What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

windows Services not starting, possible infection, already ran Spybot

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:19:53 PM, on 1/11/2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Creative\MediaSource5\CTDetctu.exe
C:\Program Files (x86)\Creative\MediaSource5\MtdAcqu.exe
C:\Windows\SysWOW64\CtHelper.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe
C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Users\Owner\Downloads\8f8x3dbk.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyBa.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyBa.dll
O4 - HKLM\..\Run: [AsioThk32Reg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32 /S CTASIO.DLL
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [BCU] "C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe"
O4 - HKLM\..\Run: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
O4 - HKLM\..\Run: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files (x86)\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [Creative Detector U] "C:\Program Files (x86)\Creative\MediaSource5\CTDetctu.exe" /R
O4 - HKCU\..\Run: [MtdAcqu] "C:\Program Files (x86)\Creative\MediaSource5\MtdAcqu.exe" /s
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O15 - Trusted Zone: *.clonewarsadventures.com
O15 - Trusted Zone: *.freerealms.com
O15 - Trusted Zone: *.soe.com
O15 - Trusted Zone: *.sony.com
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://ccfiles.creative.com/Web/softwareup…101/CTSUEng.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareup…13/CTPIDPDE.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareup…15113/CTPID.cab
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Browser Configuration Utility Service (BCUService) - DeviceVM, Inc. - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - C:\Program Files (x86)\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: JMB36X - Unknown owner - C:\Windows\SysWOW64\XSrvSetup.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\SysWOW64\IoctlSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Virtual Disk (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 10800 bytes
Post #2
Hi stevencomerthornley,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Unfortunately HJT doesn't play nice with the newer operating systems. I'm going to need a different log.

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.
Post #3
Thank you TomK, I've done as you've instructed. I've run a few antivirus and antimalware programs from the download section of the forums since I posted, but I'm not sure if I'm safe or not. Thanks for taking a look. DDS (Ver_10-12-12.02) - NTFS_AMD64 Run by [removed] at 15:29:30.90 on Sat 01/15/2011 Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_23 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.12286.10116 [GMT -5:00] AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\SysWOW64\XSrvSetup.exe C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe C:\Windows\SysWOW64\IoctlSvc.exe C:\Windows\SysWOW64\PnkBstrA.exe C:\Windows\System32\vds.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe C:\Windows\system32\conhost.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\System32\svchost.exe -k secsvcs C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\atieclxx.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskhost.exe C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Program Files (x86)\Creative\MediaSource5\CTDetctu.exe C:\Program Files (x86)\Creative\MediaSource5\MtdAcqu.exe C:\Windows\SysWOW64\CtHelper.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\svchost.exe -k SDRSVC C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files (x86)\Steam\Steam.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe c:\program files (x86)\steam\steamapps\common\chronicles of riddick - assault on dark athena\System\Win32_x86\DarkAthena.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\Owner\Downloads\dds.scr C:\Windows\system32\conhost.exe ============== Pseudo HJT Report =============== uSearch Bar = Preserve mURLSearchHooks: myBabylon English Toolbar: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyBa.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: myBabylon English Toolbar: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyBa.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: myBabylon English Toolbar: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyBa.dll uRun: [igndlm.exe] C:\Program Files (x86)\Download Manager\DLM.exe /windowsstart /startifwork uRun: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent uRun: [Creative Detector U] "C:\Program Files (x86)\Creative\MediaSource5\CTDetctu.exe" /R uRun: [MtdAcqu] "C:\Program Files (x86)\Creative\MediaSource5\MtdAcqu.exe" /s mRun: [AsioThk32Reg] REGSVR32.EXE /S CTASIO.DLL mRun: [CTHelper] CTHELPER.EXE mRun: [AsioReg] REGSVR32 /S CTASIO.DLL mRun: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min mRun: [BCU] "C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" mRun: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll Trusted Zone: clonewarsadventures.com Trusted Zone: freerealms.com Trusted Zone: soe.com Trusted Zone: sony.com DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPID.cab Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll TB-X64: {B2E293EE-FD7E-4C71-A714-5F4750D8D7B7} - No File mRun-x64: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s mRun-x64: [AsioReg] REGSVR32.EXE /S CTASIO.DLL mRun-x64: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming Hosts: 127.0.0.1 www.spywareinfo.com ================= FIREFOX =================== FF - ProfilePath - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\8byx5juw.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/ FF - plugin: C:\Program Files (x86)\Download Manager\npfpdlm.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll FF - plugin: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\8byx5juw.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npBP4FUpdater.dll FF - plugin: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\8byx5juw.default\extensions\[removed]\plugins\npRACtrl.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} FF - Ext: Delicious Bookmarks: {2fa4ed95-0317-4c6a-a74c-5f3e3912c1f9} - %profile%\extensions\{2fa4ed95-0317-4c6a-a74c-5f3e3912c1f9} FF - Ext: LogMeIn, Inc. Remote Access Plugin: [removed] - %profile%\extensions\[removed] FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} FF - Ext: Digsby Donates: {cbafdacb-a320-4294-9516-494f93d5d1b3} - %profile%\extensions\{cbafdacb-a320-4294-9516-494f93d5d1b3} FF - Ext: Battlefield Play4Free: [removed] - %profile%\extensions\[removed] ============= SERVICES / DRIVERS =============== R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-12-15 203776] R2 AntiVirService;Avira AntiVir Guard;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2010-5-25 267944] R2 avgntflt;avgntflt;C:\Windows\System32\drivers\avgntflt.sys [2010-5-25 83120] R2 BCUService;Browser Configuration Utility Service;C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2010-5-25 219360] R2 JMB36X;JMB36X;C:\Windows\SysWOW64\XSrvSetup.exe [2010-5-25 65536] R2 RtNdPt60;Realtek NDIS Protocol Driver;C:\Windows\System32\drivers\RtNdPt60.sys [2010-5-25 27136] R3 amdkmdag;amdkmdag;C:\Windows\System32\drivers\atikmdag.sys [2010-12-15 8120320] R3 amdkmdap;amdkmdap;C:\Windows\System32\drivers\atikmpag.sys [2010-12-15 289792] R3 AntiVirSchedulerService;Avira AntiVir Scheduler;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2010-5-25 135336] R3 COMMONFX.SYS;COMMONFX.SYS;C:\Windows\System32\drivers\COMMONFX.sys [2010-3-18 158808] R3 CTAUDFX.SYS;CTAUDFX.SYS;C:\Windows\System32\drivers\CTAUDFX.sys [2010-3-18 706648] R3 CTSBLFX.SYS;CTSBLFX.SYS;C:\Windows\System32\drivers\CTSBLFX.sys [2010-3-18 681048] R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2010-11-18 80384] R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2010-11-18 181248] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2010-10-14 347680] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2010-9-24 116752] S3 COMMONFX;COMMONFX;C:\Windows\System32\drivers\COMMONFX.sys [2010-3-18 158808] S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2010-12-29 79360] S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2010-12-26 79360] S3 CTAUDFX;CTAUDFX;C:\Windows\System32\drivers\CTAUDFX.sys [2010-3-18 706648] S3 CTERFXFX.SYS;CTERFXFX.SYS;C:\Windows\System32\drivers\CTERFXFX.sys [2010-3-18 141912] S3 CTERFXFX;CTERFXFX;C:\Windows\System32\drivers\CTERFXFX.sys [2010-3-18 141912] S3 CTSBLFX;CTSBLFX;C:\Windows\System32\drivers\CTSBLFX.sys [2010-3-18 681048] S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe [2009-12-15 25832] S3 etdrv;etdrv;C:\Windows\etdrv.sys [2010-10-14 25640] S3 GVTDrv64;GVTDrv64;C:\Windows\GVTDrv64.sys [2010-10-14 30528] S3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);C:\Windows\System32\drivers\RtVlan60.sys [2010-5-25 24064] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-5-26 1255736] =============== Created Last 30 ================ 2011-01-15 20:25:29 ——– d—–w- C:\Users\Owner\AppData\Roaming\Atari 2011-01-15 20:25:29 ——– d—–w- C:\Users\Owner\AppData\Local\Atari 2011-01-15 20:22:08 ——– d—–w- C:\PROGRA~3\Tages 2011-01-15 20:22:03 314016 —-a-w- C:\Windows\System32\drivers\atksgt.sys 2011-01-15 20:22:02 43680 —-a-w- C:\Windows\System32\drivers\lirsgt.sys 2011-01-15 20:21:38 74576 —-a-w- C:\Windows\System32\XAPOFX1_2.dll 2011-01-15 20:21:38 70992 —-a-w- C:\Windows\SysWow64\XAPOFX1_2.dll 2011-01-15 11:27:17 8199504 —-a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{7DF02E5A-5894-40BA-88AD-60601D15825C}\mpengine.dll 2011-01-13 04:09:51 ——– d—–w- C:\Windows\SysWow64\wbem\lt-LT 2011-01-13 04:09:51 ——– d—–w- C:\Windows\SysWow64\drivers\lt-LT 2011-01-13 04:09:51 ——– d—–w- C:\Windows\lt-LT 2011-01-13 04:09:50 ——– d—–w- C:\Windows\System32\drivers\lt-LT 2011-01-13 04:09:48 ——– d—–w- C:\Windows\System32\wbem\lt-LT 2011-01-13 04:05:43 3584 —-a-w- C:\Windows\System32\drivers\lt-LT\portcls.sys.mui 2011-01-13 04:05:40 2560 —-a-w- C:\Windows\System32\drivers\lt-LT\serscan.sys.mui 2011-01-13 04:05:37 3072 —-a-w- C:\Windows\System32\drivers\lt-LT\ataport.sys.mui 2011-01-13 04:05:37 2048 —-a-w- C:\Windows\System32\drivers\lt-LT\amdide.sys.mui 2011-01-13 04:05:33 46080 —-a-w- C:\Windows\System32\drivers\lt-LT\tcpip.sys.mui 2011-01-13 04:05:32 2560 —-a-w- C:\Windows\System32\drivers\lt-LT\scfilter.sys.mui 2011-01-13 04:05:23 3072 —-a-w- C:\Windows\System32\drivers\lt-LT\hidbth.sys.mui 2011-01-13 04:05:22 7168 —-a-w- C:\Windows\System32\drivers\lt-LT\bthport.sys.mui 2011-01-13 04:05:22 2560 —-a-w- C:\Windows\System32\drivers\lt-LT\BTHUSB.SYS.mui 2011-01-13 04:05:22 2048 —-a-w- C:\Windows\System32\drivers\lt-LT\bthenum.sys.mui 2011-01-13 03:15:38 ——– d—–w- C:\Windows\SysWow64\drivers\uk-UA 2011-01-13 03:15:37 ——– d—–w- C:\Windows\uk-UA 2011-01-13 03:15:37 ——– d—–w- C:\Windows\SysWow64\wbem\uk-UA 2011-01-13 03:15:37 ——– d—–w- C:\Windows\System32\drivers\uk-UA 2011-01-13 03:15:36 ——– d—–w- C:\Windows\System32\wbem\uk-UA 2011-01-13 03:12:01 3584 —-a-w- C:\Windows\System32\drivers\uk-UA\portcls.sys.mui 2011-01-13 03:12:01 2560 —-a-w- C:\Windows\System32\drivers\uk-UA\serscan.sys.mui 2011-01-13 03:11:58 3072 —-a-w- C:\Windows\System32\drivers\uk-UA\ataport.sys.mui 2011-01-13 03:11:58 2048 —-a-w- C:\Windows\System32\drivers\uk-UA\amdide.sys.mui 2011-01-13 03:11:57 48640 —-a-w- C:\Windows\System32\drivers\uk-UA\tcpip.sys.mui 2011-01-13 03:11:55 2560 —-a-w- C:\Windows\System32\drivers\uk-UA\scfilter.sys.mui 2011-01-13 03:11:52 7680 —-a-w- C:\Windows\System32\drivers\uk-UA\bthport.sys.mui 2011-01-13 03:11:52 3072 —-a-w- C:\Windows\System32\drivers\uk-UA\hidbth.sys.mui 2011-01-13 03:11:52 2560 —-a-w- C:\Windows\System32\drivers\uk-UA\BTHUSB.SYS.mui 2011-01-13 03:11:52 2048 —-a-w- C:\Windows\System32\drivers\uk-UA\bthenum.sys.mui 2011-01-13 03:10:52 ——– d—–w- C:\Windows\lv-LV 2011-01-13 03:10:50 ——– d—–w- C:\Windows\SysWow64\wbem\lv-LV 2011-01-13 03:10:50 ——– d—–w- C:\Windows\SysWow64\drivers\lv-LV 2011-01-13 03:10:49 ——– d—–w- C:\Windows\System32\wbem\lv-LV 2011-01-13 03:10:49 ——– d—–w- C:\Windows\System32\drivers\lv-LV 2011-01-13 03:07:15 3584 —-a-w- C:\Windows\System32\drivers\lv-LV\portcls.sys.mui 2011-01-13 03:07:15 3072 —-a-w- C:\Windows\System32\drivers\lv-LV\ataport.sys.mui 2011-01-13 03:07:15 2560 —-a-w- C:\Windows\System32\drivers\lv-LV\serscan.sys.mui 2011-01-13 03:07:15 2048 —-a-w- C:\Windows\System32\drivers\lv-LV\amdide.sys.mui 2011-01-13 03:07:14 47616 —-a-w- C:\Windows\System32\drivers\lv-LV\tcpip.sys.mui 2011-01-13 03:07:14 2560 —-a-w- C:\Windows\System32\drivers\lv-LV\scfilter.sys.mui 2011-01-13 03:07:11 7168 —-a-w- C:\Windows\System32\drivers\lv-LV\bthport.sys.mui 2011-01-13 03:07:11 3072 —-a-w- C:\Windows\System32\drivers\lv-LV\hidbth.sys.mui 2011-01-13 03:07:11 2560 —-a-w- C:\Windows\System32\drivers\lv-LV\BTHUSB.SYS.mui 2011-01-13 03:07:11 2048 —-a-w- C:\Windows\System32\drivers\lv-LV\bthenum.sys.mui 2011-01-13 03:05:55 ——– d—–w- C:\Windows\SysWow64\zh-CHT 2011-01-13 03:05:54 ——– d—–w- C:\Windows\SysWow64\drivers\zh-TW 2011-01-13 03:05:53 ——– d—–w- C:\Windows\zh-TW 2011-01-13 03:05:53 ——– d—–w- C:\Windows\SysWow64\wbem\zh-TW 2011-01-13 03:05:53 ——– d—–w- C:\Windows\SysWow64\wbem\zh-HK 2011-01-13 03:05:53 ——– d—–w- C:\Windows\System32\zh-CHT 2011-01-13 03:05:47 ——– d—–w- C:\Windows\System32\drivers\zh-HK 2011-01-13 03:05:47 ——– d—–w- C:\Windows\System32\drivers\UMDF\zh-TW 2011-01-13 03:05:46 ——– d—–w- C:\Windows\System32\wbem\zh-TW 2011-01-13 03:05:46 ——– d—–w- C:\Windows\System32\wbem\zh-HK 2011-01-13 02:59:09 ——– d—–w- C:\Windows\SysWow64\wbem\es-ES 2011-01-13 02:59:09 ——– d—–w- C:\Windows\SysWow64\es 2011-01-13 02:59:09 ——– d—–w- C:\Windows\SysWow64\drivers\UMDF\es-ES 2011-01-13 02:59:09 ——– d—–w- C:\Windows\SysWow64\drivers\es-ES 2011-01-13 02:59:09 ——– d—–w- C:\Windows\SysWow64\0C0A 2011-01-13 02:59:08 ——– d—–w- C:\Windows\System32\es 2011-01-13 02:59:08 ——– d—–w- C:\Windows\System32\drivers\UMDF\es-ES 2011-01-13 02:59:08 ——– d—–w- C:\Windows\System32\0C0A 2011-01-13 02:59:04 ——– d—–w- C:\Windows\System32\wbem\es-ES 2011-01-13 02:59:02 ——– d—–w- C:\Windows\es-ES 2011-01-13 02:54:00 7168 —-a-w- C:\Windows\System32\drivers\UMDF\es-ES\WUDFUsbccidDriver.dll.mui 2011-01-13 02:54:00 4096 —-a-w- C:\Windows\System32\drivers\es-ES\vhdmp.sys.mui 2011-01-13 02:54:00 4096 —-a-w- C:\Windows\System32\drivers\es-ES\tpm.sys.mui 2011-01-13 02:54:00 4096 —-a-w- C:\Windows\System32\drivers\es-ES\pscr.sys.mui 2011-01-13 02:54:00 3584 —-a-w- C:\Windows\System32\drivers\es-ES\portcls.sys.mui 2011-01-13 02:54:00 3072 —-a-w- C:\Windows\System32\drivers\es-ES\umbus.sys.mui 2011-01-13 02:54:00 26112 —-a-w- C:\Windows\System32\drivers\es-ES\volsnap.sys.mui 2011-01-13 02:54:00 2560 —-a-w- C:\Windows\System32\drivers\UMDF\es-ES\WpdMtpDr.dll.mui 2011-01-13 02:54:00 2560 —-a-w- C:\Windows\System32\drivers\es-ES\serscan.sys.mui 2011-01-13 02:54:00 25088 —-a-w- C:\Windows\System32\drivers\es-ES\usbport.sys.mui 2011-01-13 02:54:00 2048 —-a-w- C:\Windows\System32\drivers\es-ES\wd.sys.mui 2011-01-13 02:54:00 11776 —-a-w- C:\Windows\System32\drivers\es-ES\usbhub.sys.mui 2011-01-13 02:52:32 ——– d—–w- C:\Windows\SysWow64\he 2011-01-13 02:52:32 ——– d—–w- C:\Windows\SysWow64\drivers\he-IL 2011-01-13 02:52:31 ——– d—–w- C:\Windows\SysWow64\wbem\he-IL 2011-01-13 02:52:30 ——– d—–w- C:\Windows\System32\wbem\he-IL 2011-01-13 02:52:30 ——– d—–w- C:\Windows\System32\he 2011-01-13 02:52:30 ——– d—–w- C:\Windows\System32\drivers\UMDF\he-IL 2011-01-13 02:52:25 ——– d—–w- C:\Windows\he-IL 2011-01-13 02:46:41 ——– d—–w- C:\Windows\tr-TR 2011-01-13 02:46:36 ——– d—–w- C:\Windows\SysWow64\wbem\tr-TR 2011-01-13 02:46:36 ——– d—–w- C:\Windows\SysWow64\tr 2011-01-13 02:46:36 ——– d—–w- C:\Windows\SysWow64\drivers\tr-TR 2011-01-13 02:46:33 ——– d—–w- C:\Windows\System32\wbem\tr-TR 2011-01-13 02:46:33 ——– d—–w- C:\Windows\System32\tr 2011-01-13 02:46:33 ——– d—–w- C:\Windows\System32\drivers\UMDF\tr-TR 2011-01-13 02:40:41 ——– d—–w- C:\Windows\SysWow64\drivers\ko-KR 2011-01-13 02:40:40 ——– d—–w- C:\Windows\SysWow64\wbem\ko-KR 2011-01-13 02:40:40 ——– d—–w- C:\Windows\SysWow64\ko 2011-01-13 02:40:40 ——– d—–w- C:\Windows\ko-KR 2011-01-13 02:40:39 ——– d—–w- C:\Windows\System32\drivers\UMDF\ko-KR 2011-01-13 02:40:33 ——– d—–w- C:\Windows\System32\wbem\ko-KR 2011-01-13 02:40:33 ——– d—–w- C:\Windows\System32\ko 2011-01-13 02:34:15 ——– d—–w- C:\Windows\SysWow64\drivers\da-DK 2011-01-13 02:34:12 ——– d—–w- C:\Windows\SysWow64\wbem\da-DK 2011-01-13 02:34:12 ——– d—–w- C:\Windows\SysWow64\da 2011-01-13 02:34:12 ——– d—–w- C:\Windows\System32\drivers\UMDF\da-DK 2011-01-13 02:34:12 ——– d—–w- C:\Windows\da-DK 2011-01-13 02:34:06 ——– d—–w- C:\Windows\System32\da 2011-01-13 02:34:05 ——– d—–w- C:\Windows\System32\wbem\da-DK 2011-01-13 02:28:43 ——– d—–w- C:\Windows\pt-PT 2011-01-13 02:28:42 ——– d—–w- C:\Windows\SysWow64\wbem\pt-PT 2011-01-13 02:28:42 ——– d—–w- C:\Windows\SysWow64\pt 2011-01-13 02:28:42 ——– d—–w- C:\Windows\SysWow64\drivers\pt-PT 2011-01-13 02:28:37 ——– d—–w- C:\Windows\System32\drivers\UMDF\pt-PT 2011-01-13 02:28:36 ——– d—–w- C:\Windows\System32\wbem\pt-PT 2011-01-13 02:28:36 ——– d—–w- C:\Windows\System32\pt 2011-01-13 02:22:22 ——– d—–w- C:\Windows\SysWow64\wbem\et-EE 2011-01-13 02:22:22 ——– d—–w- C:\Windows\SysWow64\drivers\et-EE 2011-01-13 02:22:21 ——– d—–w- C:\Windows\System32\wbem\et-EE 2011-01-13 02:22:21 ——– d—–w- C:\Windows\System32\drivers\et-EE 2011-01-13 02:22:20 ——– d—–w- C:\Windows\et-EE 2011-01-13 02:18:51 3584 —-a-w- C:\Windows\System32\drivers\et-EE\portcls.sys.mui 2011-01-13 02:18:51 2560 —-a-w- C:\Windows\System32\drivers\et-EE\serscan.sys.mui 2011-01-13 02:18:50 3072 —-a-w- C:\Windows\System32\drivers\et-EE\ataport.sys.mui 2011-01-13 02:18:50 2048 —-a-w- C:\Windows\System32\drivers\et-EE\amdide.sys.mui 2011-01-13 02:18:33 45568 —-a-w- C:\Windows\System32\drivers\et-EE\tcpip.sys.mui 2011-01-13 02:18:31 2560 —-a-w- C:\Windows\System32\drivers\et-EE\scfilter.sys.mui 2011-01-13 02:18:25 7168 —-a-w- C:\Windows\System32\drivers\et-EE\bthport.sys.mui 2011-01-13 02:18:25 3072 —-a-w- C:\Windows\System32\drivers\et-EE\hidbth.sys.mui 2011-01-13 02:18:25 2560 —-a-w- C:\Windows\System32\drivers\et-EE\BTHUSB.SYS.mui 2011-01-13 02:18:25 2048 —-a-w- C:\Windows\System32\drivers\et-EE\bthenum.sys.mui 2011-01-13 02:17:30 ——– d—–w- C:\Windows\SysWow64\drivers\bg-BG 2011-01-13 02:17:28 ——– d—–w- C:\Windows\SysWow64\wbem\bg-BG 2011-01-13 02:17:28 ——– d—–w- C:\Windows\System32\drivers\bg-BG 2011-01-13 02:17:28 ——– d—–w- C:\Windows\bg-BG 2011-01-13 02:17:27 ——– d—–w- C:\Windows\System32\wbem\bg-BG 2011-01-13 02:13:42 3584 —-a-w- C:\Windows\System32\drivers\bg-BG\portcls.sys.mui 2011-01-13 02:13:42 2560 —-a-w- C:\Windows\System32\drivers\bg-BG\serscan.sys.mui 2011-01-13 02:13:38 3072 —-a-w- C:\Windows\System32\drivers\bg-BG\ataport.sys.mui 2011-01-13 02:13:38 2048 —-a-w- C:\Windows\System32\drivers\bg-BG\amdide.sys.mui 2011-01-13 02:13:36 48128 —-a-w- C:\Windows\System32\drivers\bg-BG\tcpip.sys.mui 2011-01-13 02:13:27 2560 —-a-w- C:\Windows\System32\drivers\bg-BG\scfilter.sys.mui 2011-01-13 02:13:14 7680 —-a-w- C:\Windows\System32\drivers\bg-BG\bthport.sys.mui 2011-01-13 02:13:14 3072 —-a-w- C:\Windows\System32\drivers\bg-BG\hidbth.sys.mui 2011-01-13 02:13:14 2560 —-a-w- C:\Windows\System32\drivers\bg-BG\BTHUSB.SYS.mui 2011-01-13 02:13:14 2048 —-a-w- C:\Windows\System32\drivers\bg-BG\bthenum.sys.mui 2011-01-13 02:11:58 ——– d—–w- C:\Windows\SysWow64\zh-CHS 2011-01-13 02:11:58 ——– d—–w- C:\Windows\SysWow64\drivers\zh-CN 2011-01-13 02:11:57 ——– d—–w- C:\Windows\SysWow64\wbem\zh-CN 2011-01-13 02:11:54 ——– d—–w- C:\Windows\System32\zh-CHS 2011-01-13 02:11:54 ——– d—–w- C:\Windows\System32\drivers\UMDF\zh-CN 2011-01-13 02:11:50 ——– d—–w- C:\Windows\System32\wbem\zh-CN 2011-01-13 02:11:46 ——– d—–w- C:\Windows\zh-CN 2011-01-13 02:05:58 3584 —-a-w- C:\Windows\System32\drivers\zh-CN\rdbss.sys.mui 2011-01-13 02:04:43 ——– d—–w- C:\Windows\SysWow64\nl 2011-01-13 02:04:43 ——– d—–w- C:\Windows\SysWow64\0413 2011-01-13 02:04:43 ——– d—–w- C:\Windows\nl-NL 2011-01-13 02:04:42 ——– d—–w- C:\Windows\SysWow64\wbem\nl-NL 2011-01-13 02:04:42 ——– d—–w- C:\Windows\SysWow64\drivers\UMDF\nl-NL 2011-01-13 02:04:42 ——– d—–w- C:\Windows\SysWow64\drivers\nl-NL 2011-01-13 02:04:41 ——– d—–w- C:\Windows\System32\nl 2011-01-13 02:04:41 ——– d—–w- C:\Windows\System32\0413 2011-01-13 02:04:40 ——– d—–w- C:\Windows\System32\drivers\UMDF\nl-NL 2011-01-13 02:04:37 ——– d—–w- C:\Windows\System32\wbem\nl-NL 2011-01-13 01:59:53 ——– d—–w- C:\Windows\SysWow64\wbem\sv-SE 2011-01-13 01:59:53 ——– d—–w- C:\Windows\SysWow64\sv 2011-01-13 01:59:53 ——– d—–w- C:\Windows\SysWow64\drivers\sv-SE 2011-01-13 01:59:49 ——– d—–w- C:\Windows\System32\wbem\sv-SE 2011-01-13 01:59:49 ——– d—–w- C:\Windows\System32\sv 2011-01-13 01:59:49 ——– d—–w- C:\Windows\System32\drivers\UMDF\sv-SE 2011-01-13 01:59:47 ——– d—–w- C:\Windows\sv-SE 2011-01-13 01:55:10 ——– d—–w- C:\Windows\de-DE 2011-01-13 01:55:09 ——– d—–w- C:\Windows\SysWow64\wbem\de-DE 2011-01-13 01:55:09 ——– d—–w- C:\Windows\SysWow64\drivers\UMDF\de-DE 2011-01-13 01:55:09 ——– d—–w- C:\Windows\SysWow64\drivers\de-DE 2011-01-13 01:55:09 ——– d—–w- C:\Windows\SysWow64\de 2011-01-13 01:55:09 ——– d—–w- C:\Windows\SysWow64\0407 2011-01-13 01:55:06 ——– d—–w- C:\Windows\System32\0407 2011-01-13 01:55:05 ——– d—–w- C:\Windows\System32\drivers\UMDF\de-DE 2011-01-13 01:55:05 ——– d—–w- C:\Windows\System32\de 2011-01-13 01:55:04 ——– d—–w- C:\Windows\System32\wbem\de-DE 2011-01-13 01:50:16 ——– d—–w- C:\Windows\SysWow64\cs 2011-01-13 01:50:14 ——– d—–w- C:\Windows\SysWow64\wbem\cs-CZ 2011-01-13 01:50:14 ——– d—–w- C:\Windows\SysWow64\drivers\cs-CZ 2011-01-13 01:50:14 ——– d—–w- C:\Windows\cs-CZ 2011-01-13 01:50:10 ——– d—–w- C:\Windows\System32\cs 2011-01-13 01:50:05 ——– d—–w- C:\Windows\System32\wbem\cs-CZ 2011-01-13 01:50:05 ——– d—–w- C:\Windows\System32\drivers\UMDF\cs-CZ 2011-01-13 01:42:57 ——– d—–w- C:\Windows\SysWow64\drivers\hr-HR 2011-01-13 01:42:56 ——– d—–w- C:\Windows\SysWow64\wbem\hr-HR 2011-01-13 01:42:56 ——– d—–w- C:\Windows\System32\drivers\hr-HR 2011-01-13 01:42:56 ——– d—–w- C:\Windows\hr-HR 2011-01-13 01:42:55 ——– d—–w- C:\Windows\System32\wbem\hr-HR 2011-01-13 01:40:07 3584 —-a-w- C:\Windows\System32\drivers\hr-HR\portcls.sys.mui 2011-01-13 01:40:07 2560 —-a-w- C:\Windows\System32\drivers\hr-HR\serscan.sys.mui 2011-01-13 01:40:04 3072 —-a-w- C:\Windows\System32\drivers\hr-HR\ataport.sys.mui 2011-01-13 01:40:04 2048 —-a-w- C:\Windows\System32\drivers\hr-HR\amdide.sys.mui 2011-01-13 01:40:03 48128 —-a-w- C:\Windows\System32\drivers\hr-HR\tcpip.sys.mui 2011-01-13 01:40:02 2560 —-a-w- C:\Windows\System32\drivers\hr-HR\scfilter.sys.mui 2011-01-13 01:39:58 7680 —-a-w- C:\Windows\System32\drivers\hr-HR\bthport.sys.mui 2011-01-13 01:39:58 3072 —-a-w- C:\Windows\System32\drivers\hr-HR\hidbth.sys.mui 2011-01-13 01:39:58 2560 —-a-w- C:\Windows\System32\drivers\hr-HR\BTHUSB.SYS.mui 2011-01-13 01:39:58 2048 —-a-w- C:\Windows\System32\drivers\hr-HR\bthenum.sys.mui 2011-01-13 01:38:54 ——– d—–w- C:\Windows\SysWow64\ru 2011-01-13 01:38:54 ——– d—–w- C:\Windows\SysWow64\drivers\ru-RU 2011-01-13 01:38:53 ——– d—–w- C:\Windows\SysWow64\wbem\ru-RU 2011-01-13 01:38:50 ——– d—–w- C:\Windows\System32\drivers\UMDF\ru-RU 2011-01-13 01:38:47 ——– d—–w- C:\Windows\System32\wbem\ru-RU 2011-01-13 01:38:47 ——– d—–w- C:\Windows\System32\ru 2011-01-13 01:38:44 ——– d—–w- C:\Windows\ru-RU 2011-01-13 01:34:17 ——– d—–w- C:\Windows\it-IT 2011-01-13 01:34:15 ——– d—–w- C:\Windows\SysWow64\wbem\it-IT 2011-01-13 01:34:15 ——– d—–w- C:\Windows\SysWow64\it 2011-01-13 01:34:15 ——– d—–w- C:\Windows\SysWow64\drivers\UMDF\it-IT 2011-01-13 01:34:15 ——– d—–w- C:\Windows\SysWow64\drivers\it-IT 2011-01-13 01:34:15 ——– d—–w- C:\Windows\SysWow64\0410 2011-01-13 01:34:12 ——– d—–w- C:\Windows\System32\drivers\UMDF\it-IT 2011-01-13 01:34:12 ——– d—–w- C:\Windows\System32\0410 2011-01-13 01:34:09 ——– d—–w- C:\Windows\System32\wbem\it-IT 2011-01-13 01:34:09 ——– d—–w- C:\Windows\System32\it 2011-01-13 01:29:23 ——– d—–w- C:\Windows\ja-JP 2011-01-13 01:29:20 ——– d—–w- C:\Windows\SysWow64\wbem\ja-JP 2011-01-13 01:29:20 ——– d—–w- C:\Windows\SysWow64\ja 2011-01-13 01:29:20 ——– d—–w- C:\Windows\SysWow64\drivers\UMDF\ja-JP 2011-01-13 01:29:20 ——– d—–w- C:\Windows\SysWow64\drivers\ja-JP 2011-01-13 01:29:20 ——– d—–w- C:\Windows\SysWow64\0411 2011-01-13 01:29:17 ——– d—–w- C:\Windows\System32\ja 2011-01-13 01:29:17 ——– d—–w- C:\Windows\System32\drivers\UMDF\ja-JP 2011-01-13 01:29:17 ——– d—–w- C:\Windows\System32\0411 2011-01-13 01:29:14 ——– d—–w- C:\Windows\System32\wbem\ja-JP 2011-01-13 01:26:00 9728 —-a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\dicjp.dll 2011-01-13 01:26:00 377856 —-a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwjpn.dll 2011-01-13 01:26:00 1179136 —-a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\imjplm.dll 2011-01-13 01:26:00 11507712 —-a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwjpnr.dll 2011-01-13 01:24:37 ——– d—–w- C:\Windows\SysWow64\no 2011-01-13 01:24:37 ——– d—–w- C:\Windows\SysWow64\drivers\nb-NO 2011-01-13 01:24:34 ——– d—–w- C:\Windows\SysWow64\wbem\nb-NO 2011-01-13 01:24:34 ——– d—–w- C:\Windows\System32\no 2011-01-13 01:24:34 ——– d—–w- C:\Windows\System32\drivers\UMDF\nb-NO 2011-01-13 01:24:34 ——– d—–w- C:\Windows\nb-NO 2011-01-13 01:24:26 ——– d—–w- C:\Windows\System32\wbem\nb-NO 2011-01-13 01:20:33 ——– d—–w- C:\Windows\el-GR 2011-01-13 01:20:28 ——– d—–w- C:\Windows\SysWow64\wbem\el-GR 2011-01-13 01:20:28 ——– d—–w- C:\Windows\SysWow64\el 2011-01-13 01:20:28 ——– d—–w- C:\Windows\SysWow64\drivers\el-GR 2011-01-13 01:20:25 ——– d—–w- C:\Windows\System32\wbem\el-GR 2011-01-13 01:20:25 ——– d—–w- C:\Windows\System32\el 2011-01-13 01:20:25 ——– d—–w- C:\Windows\System32\drivers\UMDF\el-GR 2011-01-13 01:16:29 ——– d—–w- C:\Windows\pt-BR 2011-01-13 01:16:27 ——– d—–w- C:\Windows\SysWow64\wbem\pt-BR 2011-01-13 01:16:27 ——– d—–w- C:\Windows\SysWow64\drivers\pt-BR 2011-01-13 01:16:22 ——– d—–w- C:\Windows\System32\drivers\UMDF\pt-BR 2011-01-13 01:16:20 ——– d—–w- C:\Windows\System32\wbem\pt-BR 2011-01-13 01:12:50 ——– d—–w- C:\Windows\SysWow64\wbem\ro-RO 2011-01-13 01:12:50 ——– d—–w- C:\Windows\SysWow64\drivers\ro-RO 2011-01-13 01:12:50 ——– d—–w- C:\Windows\ro-RO 2011-01-13 01:12:48 ——– d—–w- C:\Windows\System32\wbem\ro-RO 2011-01-13 01:10:43 3584 —-a-w- C:\Windows\System32\drivers\ro-RO\portcls.sys.mui 2011-01-13 01:10:43 2560 —-a-w- C:\Windows\System32\drivers\ro-RO\serscan.sys.mui 2011-01-13 01:10:37 3072 —-a-w- C:\Windows\System32\drivers\ro-RO\ataport.sys.mui 2011-01-13 01:10:37 2048 —-a-w- C:\Windows\System32\drivers\ro-RO\amdide.sys.mui 2011-01-13 01:10:32 47616 —-a-w- C:\Windows\System32\drivers\ro-RO\tcpip.sys.mui 2011-01-13 01:10:32 2560 —-a-w- C:\Windows\System32\drivers\ro-RO\scfilter.sys.mui 2011-01-13 01:10:28 8192 —-a-w- C:\Windows\System32\drivers\ro-RO\bthport.sys.mui 2011-01-13 01:10:28 3072 —-a-w- C:\Windows\System32\drivers\ro-RO\hidbth.sys.mui 2011-01-13 01:10:28 2560 —-a-w- C:\Windows\System32\drivers\ro-RO\BTHUSB.SYS.mui 2011-01-13 01:10:28 2048 —-a-w- C:\Windows\System32\drivers\ro-RO\bthenum.sys.mui 2011-01-13 01:09:30 ——– d—–w- C:\Windows\SysWow64\drivers\pl-PL 2011-01-13 01:09:27 ——– d—–w- C:\Windows\SysWow64\wbem\pl-PL 2011-01-13 01:09:27 ——– d—–w- C:\Windows\SysWow64\pl 2011-01-13 01:09:26 ——– d—–w- C:\Windows\System32\drivers\UMDF\pl-PL 2011-01-13 01:09:26 ——– d—–w- C:\Windows\pl-PL 2011-01-13 01:09:22 ——– d—–w- C:\Windows\System32\wbem\pl-PL 2011-01-13 01:09:22 ——– d—–w- C:\Windows\System32\pl 2011-01-13 01:03:29 7168 —-a-w- C:\Windows\System32\drivers\UMDF\fr-FR\WUDFUsbccidDriver.dll.mui 2011-01-13 01:02:00 ——– d—–w- C:\Windows\fr-FR 2011-01-13 00:58:41 6144 —-a-w- C:\Windows\System32\drivers\UMDF\ar-SA\WUDFUsbccidDriver.dll.mui 2011-01-13 00:57:58 2560 —-a-w- C:\Windows\System32\drivers\ar-SA\mountmgr.sys.mui 2011-01-13 00:56:48 ——– d—–w- C:\Windows\SysWow64\hu 2011-01-13 00:56:48 ——– d—–w- C:\Windows\SysWow64\drivers\hu-HU 2011-01-13 00:56:45 ——– d—–w- C:\Windows\SysWow64\wbem\hu-HU 2011-01-13 00:56:45 ——– d—–w- C:\Windows\System32\hu 2011-01-13 00:56:45 ——– d—–w- C:\Windows\System32\drivers\UMDF\hu-HU 2011-01-13 00:56:41 ——– d—–w- C:\Windows\System32\wbem\hu-HU 2011-01-13 00:56:39 ——– d—–w- C:\Windows\hu-HU 2011-01-13 00:53:16 ——– d—–w- C:\Windows\SysWow64\wbem\sr-Latn-CS 2011-01-13 00:53:16 ——– d—–w- C:\Windows\SysWow64\drivers\sr-Latn-CS 2011-01-13 00:53:16 ——– d—–w- C:\Windows\sr-Latn-CS 2011-01-13 00:53:14 ——– d—–w- C:\Windows\System32\wbem\sr-Latn-CS 2011-01-13 00:53:14 ——– d—–w- C:\Windows\System32\drivers\sr-Latn-CS 2011-01-13 00:51:05 3584 —-a-w- C:\Windows\System32\drivers\sr-Latn-CS\portcls.sys.mui 2011-01-13 00:51:05 2560 —-a-w- C:\Windows\System32\drivers\sr-Latn-CS\serscan.sys.mui 2011-01-13 00:51:03 3072 —-a-w- C:\Windows\System32\drivers\sr-Latn-CS\ataport.sys.mui 2011-01-13 00:51:03 2048 —-a-w- C:\Windows\System32\drivers\sr-Latn-CS\amdide.sys.mui 2011-01-13 00:51:01 47104 —-a-w- C:\Windows\System32\drivers\sr-Latn-CS\tcpip.sys.mui 2011-01-13 00:51:01 2560 —-a-w- C:\Windows\System32\drivers\sr-Latn-CS\scfilter.sys.mui 2011-01-13 00:50:58 7680 —-a-w- C:\Windows\System32\drivers\sr-Latn-CS\bthport.sys.mui 2011-01-13 00:50:58 3072 —-a-w- C:\Windows\System32\drivers\sr-Latn-CS\hidbth.sys.mui 2011-01-13 00:50:58 2560 —-a-w- C:\Windows\System32\drivers\sr-Latn-CS\BTHUSB.SYS.mui 2011-01-13 00:50:58 2048 —-a-w- C:\Windows\System32\drivers\sr-Latn-CS\bthenum.sys.mui 2011-01-13 00:50:13 ——– d—–w- C:\Windows\SysWow64\wbem\sk-SK 2011-01-13 00:50:13 ——– d—–w- C:\Windows\SysWow64\drivers\sk-SK 2011-01-13 00:50:12 ——– d—–w- C:\Windows\sk-SK 2011-01-13 00:50:11 ——– d—–w- C:\Windows\System32\wbem\sk-SK 2011-01-13 00:50:11 ——– d—–w- C:\Windows\System32\drivers\sk-SK 2011-01-13 00:48:24 3584 —-a-w- C:\Windows\System32\drivers\sk-SK\portcls.sys.mui 2011-01-13 00:48:24 2560 —-a-w- C:\Windows\System32\drivers\sk-SK\serscan.sys.mui 2011-01-13 00:48:22 47616 —-a-w- C:\Windows\System32\drivers\sk-SK\tcpip.sys.mui 2011-01-13 00:48:22 3072 —-a-w- C:\Windows\System32\drivers\sk-SK\ataport.sys.mui 2011-01-13 00:48:22 2048 —-a-w- C:\Windows\System32\drivers\sk-SK\amdide.sys.mui 2011-01-13 00:48:21 2560 —-a-w- C:\Windows\System32\drivers\sk-SK\scfilter.sys.mui 2011-01-13 00:48:17 7680 —-a-w- C:\Windows\System32\drivers\sk-SK\bthport.sys.mui 2011-01-13 00:48:17 3072 —-a-w- C:\Windows\System32\drivers\sk-SK\hidbth.sys.mui 2011-01-13 00:48:17 2560 —-a-w- C:\Windows\System32\drivers\sk-SK\BTHUSB.SYS.mui 2011-01-13 00:48:17 2048 —-a-w- C:\Windows\System32\drivers\sk-SK\bthenum.sys.mui 2011-01-13 00:47:37 ——– d—–w- C:\Windows\SysWow64\wbem\th-TH 2011-01-13 00:47:37 ——– d—–w- C:\Windows\SysWow64\drivers\th-TH 2011-01-13 00:47:34 ——– d—–w- C:\Windows\System32\wbem\th-TH 2011-01-13 00:47:32 ——– d—–w- C:\Windows\th-TH 2011-01-13 00:45:44 3584 —-a-w- C:\Windows\System32\drivers\th-TH\portcls.sys.mui 2011-01-13 00:45:44 3072 —-a-w- C:\Windows\System32\drivers\th-TH\ataport.sys.mui 2011-01-13 00:45:44 2560 —-a-w- C:\Windows\System32\drivers\th-TH\serscan.sys.mui 2011-01-13 00:45:44 2048 —-a-w- C:\Windows\System32\drivers\th-TH\amdide.sys.mui 2011-01-13 00:45:39 46592 —-a-w- C:\Windows\System32\drivers\th-TH\tcpip.sys.mui 2011-01-13 00:45:32 2560 —-a-w- C:\Windows\System32\drivers\th-TH\scfilter.sys.mui 2011-01-13 00:45:09 7168 —-a-w- C:\Windows\System32\drivers\th-TH\bthport.sys.mui 2011-01-13 00:45:09 3072 —-a-w- C:\Windows\System32\drivers\th-TH\hidbth.sys.mui 2011-01-13 00:45:09 2560 —-a-w- C:\Windows\System32\drivers\th-TH\BTHUSB.SYS.mui 2011-01-13 00:45:09 2048 —-a-w- C:\Windows\System32\drivers\th-TH\bthenum.sys.mui 2011-01-13 00:44:09 ——– d—–w- C:\Windows\fi-FI 2011-01-13 00:44:02 ——– d—–w- C:\Windows\SysWow64\XPSViewer 2011-01-13 00:44:02 ——– d—–w- C:\Windows\SysWow64\wbem\fi-FI 2011-01-13 00:44:02 ——– d—–w- C:\Windows\SysWow64\fi 2011-01-13 00:44:02 ——– d—–w- C:\Windows\SysWow64\drivers\fi-FI 2011-01-13 00:43:53 ——– d—–w- C:\Windows\System32\fi 2011-01-13 00:43:53 ——– d—–w- C:\Windows\System32\drivers\UMDF\fi-FI 2011-01-13 00:43:51 ——– d—–w- C:\Windows\System32\wbem\fi-FI 2011-01-12 23:13:21 ——– d—–w- C:\$WINDOWS.~BT 2011-01-12 02:54:11 ——– d—–w- C:\Program Files\CCleaner 2011-01-12 02:40:17 ——– d—–w- C:\PROGRA~3\PC Tools 2011-01-12 02:15:42 ——– d—–w- C:\PROGRA~3\SUPERAntiSpyware.com 2011-01-12 02:15:37 ——– d—–w- C:\Program Files\SUPERAntiSpyware 2011-01-12 02:14:08 118784 —-a-w- C:\Windows\SysWow64\MSSTDFMT.DLL 2011-01-12 02:11:48 ——– d—–w- C:\PROGRA~3\IObit 2011-01-12 02:11:46 ——– d—–w- C:\Program Files (x86)\IObit 2011-01-12 01:46:55 ——– d—–w- C:\Users\Owner\AppData\Roaming\Malwarebytes 2011-01-12 01:46:51 38224 —-a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys 2011-01-12 01:46:50 ——– d—–w- C:\PROGRA~3\Malwarebytes 2011-01-12 01:46:47 24152 —-a-w- C:\Windows\System32\drivers\mbam.sys 2011-01-12 01:46:47 ——– d—–w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2011-01-12 01:18:12 388096 —-a-r- C:\Users\Owner\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2011-01-12 00:58:18 ——– d—–w- C:\Program Files (x86)\Trend Micro 2011-01-11 23:58:19 16440 —-a-w- C:\Windows\System32\drivers\AtiPcie.sys 2011-01-08 19:12:11 ——– d—–w- C:\Windows\CheckSur 2011-01-08 15:34:25 ——– d—–w- C:\Users\Owner\AppData\Local\{9381B940-03E5-4B0D-B8DE-974EF120C8B0} 2011-01-08 15:34:13 ——– d—–w- C:\Users\Owner\AppData\Roaming\Windows Live Writer 2011-01-08 15:34:13 ——– d—–w- C:\Users\Owner\AppData\Local\Windows Live Writer 2011-01-08 12:09:06 14336 —-a-w- C:\Windows\System32\drivers\sffp_sd.sys 2011-01-08 01:30:01 ——– d—–w- C:\Users\Owner\AppData\Local\{FC506FF8-83B3-47F1-89AC-E5460C2CE00B} 2011-01-08 01:29:49 ——– d—–w- C:\Users\Owner\Tracing 2011-01-08 01:21:00 ——– d—–w- C:\Program Files (x86)\Microsoft 2011-01-02 21:54:26 ——– d—–w- C:\Users\Owner\AppData\Local\{CD3BC428-E177-4748-9F7F-0C1C3678069B} 2011-01-02 21:53:03 ——– d—–w- C:\Windows\en 2011-01-02 21:51:53 ——– d—–w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition 2011-01-02 21:45:43 ——– d—–w- C:\Windows\PCHEALTH 2011-01-02 21:43:57 3860992 —-a-w- C:\Windows\System32\UIRibbon.dll 2011-01-02 21:43:57 2983424 —-a-w- C:\Windows\SysWow64\UIRibbon.dll 2011-01-02 21:43:57 1164800 —-a-w- C:\Windows\SysWow64\UIRibbonRes.dll 2011-01-02 21:43:57 1164800 —-a-w- C:\Windows\System32\UIRibbonRes.dll 2011-01-02 21:40:34 ——– d—–w- C:\Users\Owner\AppData\Local\Windows Live 2011-01-02 21:40:33 ——– d—–w- C:\Program Files (x86)\Common Files\Windows Live 2010-12-30 02:05:38 ——– d—–w- C:\Program Files (x86)\Xiph.Org 2010-12-30 02:04:23 ——– d—–w- C:\Program Files (x86)\FLAC 2010-12-30 01:23:55 ——– d—–w- C:\Program Files\Creative 2010-12-30 00:13:47 ——– d—–w- C:\PROGRA~3\Spybot - Search & Destroy 2010-12-29 04:20:24 137000 —-a-w- C:\Windows\SysWow64\MSMAPI32.OCX 2010-12-29 04:20:24 1071088 —-a-w- C:\Windows\SysWow64\MSCOMCTL.OCX 2010-12-29 04:20:23 23552 —-a-w- C:\Windows\SysWow64\MSMPIDE.DLL 2010-12-29 04:20:23 ——– d—–w- C:\Program Files (x86)\PDFCreator 2010-12-29 04:10:15 670141 —-a-w- C:\Windows\SysWow64\~.tmp 2010-12-29 04:02:44 ——– d—–w- C:\Users\Owner\AppData\Roaming\Nolo 2010-12-29 04:02:43 ——– d—–w- C:\Users\Owner\AppData\Local\Quicken WillMaker Plus 2011 2010-12-29 04:02:34 90112 —-a-w- C:\Windows\unvise32.exe 2010-12-29 04:02:30 ——– d—–w- C:\Program Files (x86)\Quicken WillMaker Plus 2011 2010-12-29 00:05:50 8199504 —-a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll 2010-12-28 04:29:31 311808 —-a-w- C:\Windows\System32\msv1_0.dll 2010-12-28 04:29:31 257024 —-a-w- C:\Windows\SysWow64\msv1_0.dll 2010-12-28 04:20:56 243712 —-a-w- C:\Windows\System32\drivers\ks.sys 2010-12-28 02:50:14 ——– d—–w- C:\Users\Owner\AppData\Local\2DBoy 2010-12-28 02:50:14 ——– d—–w- C:\PROGRA~3\2DBoy 2010-12-28 02:39:52 85504 —-a-w- C:\Windows\SysWow64\secproc_ssp_isv.dll 2010-12-28 02:38:56 340992 —-a-w- C:\Windows\System32\schannel.dll 2010-12-28 02:37:48 516096 —-a-w- C:\Program Files\Windows Mail\wab.exe 2010-12-27 02:49:49 835440 —-a-w- C:\Windows\SysWow64\pbsvc.exe 2010-12-27 01:59:30 ——– d—–w- C:\Windows\Panther 2010-12-27 01:51:26 ——– d–h–w- C:\$WINDOWS.~Q 2010-12-27 01:42:03 ——– d–h–w- C:\$INPLACE.~TR 2010-12-26 23:40:58 ——– d—–w- C:\Program Files (x86)\Common Files\Creative Labs Shared 2010-12-26 23:39:20 99176 —-a-w- C:\Windows\SysWow64\PresentationHostProxy.dll 2010-12-26 23:39:20 49472 —-a-w- C:\Windows\SysWow64\netfxperf.dll 2010-12-26 23:39:20 48960 —-a-w- C:\Windows\System32\netfxperf.dll 2010-12-26 23:39:20 444752 —-a-w- C:\Windows\System32\mscoree.dll 2010-12-26 23:39:20 320352 —-a-w- C:\Windows\System32\PresentationHost.exe 2010-12-26 23:39:20 297808 —-a-w- C:\Windows\SysWow64\mscoree.dll 2010-12-26 23:39:20 295264 —-a-w- C:\Windows\SysWow64\PresentationHost.exe 2010-12-26 23:39:20 1942856 —-a-w- C:\Windows\System32\dfshim.dll 2010-12-26 23:39:20 1130824 —-a-w- C:\Windows\SysWow64\dfshim.dll 2010-12-26 23:39:20 109912 —-a-w- C:\Windows\System32\PresentationHostProxy.dll 2010-12-26 23:38:10 220672 —-a-w- C:\Windows\System32\wintrust.dll 2010-12-26 23:38:10 172032 —-a-w- C:\Windows\SysWow64\wintrust.dll 2010-12-26 23:38:10 139264 —-a-w- C:\Windows\System32\cabview.dll 2010-12-26 23:38:10 132608 —-a-w- C:\Windows\SysWow64\cabview.dll 2010-12-26 23:03:17 466456 —-a-w- C:\Windows\System32\wrap_oal.dll 2010-12-26 23:03:17 444952 —-a-w- C:\Windows\SysWow64\wrap_oal.dll 2010-12-26 23:03:17 122904 —-a-w- C:\Windows\System32\OpenAL32.dll 2010-12-26 23:03:17 109080 —-a-w- C:\Windows\SysWow64\OpenAL32.dll 2010-12-26 23:03:17 ——– d—–w- C:\Program Files (x86)\OpenAL 2010-12-26 23:03:16 89088 —-a-w- C:\Windows\System32\CmdRtr64.DLL 2010-12-26 23:03:16 73728 —-a-w- C:\Windows\SysWow64\CmdRtr.DLL 2010-12-26 23:03:16 190976 —-a-w- C:\Windows\System32\APOMgr64.DLL 2010-12-26 23:03:16 148480 —-a-w- C:\Windows\SysWow64\APOMngr.DLL 2010-12-26 23:03:02 ——– d—–w- C:\Windows\System32\data 2010-12-26 23:02:45 0 —-a-w- C:\Windows\ativpsrm.bin 2010-12-26 23:01:28 ——– d—–w- C:\Windows\SysWow64\RTCOM 2010-12-26 23:01:28 ——– d—–w- C:\Program Files\Realtek 2010-12-26 21:19:25 10240 —-a-w- C:\Windows\System32\CTDCRES.DLL 2010-12-26 17:38:01 ——– d—–w- C:\Users\Owner\AppData\Local\Futuremark 2010-12-26 01:14:03 ——– d–h–w- C:\Windows\msdownld.tmp 2010-12-23 00:34:55 ——– d—–w- C:\Users\Owner\AppData\Roaming\Braid ==================== Find3M ==================== 2011-01-12 03:09:25 0 —-a-w- C:\Windows\System32\winbio.dll 2011-01-09 02:41:26 270904 —-a-w- C:\Windows\SysWow64\PnkBstrB.xtr 2011-01-09 02:41:26 270904 —-a-w- C:\Windows\SysWow64\PnkBstrB.exe 2011-01-09 02:20:16 270904 —-a-w- C:\Windows\SysWow64\PnkBstrB.ex0 2010-12-27 02:51:33 75136 —-a-w- C:\Windows\SysWow64\PnkBstrA.exe 2010-12-26 23:04:10 18960 —-a-w- C:\Windows\System32\drivers\LNonPnP.sys 2010-12-13 13:40:21 83120 —-a-w- C:\Windows\System32\drivers\avgntflt.sys 2010-11-28 02:51:02 25640 —-a-w- C:\Windows\etdrv.sys 2010-11-28 02:50:36 30528 —-a-w- C:\Windows\GVTDrv64.sys 2010-11-28 02:50:26 25640 —-a-w- C:\Windows\gdrv.sys 2010-11-19 02:34:26 80384 —-a-w- C:\Windows\System32\drivers\nusb3hub.sys 2010-11-19 02:34:26 181248 —-a-w- C:\Windows\System32\drivers\nusb3xhc.sys 2010-11-12 23:53:06 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2010-11-10 07:28:46 301936 —-a-w- C:\Windows\WLXPGSS.SCR 2010-11-04 06:35:53 1194496 —-a-w- C:\Windows\System32\wininet.dll 2010-11-04 06:31:34 57856 —-a-w- C:\Windows\System32\licmgr10.dll 2010-11-04 05:52:17 978944 —-a-w- C:\Windows\SysWow64\wininet.dll 2010-11-04 05:48:36 44544 —-a-w- C:\Windows\SysWow64\licmgr10.dll 2010-11-04 05:16:14 482816 —-a-w- C:\Windows\System32\html.iec 2010-11-04 04:41:26 386048 —-a-w- C:\Windows\SysWow64\html.iec 2010-11-04 04:35:37 1638912 —-a-w- C:\Windows\System32\mshtml.tlb 2010-11-04 04:08:54 1638912 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2010-11-02 05:21:51 982912 —-a-w- C:\Windows\System32\drivers\dxgkrnl.sys 2010-11-02 05:18:59 662528 —-a-w- C:\Windows\System32\XpsPrint.dll 2010-11-02 05:18:59 229888 —-a-w- C:\Windows\System32\XpsRasterService.dll 2010-11-02 05:18:58 470016 —-a-w- C:\Windows\System32\XpsGdiConverter.dll 2010-11-02 05:18:17 524288 —-a-w- C:\Windows\System32\wmicmiplugin.dll 2010-11-02 05:17:38 473600 —-a-w- C:\Windows\System32\taskcomp.dll 2010-11-02 05:17:38 1169408 —-a-w- C:\Windows\System32\taskschd.dll 2010-11-02 05:16:53 1114624 —-a-w- C:\Windows\System32\schedsvc.dll 2010-11-02 05:12:53 1133568 —-a-w- C:\Windows\System32\FntCache.dll 2010-11-02 05:12:25 1540608 —-a-w- C:\Windows\System32\DWrite.dll 2010-11-02 05:12:08 1837568 —-a-w- C:\Windows\System32\d3d10warp.dll 2010-11-02 05:12:07 320512 —-a-w- C:\Windows\System32\d3d10_1core.dll 2010-11-02 05:12:06 902656 —-a-w- C:\Windows\System32\d2d1.dll 2010-11-02 05:12:06 197120 —-a-w- C:\Windows\System32\d3d10_1.dll 2010-11-02 05:10:47 464384 —-a-w- C:\Windows\System32\taskeng.exe 2010-11-02 05:10:32 285696 —-a-w- C:\Windows\System32\schtasks.exe 2010-11-02 04:59:08 144384 —-a-w- C:\Windows\System32\cdd.dll 2010-11-02 04:41:36 442880 —-a-w- C:\Windows\SysWow64\XpsPrint.dll 2010-11-02 04:41:36 283648 —-a-w- C:\Windows\SysWow64\XpsGdiConverter.dll 2010-11-02 04:41:36 135168 —-a-w- C:\Windows\SysWow64\XpsRasterService.dll 2010-11-02 04:40:36 496128 —-a-w- C:\Windows\SysWow64\taskschd.dll 2010-11-02 04:40:36 305152 —-a-w- C:\Windows\SysWow64\taskcomp.dll 2010-11-02 04:35:51 1074176 —-a-w- C:\Windows\SysWow64\DWrite.dll 2010-11-02 04:35:35 1170944 —-a-w- C:\Windows\SysWow64\d3d10warp.dll 2010-11-02 04:35:34 739840 —-a-w- C:\Windows\SysWow64\d2d1.dll 2010-11-02 04:35:34 218624 —-a-w- C:\Windows\SysWow64\d3d10_1core.dll 2010-11-02 04:35:34 161792 —-a-w- C:\Windows\SysWow64\d3d10_1.dll 2010-11-02 04:34:44 192000 —-a-w- C:\Windows\SysWow64\taskeng.exe 2010-11-02 04:34:33 179712 —-a-w- C:\Windows\SysWow64\schtasks.exe 2010-11-02 02:50:58 258048 —-a-w- C:\Windows\System32\drivers\dxgmms1.sys 2010-10-27 05:06:22 2048 —-a-w- C:\Windows\System32\tzres.dll 2010-10-27 04:32:36 2048 —-a-w- C:\Windows\SysWow64\tzres.dll 2010-10-20 05:20:01 46080 —-a-w- C:\Windows\System32\atmlib.dll 2010-10-20 04:54:18 34304 —-a-w- C:\Windows\SysWow64\atmlib.dll 2010-10-20 03:09:15 3124224 —-a-w- C:\Windows\System32\win32k.sys 2010-10-20 03:05:46 367104 —-a-w- C:\Windows\System32\atmfd.dll 2010-10-20 02:58:41 294400 —-a-w- C:\Windows\SysWow64\atmfd.dll 2010-10-19 15:41:44 270720 ——w- C:\Windows\System32\MpSigStub.exe ============= FINISH: 15:31:22.66 ===============

Attachments:

Post #4
stevencomerthornley, 1. Locate your Windows Installation Disc and insert it into your computer. 2. Restart the computer and enter the BIOS to make sure that your DVD/CD drive is at the top of the Boot Order List 3. Save all the settings in the BIOS and restart. 4. When prompted, press any key to boot from the Windows Installation Disc. 5. Select English as your language and click next. 6. Towards the bottom of the next screen, click on "Repair your computer" 7. Select Windows 7 and click next. 8. Select the top option and click next. 9. Select Command Prompt and click next Once you've got Command Prompt running, type in "chkdsk /f" and hit enter. Take a note of the results Then type in "sfc /scannow" and let the test run. Please post the results from both in your next post.
Post #7
stevencomerthornley,

To be honest… the information in cbs.txt means virtually nothing to me… but it might be helpful to the Tech Team… and I'm becoming more convinced that your issue isn't malware related.

Let's see what an online scan can find.

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

  • Please go here then click on: [external image: Posted Image]

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: [external image: Posted Image]
  • The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: [external image: Posted Image]
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
Post #8
ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6419 # api_version=3.0.2 # EOSSerial=bdce76281de5cb49a8c6dd62e4b568d0 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-01-16 11:36:53 # local_time=2011-01-16 06:36:53 (-0500, Eastern Standard Time) # country="United States" # lang=1033 # osver=6.1.7600 NT # compatibility_mode=512 16777215 100 0 335671 335671 0 0 # compatibility_mode=1797 16775165 100 94 0 31619469 0 0 # compatibility_mode=5893 16776573 100 94 0 46755819 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=724725 # found=0 # cleaned=0 # scan_time=8644
Post #9
stevencomerthornley,

I'm not finding any malware… but you have alot of errors in your error log. I suggest that you post in the Windows Forum and see if the Tech Team can help you straighten things out. When you post there… please include a link back to this thread so that they can see the information you've provided here.

But first,

You can delete DDS and HJT.

Be sure any re-enable any security programs that you disabled.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI