-7B9B-4C00-8DE7-A82E2D9E06D0}"="{97A63106-5848-4D71-85EF-A6F3FB552BF0}"
"{78610E8F-267E-4FC6-BC97-3F00082AB9F4}"="{97A63106-5848-4D71-85EF-A6F3FB552BF0}"
"{42D3D9D4-6D94-4CC0-9D27-FABDE8CEB553}"="{97A63106-5848-4D71-85EF-A6F3FB552BF0}"
"{931AAFCF-B4DE-4901-803F-2E465BFF3E03}"="{B0F9686B-039F-4DC8-A6D8-C587B5CE26E7}"
"{6978B49B-74C7-466F-A132-800B2351AFB0}"="{B84E5337-1763-4186-9949-6FED17C3941B}"
"{BEC83CA8-CF97-46DC-8DE3-16BDDD672D3B}"="{B84E5337-1763-4186-9949-6FED17C3941B}"
"{A4A6EE37-4312-4998-92F6-12D0D36D282A}"="{5C6C790C-FD09-48A7-8291-42081EA7426E}"
"{6FE7B24B-D6B1-4758-80A8-CA2680C5A6D7}"="{5C6C790C-FD09-48A7-8291-42081EA7426E}"
"{4C4B164A-A73A-4F81-A56C-9B767DC35832}"="{CC2D6197-BB54-4DC5-9819-F7296922C74B}"
"{F245FD00-9063-4480-8F61-B1ECCBDC0579}"="{CC2D6197-BB54-4DC5-9819-F7296922C74B}"
"{D9DAD9B4-FE80-46CA-B4FA-BC76DEFFA7DB}"="{CC2D6197-BB54-4DC5-9819-F7296922C74B}"
"{64ABF481-AC4A-47DF-B2B6-4E6E92FCAE54}"="{35408A3C-4DE1-45F3-98B5-41DFD0FA3CEA}"
"{B0C850C8-05E7-42E4-AA25-203E6CD8E9CC}"="{C921FD8F-FA50-4602-94E4-FE6FB7C3F610}"
"{CAFBD21C-198E-4E0C-805B-86BEDFE579AC}"="{C921FD8F-FA50-4602-94E4-FE6FB7C3F610}"
"{21484D6B-B5DF-4364-A343-3E8B7C1E9B01}"="{9639BEA1-801E-4DF4-8A13-C3F35E99B889}"
"{183B19C5-6542-4EF2-80BE-589A89B4BA2B}"="{9639BEA1-801E-4DF4-8A13-C3F35E99B889}"
"{1BC64595-C272-4A83-8BB0-F75E63B76482}"="{F3B8B3B2-0225-463F-A360-5DC6796FC047}"
"{FEF12BB2-70AB-4130-9CF5-E8E14B14CFE5}"="{F3B8B3B2-0225-463F-A360-5DC6796FC047}"
"{6DB2BBAD-1511-45A3-B837-E3DE31CE0705}"="{F3B8B3B2-0225-463F-A360-5DC6796FC047}"
"{54F1B1D7-A996-4C13-B984-8A1D0F3FEF6A}"="{8E94D209-3351-4937-91B7-8A8E93E9E9B4}"
"{9AA63369-AAF2-4632-BAF9-7AFFC291841D}"="{8E94D209-3351-4937-91B7-8A8E93E9E9B4}"
"{3BF7ECCE-2448-49C8-AF61-2E24CE0AA23F}"="{713FA741-E8C1-4EC4-9ED5-F3F6CE5BD8C8}"
"{590C708B-CFAA-42CF-96FA-F279201F6A4A}"="{CF233A11-22B7-4800-8594-D1B1DDE626F3}"
"{12AE0A92-222C-48F2-B5DB-FCAC8F2CE07A}"="{CF233A11-22B7-4800-8594-D1B1DDE626F3}"
"{92BB0019-4110-47AE-891A-42426B58A94E}"="{9C08E0AC-92EB-40F7-A4BB-78AB31E82E83}"
"{7C555323-B2AA-4540-B794-7CF6C8B90FA6}"="{9C08E0AC-92EB-40F7-A4BB-78AB31E82E83}"
"{A0C20664-FAD9-4E5F-9C2C-415B8DCC809E}"="{D0569C11-5D8E-437B-9807-C59E3C0D13CF}"
"{C0BAAE89-95EC-4D6B-AA21-954034FBD9BB}"="{D0569C11-5D8E-437B-9807-C59E3C0D13CF}"
"{08013516-A048-4A9F-9AB7-EFA90C353B6D}"="{C3559726-34E2-425E-9A11-E729F31CD388}"
"{C7C75C24-D769-49F1-8403-63F1820F167C}"="{C3559726-34E2-425E-9A11-E729F31CD388}"
"{94CF6D74-FBB7-40CE-9EE6-85FC539667E5}"="{C3559726-34E2-425E-9A11-E729F31CD388}"
"{436F9D63-AFF4-430B-8A5B-139143D9361D}"="{2B37A003-0CC1-4075-93CE-302F4064BBEE}"
"{EC9F28F6-2E29-4716-B15A-C2ADF4F4E2E7}"="{41C34055-DDE8-423F-9F24-FE6F380F4039}"
"{3AF2FFD0-8F10-436F-9614-DFE8130330B6}"="{41C34055-DDE8-423F-9F24-FE6F380F4039}"
"{17333884-3D42-4872-BBB4-FE3D853341D8}"="{4E61784F-4D0E-4C4D-9E92-80F5698503CD}"
"{AF2C5D73-F1A2-453D-A397-87A64EF9CBB8}"="{4E61784F-4D0E-4C4D-9E92-80F5698503CD}"
"{8F231E93-485D-41EE-96A6-129C415C2F4B}"="{BFE13188-1ACB-4C06-81D5-9F11B4317638}"
"{65F706DC-B177-4A8B-B5AF-7AB5EE1299B7}"="{BFE13188-1ACB-4C06-81D5-9F11B4317638}"
"{9DEBAB58-2684-461E-90C7-52324162DC4B}"="{525CE3FE-4789-45CE-A2FE-1D5339F1D0A2}"
"{12E98E2B-4484-4EC6-B91B-9AF7E21A77EF}"="{525CE3FE-4789-45CE-A2FE-1D5339F1D0A2}"
"{137FC62C-1A24-4F37-A7A2-781B04C8BE36}"="{C98CFFE4-D9E2-45C7-8488-9DDFA8F43AFA}"
"{8A8819B1-BAE0-4545-BCFB-56EF7F054EAC}"="{C98CFFE4-D9E2-45C7-8488-9DDFA8F43AFA}"
"{80BDB29A-1932-4304-ADAB-E8F13D7E9979}"="{3CFBBA6D-8378-47A3-9F2E-321F7B0C2D6F}"
"{68C54786-8466-439B-91C5-A20BA3E15DBB}"="{3CFBBA6D-8378-47A3-9F2E-321F7B0C2D6F}"
"{1E13F767-1AC7-49BC-A6EF-F7E994B80645}"="{EC584CC0-DA30-438D-BF59-524109E3E6C8}"
"{C107C456-0E9D-42BB-AEFA-BE778AB8418B}"="{81339890-235A-44CE-9446-BFF257DA38FE}"
"{42DF5B73-D70E-4C2C-BF98-6B478ED214C4}"="{81339890-235A-44CE-9446-BFF257DA38FE}"
"{E60CD88E-27D9-4C9D-9523-C85DA2D3EC0F}"="{E6BC8F90-6DC9-45AF-BC9F-E66A4005B79C}"
"{ECE534FB-D6DA-4C67-A0C2-69226A974192}"="{E6BC8F90-6DC9-45AF-BC9F-E66A4005B79C}"
"{0BEFA56D-163A-4E61-8A14-DAB0ED7B4280}"="{CE9E5383-1F93-4A87-A562-7BE4F9789539}"
"{AF53D0F1-7676-4309-9D54-20C62E062B4A}"="{CE9E5383-1F93-4A87-A562-7BE4F9789539}"
"{D80CED05-7B24-42BC-A31A-51D18C2D6F04}"="{389B4C12-874D-454A-81E8-B271A483F0F5}"
"{1E6DA476-5EFE-4A45-BFF7-2A89B743F1C0}"="{389B4C12-874D-454A-81E8-B271A483F0F5}"
"{E26EA2E6-64ED-4272-BE85-7F99CCEBD0A7}"="{1A52425E-FBBB-43F6-8E82-491369EC25D4}"
"{00CB2C87-9BE3-419F-AB49-7A306FE63386}"="{1A52425E-FBBB-43F6-8E82-491369EC25D4}"
"{4390C4B8-6178-401E-B98F-54C1A9EADB20}"="{531C313E-FCD1-4534-A973-17857228131D}"
"{624D6235-0E10-46EC-8731-BD737623C08A}"="{531C313E-FCD1-4534-A973-17857228131D}"
"{FF80B929-4931-4DC7-8B1D-C1D0E0C9D3CD}"="{3BD6C47F-F4BA-4B3C-9A37-EF83EFCBF40F}"
"{A4947428-4272-4EA1-B43E-C695EB966DCB}"="{3BD6C47F-F4BA-4B3C-9A37-EF83EFCBF40F}"
"{7293E3ED-8F42-430A-8809-2E3D74CD5668}"="{3BD6C47F-F4BA-4B3C-9A37-EF83EFCBF40F}"
"{25189C72-993B-4457-8B44-8840EF9A0E9D}"="{B8A25F7D-79DE-4D50-949F-E8CA2AD1E143}"
"{09F47DF5-0915-4CE1-948C-2D1672534BE2}"="{8D27BFA5-0642-49F1-89F8-7E72446A6CAA}"
"{EFDE3060-348F-46E9-9829-D7E88E129918}"="{8D27BFA5-0642-49F1-89F8-7E72446A6CAA}"
"{B0470F53-FED4-445D-B3CA-BF81392D22F3}"="{DA09D297-B79C-4DD2-897F-642B598D4ABA}"
"{F3066FAC-911F-4777-9E6F-2B06B5640660}"="{DA09D297-B79C-4DD2-897F-642B598D4ABA}"
"{F3D05AA7-E446-418F-AD3A-CEED2348F112}"="{66A0C724-775F-44BA-8E54-37325B18A69C}"
"{9A82D187-470D-48D1-8F68-3744944CD213}"="{66A0C724-775F-44BA-8E54-37325B18A69C}"
"ccSvcHst_ccSetMgr"="{E48AEBEB-CA2B-4A1C-858C-43F6C0793FAE}"
"SNDServiceRequestChannel"="{E48AEBEB-CA2B-4A1C-858C-43F6C0793FAE}"
"SNDLocationChannel"="{E48AEBEB-CA2B-4A1C-858C-43F6C0793FAE}"
"ccSettingsService"="{E48AEBEB-CA2B-4A1C-858C-43F6C0793FAE}"
"ccSvcHst_ccEvtMgr"="{E48AEBEB-CA2B-4A1C-858C-43F6C0793FAE}"
"ccEvtCli"="{E48AEBEB-CA2B-4A1C-858C-43F6C0793FAE}"
"{9A9B5E1C-7CAB-471A-A980-71FE43218BB6}"="{C4C1034B-24A0-4A49-AA0E-4F5992BCE7B8}"
"{4372222F-26F8-469A-8E29-D72C0C454D52}"="{C4C1034B-24A0-4A49-AA0E-4F5992BCE7B8}"
"{BB89D499-B611-4B04-AF75-D22FEADAE56B}"="{C4C1034B-24A0-4A49-AA0E-4F5992BCE7B8}"
"{8DD18F13-C838-469C-BFAA-62127C1BF736}"="{B0758CF8-215B-4252-A19C-979168EEE83A}"
"{508AEE84-FDA8-4E8F-BBF4-DF78E6CAD267}"="{B0758CF8-215B-4252-A19C-979168EEE83A}"
"{416E1A46-39BD-42A3-AF32-B57BE4E681FF}"="{B0758CF8-215B-4252-A19C-979168EEE83A}"
"{051032EE-FF3A-42A7-BD42-261D743CC061}"="{19023E1D-4EED-4D5C-B092-AEF3F5613FA5}"
"{54DBBAD0-815E-4A1D-887B-7C56C42996F5}"="{181C8B83-D11B-4BA2-84CE-5113D01A8671}"
"{4EBE14D7-9BDD-453C-84CD-EB3E5039A700}"="{181C8B83-D11B-4BA2-84CE-5113D01A8671}"
"{A2D31297-AB45-4F7A-ABB6-49866B6961A3}"="{9F093C7E-342E-4B7C-8233-5F101377BC4A}"
"{4B31CDB8-41A4-49C2-9268-433D71BD94E2}"="{9F093C7E-342E-4B7C-8233-5F101377BC4A}"
"{670B1B92-E088-44F5-9E8C-A5B702FB797B}"="{A8482AB7-D9E4-4FB8-8AC5-2479683E922C}"
"{D7AB8E97-FAE6-4019-83D4-2AFC1A645C5B}"="{A8482AB7-D9E4-4FB8-8AC5-2479683E922C}"
"{B49C209C-FAAD-472A-8D7C-F3032C676336}"="{A8482AB7-D9E4-4FB8-8AC5-2479683E922C}"
"{F35CA932-1961-4703-A251-F5FB6979B651}"="{AF807C26-75C9-47DD-B8A1-1FE97C60DD88}"
"{3BE01883-5766-46D1-976B-42167878A597}"="{A6B4792D-91F0-4039-82C2-F46264E40C60}"
"{AD5BAA22-FEC3-4DB7-B723-A08D5813DD73}"="{A6B4792D-91F0-4039-82C2-F46264E40C60}"
"{B77BC20C-1E1D-40BD-96E3-E0116FE83E03}"="{E48AEBEB-CA2B-4A1C-858C-43F6C0793FAE}"
"{073DBDA7-3F71-43A3-9A1A-095CEC7FFDAE}"="{E48AEBEB-CA2B-4A1C-858C-43F6C0793FAE}"
"{10F797E4-AB13-403E-8283-994913E719D0}"="{44AD37DD-3A5B-4B3E-B8F5-CCA00C0114CB}"
"{590E7D7E-CEA8-4289-9ABD-6585C3C9B30F}"="{44AD37DD-3A5B-4B3E-B8F5-CCA00C0114CB}"
"{EA689F1F-BAC7-4787-932A-0957AB525312}"="{44AD37DD-3A5B-4B3E-B8F5-CCA00C0114CB}"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'Explorer.exe'(4880)
c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
c:\program files\TortoiseSVN\bin\TortoiseStub.dll
c:\program files\TortoiseSVN\bin\TortoiseSVN.dll
c:\program files\TortoiseSVN\bin\intl3_tsvn.dll
c:\users\David Pagini\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
c:\windows\system32\msi.dll
.
Completion time: 2010-09-29 15:21:51
ComboFix-quarantined-files.txt 2010-09-29 19:21
ComboFix2.txt 2010-09-29 01:40
ComboFix3.txt 2009-02-03 04:53

Pre-Run: 56,217,260,032 bytes free
Post-Run: 56,157,806,592 bytes free

- - End Of File - - 3620AAD9893FC398BF71B0D599E587E3




MBAM

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4717

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

9/29/2010 3:53:45 PM
mbam-log-2010-09-29 (15-53-45).txt

Scan type: Quick scan
Objects scanned: 172684
Time elapsed: 6 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
Post #8
I need you to run the following scan: Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.



Also please tell me how the computer is running now.
Post #9
Definitely appears to be running better… Here is the log: ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=f2234ac2e19e9643b45d2b582cd39bec # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2010-09-30 03:08:46 # local_time=2010-09-29 11:08:46 (-0500, Eastern Daylight Time) # country="United States" # lang=1033 # osver=6.1.7600 NT # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=5893 16776574 100 85 37340968 37354768 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=368642 # found=2 # cleaned=0 # scan_time=6170 C:\Users\David Pagini\E-Books\Sort\82 Rare but Easy Magic Tricks\Magic Tricks\Mentalist Tricks.exe probably a variant of Win32/Agent.FTBFDEW trojan 00000000000000000000000000000000 I C:\Users\David Pagini\E-Books\Sort\Magic Tricks\Mentalist Tricks.exe probably a variant of Win32/Agent.FTBFDEW trojan 00000000000000000000000000000000 I
Post #10
Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:Files
C:\Users\David Pagini\E-Books\Sort\82 Rare but Easy Magic Tricks\Magic Tricks\Mentalist Tricks.exe 
C:\Users\David Pagini\E-Books\Sort\Magic Tricks\Mentalist Tricks.exe 

:Commands
[emptytemp]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log
Post #11
All processes killed ========== SERVICES/DRIVERS ========== ========== FILES ========== C:\Users\David Pagini\E-Books\Sort\82 Rare but Easy Magic Tricks\Magic Tricks\Mentalist Tricks.exe moved successfully. C:\Users\David Pagini\E-Books\Sort\Magic Tricks\Mentalist Tricks.exe moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: David Pagini ->Temp folder emptied: 1888 bytes ->Temporary Internet Files folder emptied: 2335151 bytes ->Java cache emptied: 535350 bytes ->FireFox cache emptied: 43898547 bytes ->Google Chrome cache emptied: 115830032 bytes ->Apple Safari cache emptied: 25188352 bytes ->Opera cache emptied: 7709412 bytes ->Flash cache emptied: 1027362 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 41044 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Guest ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->FireFox cache emptied: 66238421 bytes ->Apple Safari cache emptied: 11640832 bytes ->Flash cache emptied: 1383 bytes User: Mcx1 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes RecycleBin emptied: 10999399 bytes Total Files Cleaned = 272.00 mb OTL by OldTimer - Version 3.2.14.1 log created on 09302010_140334 Files\Folders moved on Reboot… Registry entries deleted on Reboot… All set? =)
Post #12
You appear clean of infections,please do the following.



ComboFix - Cleanup
Time for some housekeeping
  • Click Start…select Run from the menu.
  • Copy and paste the following into the text entry box:
    Combofix /Uninstall
  • Click the OK button. (See image below as reference.)
🖼Click to load external image (Posted Image)








Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.







[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 21 and save it to your desktop.
  • Scroll down to where it says JDK 6 Update 21 (JDK or JRE)
  • Click the Download JRE button to the right
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u21 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u21-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.







Here are some recommendations to help you stay clean.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/



Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.

please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:
  • Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.


Thats it you are good to go.Safe surfing

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI