What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Infected With URLFRAUDCHECK

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I'll introduce myself when im a bit calmer and yes im newish to computers and the sledgehammer thingy did put a smirk on my face which prob saved this lappy from being smashed to bits courtersy of the WALL. Sunday night i got my first virus and tbh it couldn't have come a worse time workwise and projects, ive been infected with urlfraudcheck and it's making my computer life and search engine hell, now i downloaded stopzilla as it said it gets rid, nope it was back today and ive had to sneak past it somehow to register here, hopefully someone can help, it also doesn't help being on a mobile dongle with a bad reception, HELP! I need the computer back.
Post #2
Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post






Please download TDSSKiller.zip
  • Extract it to your desktop
  • Double click TDSSKiller.exe
  • Press Start Scan
    • Only if Malicious objects are found then ensure Cure is selected
      If suspicious objects are found select skip
    • Then click Continue > Reboot now
  • Copy and paste the log in your next reply
    • A copy of the log will be saved automatically to the root of the drive (typically C:\)











  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under Custom Scan paste this in

    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • You may need two posts to fit them both in.
Post #3
Hello mowman and thanks for the reply and help with the link, just downloaded the tdss killer and one malicious was found and was rebooted, i think this is the log you requested, just going to download the other now. 2011/02/08 20:23:57.0740 6452 TDSS rootkit removing tool 2.4.16.0 Feb 1 2011 10:34:03 2011/02/08 20:23:59.0743 6452 ================================================================================ 2011/02/08 20:23:59.0743 6452 SystemInfo: 2011/02/08 20:23:59.0743 6452 2011/02/08 20:23:59.0743 6452 OS Version: 6.1.7600 ServicePack: 0.0 2011/02/08 20:23:59.0743 6452 Product type: Workstation 2011/02/08 20:23:59.0743 6452 ComputerName: SAMR720 2011/02/08 20:23:59.0743 6452 UserName: steelfix1 2011/02/08 20:23:59.0743 6452 Windows directory: C:\windows 2011/02/08 20:23:59.0744 6452 System windows directory: C:\windows 2011/02/08 20:23:59.0744 6452 Processor architecture: Intel x86 2011/02/08 20:23:59.0744 6452 Number of processors: 2 2011/02/08 20:23:59.0744 6452 Page size: 0x1000 2011/02/08 20:23:59.0744 6452 Boot type: Normal boot 2011/02/08 20:23:59.0744 6452 ================================================================================ 2011/02/08 20:24:00.0224 6452 Initialize success 2011/02/08 20:24:44.0891 6136 ================================================================================ 2011/02/08 20:24:44.0891 6136 Scan started 2011/02/08 20:24:44.0892 6136 Mode: Manual; 2011/02/08 20:24:44.0892 6136 ================================================================================ 2011/02/08 20:24:45.0970 6136 1394ohci (6d2aca41739bfe8cb86ee8e85f29697d) C:\windows\system32\DRIVERS\1394ohci.sys 2011/02/08 20:24:46.0037 6136 ACPI (f0e07d144c8685b8774bc32fc8da4df0) C:\windows\system32\DRIVERS\ACPI.sys 2011/02/08 20:24:46.0096 6136 AcpiPmi (98d81ca942d19f7d9153b095162ac013) C:\windows\system32\DRIVERS\acpipmi.sys 2011/02/08 20:24:46.0173 6136 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\windows\system32\DRIVERS\adp94xx.sys 2011/02/08 20:24:46.0225 6136 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\windows\system32\DRIVERS\adpahci.sys 2011/02/08 20:24:46.0295 6136 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\windows\system32\DRIVERS\adpu320.sys 2011/02/08 20:24:46.0391 6136 AFD (ddc040fdb01ef1712a6b13e52afb104c) C:\windows\system32\drivers\afd.sys 2011/02/08 20:24:46.0508 6136 AgereSoftModem (07758c2196a62f207f77556311e7459a) C:\windows\system32\DRIVERS\AGRSM.sys 2011/02/08 20:24:46.0590 6136 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\windows\system32\DRIVERS\agp440.sys 2011/02/08 20:24:46.0662 6136 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\windows\system32\DRIVERS\djsvs.sys 2011/02/08 20:24:46.0722 6136 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\windows\system32\DRIVERS\aliide.sys 2011/02/08 20:24:46.0800 6136 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\windows\system32\DRIVERS\amdagp.sys 2011/02/08 20:24:46.0841 6136 amdide (cd5914170297126b6266860198d1d4f0) C:\windows\system32\DRIVERS\amdide.sys 2011/02/08 20:24:46.0866 6136 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\windows\system32\DRIVERS\amdk8.sys 2011/02/08 20:24:46.0903 6136 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\windows\system32\DRIVERS\amdppm.sys 2011/02/08 20:24:46.0938 6136 amdsata (2101a86c25c154f8314b24ef49d7fbc2) C:\windows\system32\DRIVERS\amdsata.sys 2011/02/08 20:24:46.0965 6136 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\windows\system32\DRIVERS\amdsbs.sys 2011/02/08 20:24:46.0996 6136 amdxata (b81c2b5616f6420a9941ea093a92b150) C:\windows\system32\DRIVERS\amdxata.sys 2011/02/08 20:24:47.0028 6136 AppID (feb834c02ce1e84b6a38f953ca067706) C:\windows\system32\drivers\appid.sys 2011/02/08 20:24:47.0098 6136 arc (2932004f49677bd84dbc72edb754ffb3) C:\windows\system32\DRIVERS\arc.sys 2011/02/08 20:24:47.0125 6136 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\windows\system32\DRIVERS\arcsas.sys 2011/02/08 20:24:47.0158 6136 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\windows\system32\DRIVERS\asyncmac.sys 2011/02/08 20:24:47.0246 6136 atapi (338c86357871c167a96ab976519bf59e) C:\windows\system32\DRIVERS\atapi.sys 2011/02/08 20:24:47.0386 6136 athr (ac4adac154563ab41cc79b0257bc685a) C:\windows\system32\DRIVERS\athr.sys 2011/02/08 20:24:47.0538 6136 AtiHdmiService (40a07e6916ac098e31a9e39ac202b8a1) C:\windows\system32\drivers\AtiHdmi.sys 2011/02/08 20:24:47.0730 6136 atikmdag (745c79700646c3f285cd09775618a04b) C:\windows\system32\DRIVERS\atikmdag.sys 2011/02/08 20:24:48.0013 6136 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\windows\system32\DRIVERS\bxvbdx.sys 2011/02/08 20:24:48.0081 6136 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\windows\system32\DRIVERS\b57nd60x.sys 2011/02/08 20:24:48.0155 6136 Beep (505506526a9d467307b3c393dedaf858) C:\windows\system32\drivers\Beep.sys 2011/02/08 20:24:48.0206 6136 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\windows\system32\DRIVERS\blbdrive.sys 2011/02/08 20:24:48.0236 6136 bowser (fcafaef6798d7b51ff029f99a9898961) C:\windows\system32\DRIVERS\bowser.sys 2011/02/08 20:24:48.0260 6136 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\windows\system32\DRIVERS\BrFiltLo.sys 2011/02/08 20:24:48.0282 6136 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\windows\system32\DRIVERS\BrFiltUp.sys 2011/02/08 20:24:48.0336 6136 Brserid (845b8ce732e67f3b4133164868c666ea) C:\windows\System32\Drivers\Brserid.sys 2011/02/08 20:24:48.0371 6136 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\windows\System32\Drivers\BrSerWdm.sys 2011/02/08 20:24:48.0390 6136 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\windows\System32\Drivers\BrUsbMdm.sys 2011/02/08 20:24:48.0411 6136 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\windows\System32\Drivers\BrUsbSer.sys 2011/02/08 20:24:48.0461 6136 BthEnum (2865a5c8e98c70c605f417908cebb3a4) C:\windows\system32\DRIVERS\BthEnum.sys 2011/02/08 20:24:48.0493 6136 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\windows\system32\DRIVERS\bthmodem.sys 2011/02/08 20:24:48.0521 6136 BthPan (ad1872e5829e8a2c3b5b4b641c3eab0e) C:\windows\system32\DRIVERS\bthpan.sys 2011/02/08 20:24:48.0578 6136 BTHPORT (4a34888e13224678dd062466afec4240) C:\windows\system32\Drivers\BTHport.sys 2011/02/08 20:24:48.0633 6136 BTHUSB (fa04c63916fa221dbb91fce153d07a55) C:\windows\system32\Drivers\BTHUSB.sys 2011/02/08 20:24:48.0682 6136 btwaudio (d57d29132efe13a83133d9bd449e0cf1) C:\windows\system32\drivers\btwaudio.sys 2011/02/08 20:24:48.0722 6136 btwavdt (d282c14a69357d0e1bafaecc2ca98c3a) C:\windows\system32\DRIVERS\btwavdt.sys 2011/02/08 20:24:48.0751 6136 btwl2cap (aafd7cb76ba61fbb08e302da208c974a) C:\windows\system32\DRIVERS\btwl2cap.sys 2011/02/08 20:24:48.0785 6136 btwrchid (02eb4d2b05967df2d32f29c84ab1fb17) C:\windows\system32\DRIVERS\btwrchid.sys 2011/02/08 20:24:48.0836 6136 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\windows\system32\DRIVERS\cdfs.sys 2011/02/08 20:24:48.0886 6136 cdrom (ba6e70aa0e6091bc39de29477d866a77) C:\windows\system32\DRIVERS\cdrom.sys 2011/02/08 20:24:48.0985 6136 cfwids (7e6f7da1c4de5680820f964562548949) C:\windows\system32\drivers\cfwids.sys 2011/02/08 20:24:49.0028 6136 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\windows\system32\DRIVERS\circlass.sys 2011/02/08 20:24:49.0076 6136 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\windows\system32\CLFS.sys 2011/02/08 20:24:49.0193 6136 CmBatt (dea805815e587dad1dd2c502220b5616) C:\windows\system32\DRIVERS\CmBatt.sys 2011/02/08 20:24:49.0240 6136 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\windows\system32\DRIVERS\cmdide.sys 2011/02/08 20:24:49.0291 6136 CNG (1b675691ed940766149c93e8f4488d68) C:\windows\system32\Drivers\cng.sys 2011/02/08 20:24:49.0387 6136 Compbatt (a6023d3823c37043986713f118a89bee) C:\windows\system32\DRIVERS\compbatt.sys 2011/02/08 20:24:49.0440 6136 CompositeBus (f1724ba27e97d627f808fb0ba77a28a6) C:\windows\system32\DRIVERS\CompositeBus.sys 2011/02/08 20:24:49.0483 6136 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\windows\system32\DRIVERS\crcdisk.sys 2011/02/08 20:24:49.0622 6136 DfsC (8e09e52ee2e3ceb199ef3dd99cf9e3fb) C:\windows\system32\Drivers\dfsc.sys 2011/02/08 20:24:49.0686 6136 discache (1a050b0274bfb3890703d490f330c0da) C:\windows\system32\drivers\discache.sys 2011/02/08 20:24:49.0731 6136 Disk (565003f326f99802e68ca78f2a68e9ff) C:\windows\system32\DRIVERS\disk.sys 2011/02/08 20:24:49.0801 6136 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\windows\system32\drivers\drmkaud.sys 2011/02/08 20:24:49.0855 6136 DXGKrnl (1679a4669326cb1a67cc95658d273234) C:\windows\System32\drivers\dxgkrnl.sys 2011/02/08 20:24:50.0035 6136 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\windows\system32\DRIVERS\evbdx.sys 2011/02/08 20:24:50.0261 6136 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\windows\system32\DRIVERS\elxstor.sys 2011/02/08 20:24:50.0326 6136 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\windows\system32\DRIVERS\errdev.sys 2011/02/08 20:24:50.0410 6136 exfat (2dc9108d74081149cc8b651d3a26207f) C:\windows\system32\drivers\exfat.sys 2011/02/08 20:24:50.0448 6136 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\windows\system32\drivers\fastfat.sys 2011/02/08 20:24:50.0512 6136 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\windows\system32\DRIVERS\fdc.sys 2011/02/08 20:24:50.0562 6136 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\windows\system32\drivers\fileinfo.sys 2011/02/08 20:24:50.0592 6136 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\windows\system32\drivers\filetrace.sys 2011/02/08 20:24:50.0610 6136 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\windows\system32\DRIVERS\flpydisk.sys 2011/02/08 20:24:50.0668 6136 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\windows\system32\drivers\fltmgr.sys 2011/02/08 20:24:50.0718 6136 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\windows\system32\drivers\FsDepends.sys 2011/02/08 20:24:50.0777 6136 fssfltr (d909075fa72c090f27aa926c32cb4612) C:\windows\system32\DRIVERS\fssfltr.sys 2011/02/08 20:24:50.0833 6136 Fs_Rec (a574b4360e438977038aae4bf60d79a2) C:\windows\system32\drivers\Fs_Rec.sys 2011/02/08 20:24:50.0878 6136 fvevol (dafbd9fe39197495aed6d51f3b85b5d2) C:\windows\system32\DRIVERS\fvevol.sys 2011/02/08 20:24:50.0950 6136 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\windows\system32\DRIVERS\gagp30kx.sys 2011/02/08 20:24:51.0018 6136 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\windows\system32\drivers\hcw85cir.sys 2011/02/08 20:24:51.0063 6136 HdAudAddService (3530cad25deba7dc7de8bb51632cbc5f) C:\windows\system32\drivers\HdAudio.sys 2011/02/08 20:24:51.0107 6136 HDAudBus (717a2207fd6f13ad3e664c7d5a43c7bf) C:\windows\system32\DRIVERS\HDAudBus.sys 2011/02/08 20:24:51.0126 6136 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\windows\system32\DRIVERS\HidBatt.sys 2011/02/08 20:24:51.0165 6136 HidBth (89448f40e6df260c206a193a4683ba78) C:\windows\system32\DRIVERS\hidbth.sys 2011/02/08 20:24:51.0200 6136 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\windows\system32\DRIVERS\hidir.sys 2011/02/08 20:24:51.0245 6136 HidUsb (25072fb35ac90b25f9e4e3bacf774102) C:\windows\system32\DRIVERS\hidusb.sys 2011/02/08 20:24:51.0357 6136 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\windows\system32\DRIVERS\HpSAMD.sys 2011/02/08 20:24:51.0428 6136 HTTP (c531c7fd9e8b62021112787c4e2c5a5a) C:\windows\system32\drivers\HTTP.sys 2011/02/08 20:24:51.0482 6136 hwpolicy (8305f33cde89ad6c7a0763ed0b5a8d42) C:\windows\system32\drivers\hwpolicy.sys 2011/02/08 20:24:51.0547 6136 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\windows\system32\DRIVERS\i8042prt.sys 2011/02/08 20:24:51.0588 6136 iaStor (d483687eace0c065ee772481a96e05f5) C:\windows\system32\DRIVERS\iaStor.sys 2011/02/08 20:24:51.0630 6136 iaStorV (934af4d7c5f457b9f0743f4299b77b67) C:\windows\system32\DRIVERS\iaStorV.sys 2011/02/08 20:24:51.0791 6136 igfx (ad626f6964f4d364d226c39e06872dd3) C:\windows\system32\DRIVERS\igdkmd32.sys 2011/02/08 20:24:52.0041 6136 iirsp (4173ff5708f3236cf25195fecd742915) C:\windows\system32\DRIVERS\iirsp.sys 2011/02/08 20:24:52.0205 6136 IntcAzAudAddService (db96b8bd676bb24bd4f1dc53ca1f182c) C:\windows\system32\drivers\RTKVHDA.sys 2011/02/08 20:24:52.0372 6136 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\windows\system32\DRIVERS\intelide.sys 2011/02/08 20:24:52.0436 6136 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\windows\system32\DRIVERS\intelppm.sys 2011/02/08 20:24:52.0498 6136 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\windows\system32\DRIVERS\ipfltdrv.sys 2011/02/08 20:24:52.0551 6136 IPMIDRV (e4454b6c37d7ffd5649611f6496308a7) C:\windows\system32\DRIVERS\IPMIDrv.sys 2011/02/08 20:24:52.0571 6136 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\windows\system32\drivers\ipnat.sys 2011/02/08 20:24:52.0632 6136 IRENUM (42996cff20a3084a56017b7902307e9f) C:\windows\system32\drivers\irenum.sys 2011/02/08 20:24:52.0693 6136 is3srv (8fe4ecc7877fcfe4e59414708898073d) C:\windows\system32\drivers\is3srv.sys 2011/02/08 20:24:52.0722 6136 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\windows\system32\DRIVERS\isapnp.sys 2011/02/08 20:24:52.0753 6136 iScsiPrt (ed46c223ae46c6866ab77cdc41c404b7) C:\windows\system32\DRIVERS\msiscsi.sys 2011/02/08 20:24:52.0813 6136 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\windows\system32\DRIVERS\kbdclass.sys 2011/02/08 20:24:52.0856 6136 kbdhid (3d9f0ebf350edcfd6498057301455964) C:\windows\system32\DRIVERS\kbdhid.sys 2011/02/08 20:24:52.0893 6136 KSecDD (e36a061ec11b373826905b21be10948f) C:\windows\system32\Drivers\ksecdd.sys 2011/02/08 20:24:52.0942 6136 KSecPkg (365c6154bbbc5377173f1ca7bfb6cc59) C:\windows\system32\Drivers\ksecpkg.sys 2011/02/08 20:24:53.0050 6136 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\windows\system32\DRIVERS\lltdio.sys 2011/02/08 20:24:53.0133 6136 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\windows\system32\DRIVERS\lsi_fc.sys 2011/02/08 20:24:53.0168 6136 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\windows\system32\DRIVERS\lsi_sas.sys 2011/02/08 20:24:53.0192 6136 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\windows\system32\DRIVERS\lsi_sas2.sys 2011/02/08 20:24:53.0218 6136 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\windows\system32\DRIVERS\lsi_scsi.sys 2011/02/08 20:24:53.0262 6136 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\windows\system32\drivers\luafv.sys 2011/02/08 20:24:53.0362 6136 massfilter (59a2783aba6019bed0c843c706e10a6a) C:\windows\system32\drivers\massfilter.sys 2011/02/08 20:24:53.0562 6136 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\windows\system32\DRIVERS\megasas.sys 2011/02/08 20:24:53.0635 6136 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\windows\system32\DRIVERS\MegaSR.sys 2011/02/08 20:24:53.0708 6136 mfeapfk (84d59a3eddfb9438fb94f7f80d37859d) C:\windows\system32\drivers\mfeapfk.sys 2011/02/08 20:24:53.0756 6136 mfeavfk (67e961988312b1a28d6f93357b0bf998) C:\windows\system32\drivers\mfeavfk.sys 2011/02/08 20:24:53.0847 6136 mfebopk (19161b1796cf74a6a326abde309062ba) C:\windows\system32\drivers\mfebopk.sys 2011/02/08 20:24:53.0900 6136 mfefirek (d5f89b4934960c70882924d992c6abfc) C:\windows\system32\drivers\mfefirek.sys 2011/02/08 20:24:53.0950 6136 mfehidk (0efab2b91b27543fe589de700de07136) C:\windows\system32\drivers\mfehidk.sys 2011/02/08 20:24:54.0000 6136 mfenlfk (b4022e16569bbd1a85e68e7e78e68880) C:\windows\system32\DRIVERS\mfenlfk.sys 2011/02/08 20:24:54.0056 6136 mferkdet (c9eda1eada2ab6e34cd1a10c3a24ab25) C:\windows\system32\drivers\mferkdet.sys 2011/02/08 20:24:54.0121 6136 mfewfpk (183f32c79d1693170df3baecec611125) C:\windows\system32\drivers\mfewfpk.sys 2011/02/08 20:24:54.0167 6136 Modem (f001861e5700ee84e2d4e52c712f4964) C:\windows\system32\drivers\modem.sys 2011/02/08 20:24:54.0197 6136 monitor (79d10964de86b292320e9dfe02282a23) C:\windows\system32\DRIVERS\monitor.sys 2011/02/08 20:24:54.0242 6136 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\windows\system32\DRIVERS\mouclass.sys 2011/02/08 20:24:54.0276 6136 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\windows\system32\DRIVERS\mouhid.sys 2011/02/08 20:24:54.0305 6136 mountmgr (921c18727c5920d6c0300736646931c2) C:\windows\system32\drivers\mountmgr.sys 2011/02/08 20:24:54.0338 6136 mpio (2af5997438c55fb79d33d015c30e1974) C:\windows\system32\DRIVERS\mpio.sys 2011/02/08 20:24:54.0385 6136 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\windows\system32\drivers\mpsdrv.sys 2011/02/08 20:24:54.0418 6136 MRxDAV (b1be47008d20e43da3adc37c24cdb89d) C:\windows\system32\drivers\mrxdav.sys 2011/02/08 20:24:54.0472 6136 mrxsmb (f1b6aa08497ea86ca6ef6f7a08b0bfb8) C:\windows\system32\DRIVERS\mrxsmb.sys 2011/02/08 20:24:54.0503 6136 mrxsmb10 (5613358b4050f46f5a9832da8050d6e4) C:\windows\system32\DRIVERS\mrxsmb10.sys 2011/02/08 20:24:54.0533 6136 mrxsmb20 (25c9792778d80feb4c8201e62281bfdf) C:\windows\system32\DRIVERS\mrxsmb20.sys 2011/02/08 20:24:54.0585 6136 msahci (4326d168944123f38dd3b2d9c37a0b12) C:\windows\system32\DRIVERS\msahci.sys 2011/02/08 20:24:54.0627 6136 msdsm (455029c7174a2dbb03dba8a0d8bddd9a) C:\windows\system32\DRIVERS\msdsm.sys 2011/02/08 20:24:54.0677 6136 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\windows\system32\drivers\Msfs.sys 2011/02/08 20:24:54.0696 6136 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\windows\System32\drivers\mshidkmdf.sys 2011/02/08 20:24:54.0756 6136 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\windows\system32\DRIVERS\msisadrv.sys 2011/02/08 20:24:54.0821 6136 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\windows\system32\drivers\MSKSSRV.sys 2011/02/08 20:24:54.0861 6136 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\windows\system32\drivers\MSPCLOCK.sys 2011/02/08 20:24:54.0887 6136 MSPQM (f456e973590d663b1073e9c463b40932) C:\windows\system32\drivers\MSPQM.sys 2011/02/08 20:24:54.0932 6136 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\windows\system32\drivers\MsRPC.sys 2011/02/08 20:24:54.0961 6136 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\windows\system32\DRIVERS\mssmbios.sys 2011/02/08 20:24:55.0013 6136 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\windows\system32\drivers\MSTEE.sys 2011/02/08 20:24:55.0032 6136 MTConfig (33599130f44e1f34631cea241de8ac84) C:\windows\system32\DRIVERS\MTConfig.sys 2011/02/08 20:24:55.0063 6136 Mup (159fad02f64e6381758c990f753bcc80) C:\windows\system32\Drivers\mup.sys 2011/02/08 20:24:55.0123 6136 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\windows\system32\DRIVERS\nwifi.sys 2011/02/08 20:24:55.0182 6136 NDIS (23759d175a0a9baaf04d05047bc135a8) C:\windows\system32\drivers\ndis.sys 2011/02/08 20:24:55.0245 6136 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\windows\system32\DRIVERS\ndiscap.sys 2011/02/08 20:24:55.0465 6136 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\windows\system32\DRIVERS\ndistapi.sys 2011/02/08 20:24:55.0510 6136 Ndisuio (b30ae7f2b6d7e343b0df32e6c08fce75) C:\windows\system32\DRIVERS\ndisuio.sys 2011/02/08 20:24:55.0538 6136 NdisWan (267c415eadcbe53c9ca873dee39cf3a4) C:\windows\system32\DRIVERS\ndiswan.sys 2011/02/08 20:24:55.0572 6136 NDProxy (af7e7c63dcef3f8772726f86039d6eb4) C:\windows\system32\drivers\NDProxy.sys 2011/02/08 20:24:55.0612 6136 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\windows\system32\DRIVERS\netbios.sys 2011/02/08 20:24:55.0647 6136 NetBT (dd52a733bf4ca5af84562a5e2f963b91) C:\windows\system32\DRIVERS\netbt.sys 2011/02/08 20:24:55.0737 6136 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\windows\system32\DRIVERS\nfrd960.sys 2011/02/08 20:24:55.0796 6136 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\windows\system32\drivers\Npfs.sys 2011/02/08 20:24:55.0843 6136 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\windows\system32\drivers\nsiproxy.sys 2011/02/08 20:24:55.0901 6136 Ntfs (3795dcd21f740ee799fb7223234215af) C:\windows\system32\drivers\Ntfs.sys 2011/02/08 20:24:55.0967 6136 Null (f9756a98d69098dca8945d62858a812c) C:\windows\system32\drivers\Null.sys 2011/02/08 20:24:55.0995 6136 nvraid (3f3d04b1d08d43c16ea7963954ec768d) C:\windows\system32\DRIVERS\nvraid.sys 2011/02/08 20:24:56.0032 6136 nvstor (c99f251a5de63c6f129cf71933aced0f) C:\windows\system32\DRIVERS\nvstor.sys 2011/02/08 20:24:56.0056 6136 nv_agp (5a0983915f02bae73267cc2a041f717d) C:\windows\system32\DRIVERS\nv_agp.sys 2011/02/08 20:24:56.0106 6136 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\windows\system32\DRIVERS\ohci1394.sys 2011/02/08 20:24:56.0172 6136 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\windows\system32\DRIVERS\parport.sys 2011/02/08 20:24:56.0207 6136 partmgr (ff4218952b51de44fe910953a3e686b9) C:\windows\system32\drivers\partmgr.sys 2011/02/08 20:24:56.0232 6136 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\windows\system32\DRIVERS\parvdm.sys 2011/02/08 20:24:56.0265 6136 pci (c858cb77c577780ecc456a892e7e7d0f) C:\windows\system32\DRIVERS\pci.sys 2011/02/08 20:24:56.0291 6136 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\windows\system32\DRIVERS\pciide.sys 2011/02/08 20:24:56.0321 6136 pcmcia (f396431b31693e71e8a80687ef523506) C:\windows\system32\DRIVERS\pcmcia.sys 2011/02/08 20:24:56.0350 6136 pcw (250f6b43d2b613172035c6747aeeb19f) C:\windows\system32\drivers\pcw.sys 2011/02/08 20:24:56.0938 6136 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\windows\system32\drivers\peauth.sys 2011/02/08 20:24:57.0193 6136 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\windows\system32\DRIVERS\raspptp.sys 2011/02/08 20:24:57.0248 6136 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\windows\system32\DRIVERS\processr.sys 2011/02/08 20:24:57.0345 6136 Psched (6270ccae2a86de6d146529fe55b3246a) C:\windows\system32\DRIVERS\pacer.sys 2011/02/08 20:24:57.0423 6136 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\windows\system32\DRIVERS\ql2300.sys 2011/02/08 20:24:57.0492 6136 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\windows\system32\DRIVERS\ql40xx.sys 2011/02/08 20:24:57.0546 6136 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\windows\system32\drivers\qwavedrv.sys 2011/02/08 20:24:57.0578 6136 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\windows\system32\DRIVERS\rasacd.sys 2011/02/08 20:24:57.0686 6136 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\windows\system32\DRIVERS\AgileVpn.sys 2011/02/08 20:24:57.0760 6136 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\windows\system32\DRIVERS\rasl2tp.sys 2011/02/08 20:24:57.0803 6136 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\windows\system32\DRIVERS\raspppoe.sys 2011/02/08 20:24:57.0838 6136 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\windows\system32\DRIVERS\rassstp.sys 2011/02/08 20:24:57.0870 6136 rdbss (835d7e81bf517a3b72384bdcc85e1ce6) C:\windows\system32\DRIVERS\rdbss.sys 2011/02/08 20:24:57.0907 6136 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\windows\system32\DRIVERS\rdpbus.sys 2011/02/08 20:24:57.0935 6136 RDPCDD (1e016846895b15a99f9a176a05029075) C:\windows\system32\DRIVERS\RDPCDD.sys 2011/02/08 20:24:57.0967 6136 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\windows\system32\drivers\rdpencdd.sys 2011/02/08 20:24:58.0005 6136 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\windows\system32\drivers\rdprefmp.sys 2011/02/08 20:24:58.0032 6136 RDPWD (801371ba9782282892d00aadb08ee367) C:\windows\system32\drivers\RDPWD.sys 2011/02/08 20:24:58.0081 6136 rdyboost (4ea225bf1cf05e158853f30a99ca29a7) C:\windows\system32\drivers\rdyboost.sys 2011/02/08 20:24:58.0187 6136 RFCOMM (cb928d9e6daf51879dd6ba8d02f01321) C:\windows\system32\DRIVERS\rfcomm.sys 2011/02/08 20:24:58.0255 6136 RMCAST (b4090006a82eeb608c358ab5d37de85a) C:\windows\system32\DRIVERS\RMCAST.sys 2011/02/08 20:24:58.0317 6136 rspndr (032b0d36ad92b582d869879f5af5b928) C:\windows\system32\DRIVERS\rspndr.sys 2011/02/08 20:24:58.0361 6136 RTL8167 (7dfd48e24479b68b258d8770121155a0) C:\windows\system32\DRIVERS\Rt86win7.sys 2011/02/08 20:24:58.0420 6136 SABI (6e5fbb7cbaec47038b945d5e9b144a64) C:\windows\system32\Drivers\SABI.sys 2011/02/08 20:24:58.0495 6136 sbp2port (34ee0c44b724e3e4ce2eff29126de5b5) C:\windows\system32\DRIVERS\sbp2port.sys 2011/02/08 20:24:58.0541 6136 scfilter (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\windows\system32\DRIVERS\scfilter.sys 2011/02/08 20:24:58.0637 6136 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\windows\system32\drivers\secdrv.sys 2011/02/08 20:24:58.0730 6136 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\windows\system32\DRIVERS\serenum.sys 2011/02/08 20:24:58.0766 6136 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\windows\system32\DRIVERS\serial.sys 2011/02/08 20:24:58.0795 6136 sermouse (79bffb520327ff916a582dfea17aa813) C:\windows\system32\DRIVERS\sermouse.sys 2011/02/08 20:24:58.0861 6136 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\windows\system32\DRIVERS\sffdisk.sys 2011/02/08 20:24:58.0892 6136 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\windows\system32\DRIVERS\sffp_mmc.sys 2011/02/08 20:24:58.0931 6136 sffp_sd (4f1e5b0fe7c8050668dbfade8999aefb) C:\windows\system32\DRIVERS\sffp_sd.sys 2011/02/08 20:24:58.0969 6136 sfloppy (db96666cc8312ebc45032f30b007a547) C:\windows\system32\DRIVERS\sfloppy.sys 2011/02/08 20:24:59.0032 6136 Sftfs (cc895997c0995a07b6b2779a3b21918b) C:\windows\system32\DRIVERS\Sftfslh.sys 2011/02/08 20:24:59.0091 6136 Sftplay (cf5e9798637795db59697f5e40fca993) C:\windows\system32\DRIVERS\Sftplaylh.sys 2011/02/08 20:24:59.0136 6136 Sftredir (4c8076ff8938b365eeec9123969e0350) C:\windows\system32\DRIVERS\Sftredirlh.sys 2011/02/08 20:24:59.0176 6136 Sftvol (6095a5f221eca9dada2c9ee80ec0d92d) C:\windows\system32\DRIVERS\Sftvollh.sys 2011/02/08 20:24:59.0264 6136 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\windows\system32\DRIVERS\sisagp.sys 2011/02/08 20:24:59.0310 6136 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\windows\system32\DRIVERS\SiSRaid2.sys 2011/02/08 20:24:59.0356 6136 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\windows\system32\DRIVERS\sisraid4.sys 2011/02/08 20:24:59.0397 6136 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\windows\system32\DRIVERS\smb.sys 2011/02/08 20:24:59.0499 6136 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\windows\system32\drivers\spldr.sys 2011/02/08 20:24:59.0632 6136 srv (2dbedfb1853f06110ec2aa7f3213c89f) C:\windows\system32\DRIVERS\srv.sys 2011/02/08 20:24:59.0681 6136 srv2 (db37131d1027c50ea7ee21c8bb4536aa) C:\windows\system32\DRIVERS\srv2.sys 2011/02/08 20:24:59.0722 6136 srvnet (f5980b74124db9233b33f86fc5ebbb4f) C:\windows\system32\DRIVERS\srvnet.sys 2011/02/08 20:24:59.0794 6136 stexstor (db32d325c192b801df274bfd12a7e72b) C:\windows\system32\DRIVERS\stexstor.sys 2011/02/08 20:24:59.0852 6136 swenum (e58c78a848add9610a4db6d214af5224) C:\windows\system32\DRIVERS\swenum.sys 2011/02/08 20:24:59.0920 6136 SynTP (215a45246c6e2d0a9c263ce1786c8d8a) C:\windows\system32\DRIVERS\SynTP.sys 2011/02/08 20:24:59.0982 6136 szkg5 (8fe4ecc7877fcfe4e59414708898073d) C:\windows\system32\DRIVERS\szkg.sys 2011/02/08 20:25:00.0006 6136 szkgfs (410a02a920fa9daeec56364e839597c1) C:\windows\system32\drivers\szkgfs.sys 2011/02/08 20:25:00.0119 6136 Tcpip (bb7f39c31c4a4417fd318e7cd184e225) C:\windows\system32\drivers\tcpip.sys 2011/02/08 20:25:00.0251 6136 TCPIP6 (bb7f39c31c4a4417fd318e7cd184e225) C:\windows\system32\DRIVERS\tcpip.sys 2011/02/08 20:25:00.0341 6136 tcpipreg (e64444523add154f86567c469bc0b17f) C:\windows\system32\drivers\tcpipreg.sys 2011/02/08 20:25:00.0390 6136 TDPIPE (1875c1490d99e70e449e3afae9fcbadf) C:\windows\system32\drivers\tdpipe.sys 2011/02/08 20:25:00.0422 6136 TDTCP (7551e91ea999ee9a8e9c331d5a9c31f3) C:\windows\system32\drivers\tdtcp.sys 2011/02/08 20:25:00.0466 6136 tdx (cb39e896a2a83702d1737bfd402b3542) C:\windows\system32\DRIVERS\tdx.sys 2011/02/08 20:25:00.0512 6136 TermDD (c36f41ee20e6999dbf4b0425963268a5) C:\windows\system32\DRIVERS\termdd.sys 2011/02/08 20:25:00.0625 6136 tssecsrv (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\windows\system32\DRIVERS\tssecsrv.sys 2011/02/08 20:25:00.0697 6136 tunnel (3e461d890a97f9d4c168f5fda36e1d00) C:\windows\system32\DRIVERS\tunnel.sys 2011/02/08 20:25:00.0751 6136 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\windows\system32\DRIVERS\uagp35.sys 2011/02/08 20:25:00.0819 6136 udfs (eb0a7bd4d471ac3ce55564a4c55b9d8e) C:\windows\system32\DRIVERS\udfs.sys 2011/02/08 20:25:00.0911 6136 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\windows\system32\DRIVERS\uliagpkx.sys 2011/02/08 20:25:00.0957 6136 umbus (049b3a50b3d646baeeee9eec9b0668dc) C:\windows\system32\DRIVERS\umbus.sys 2011/02/08 20:25:01.0035 6136 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\windows\system32\DRIVERS\umpass.sys 2011/02/08 20:25:01.0094 6136 usbccgp (8455c4ed038efd09e99327f9d2d48ffa) C:\windows\system32\DRIVERS\usbccgp.sys 2011/02/08 20:25:01.0150 6136 usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\windows\system32\DRIVERS\usbcir.sys 2011/02/08 20:25:01.0192 6136 usbehci (1c333bfd60f2fed2c7ad5daf533cb742) C:\windows\system32\DRIVERS\usbehci.sys 2011/02/08 20:25:01.0240 6136 usbhub (ee6ef93ccfa94fae8c6ab298273d8ae2) C:\windows\system32\DRIVERS\usbhub.sys 2011/02/08 20:25:01.0290 6136 usbohci (a6fb7957ea7afb1165991e54ce934b74) C:\windows\system32\DRIVERS\usbohci.sys 2011/02/08 20:25:01.0329 6136 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\windows\system32\DRIVERS\usbprint.sys 2011/02/08 20:25:01.0367 6136 USBSTOR (d8889d56e0d27e57ed4591837fe71d27) C:\windows\system32\DRIVERS\USBSTOR.SYS 2011/02/08 20:25:01.0414 6136 usbuhci (78780c3ebce17405b1ccd07a3a8a7d72) C:\windows\system32\DRIVERS\usbuhci.sys 2011/02/08 20:25:01.0476 6136 usbvideo (b5f6a992d996282b7fae7048e50af83a) C:\windows\System32\Drivers\usbvideo.sys 2011/02/08 20:25:01.0521 6136 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\windows\system32\DRIVERS\vdrvroot.sys 2011/02/08 20:25:01.0555 6136 vga (17c408214ea61696cec9c66e388b14f3) C:\windows\system32\DRIVERS\vgapnp.sys 2011/02/08 20:25:01.0587 6136 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\windows\System32\drivers\vga.sys 2011/02/08 20:25:01.0615 6136 vhdmp (3be6e1f3a4f1afec8cee0d7883f93583) C:\windows\system32\DRIVERS\vhdmp.sys 2011/02/08 20:25:01.0674 6136 viaagp (c829317a37b4bea8f39735d4b076e923) C:\windows\system32\DRIVERS\viaagp.sys 2011/02/08 20:25:01.0704 6136 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\windows\system32\DRIVERS\viac7.sys 2011/02/08 20:25:01.0726 6136 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\windows\system32\DRIVERS\viaide.sys 2011/02/08 20:25:01.0769 6136 volmgr (384e5a2aa49934295171e499f86ba6f3) C:\windows\system32\DRIVERS\volmgr.sys 2011/02/08 20:25:01.0797 6136 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\windows\system32\drivers\volmgrx.sys 2011/02/08 20:25:01.0832 6136 volsnap (58df9d2481a56edde167e51b334d44fd) C:\windows\system32\DRIVERS\volsnap.sys 2011/02/08 20:25:01.0902 6136 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\windows\system32\DRIVERS\vsmraid.sys 2011/02/08 20:25:01.0940 6136 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\windows\system32\DRIVERS\vwifibus.sys 2011/02/08 20:25:01.0981 6136 vwififlt (7090d3436eeb4e7da3373090a23448f7) C:\windows\system32\DRIVERS\vwififlt.sys 2011/02/08 20:25:02.0024 6136 vwifimp (a3f04cbea6c2a10e6cb01f8b47611882) C:\windows\system32\DRIVERS\vwifimp.sys 2011/02/08 20:25:02.0061 6136 WacomPen (de3721e89c653aa281428c8a69745d90) C:\windows\system32\DRIVERS\wacompen.sys 2011/02/08 20:25:02.0097 6136 WANARP (692a712062146e96d28ba0b7d75de31b) C:\windows\system32\DRIVERS\wanarp.sys 2011/02/08 20:25:02.0114 6136 Wanarpv6 (692a712062146e96d28ba0b7d75de31b) C:\windows\system32\DRIVERS\wanarp.sys 2011/02/08 20:25:02.0180 6136 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\windows\system32\DRIVERS\wd.sys 2011/02/08 20:25:02.0216 6136 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\windows\system32\drivers\Wdf01000.sys 2011/02/08 20:25:02.0302 6136 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\windows\system32\DRIVERS\wfplwf.sys 2011/02/08 20:25:02.0330 6136 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\windows\system32\drivers\wimmount.sys 2011/02/08 20:25:02.0499 6136 WinUsb (30fc6e5448d0cbaaa95280eeef7fedae) C:\windows\system32\DRIVERS\WinUsb.sys 2011/02/08 20:25:02.0595 6136 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\windows\system32\DRIVERS\wmiacpi.sys 2011/02/08 20:25:02.0645 6136 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\windows\system32\drivers\ws2ifsl.sys 2011/02/08 20:25:02.0709 6136 WudfPf (6f9b6c0c93232cff47d0f72d6db1d21e) C:\windows\system32\drivers\WudfPf.sys 2011/02/08 20:25:02.0744 6136 WUDFRd (f91ff1e51fca30b3c3981db7d5924252) C:\windows\system32\DRIVERS\WUDFRd.sys 2011/02/08 20:25:02.0885 6136 yukonw7 (3eb1576f77b60a6c79dd7742b67219b8) C:\windows\system32\DRIVERS\yk62x86.sys 2011/02/08 20:25:02.0959 6136 ZTEusbmdm6k (86187fb5d81781501558f8742dee4197) C:\windows\system32\DRIVERS\ZTEusbmdm6k.sys 2011/02/08 20:25:02.0991 6136 ZTEusbnet (b7836ca4a95e12135e7e49fec9c29f2a) C:\windows\system32\DRIVERS\ZTEusbnet.sys 2011/02/08 20:25:03.0037 6136 ZTEusbnmea (86187fb5d81781501558f8742dee4197) C:\windows\system32\DRIVERS\ZTEusbnmea.sys 2011/02/08 20:25:03.0082 6136 ZTEusbser6k (86187fb5d81781501558f8742dee4197) C:\windows\system32\DRIVERS\ZTEusbser6k.sys 2011/02/08 20:25:03.0167 6136 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0) 2011/02/08 20:25:03.0172 6136 ================================================================================ 2011/02/08 20:25:03.0172 6136 Scan finished 2011/02/08 20:25:03.0172 6136
Post #4
OTL logfile created on: 2/8/2011 8:57:31 PM - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Downloads
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 66.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 225.33 Gb Total Space | 184.47 Gb Free Space | 81.87% Space Free | Partition Type: NTFS
Drive D: | 225.33 Gb Total Space | 95.73 Gb Free Space | 42.48% Space Free | Partition Type: NTFS
Drive F: | 33.48 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: SAMR720 | User Name: steelfix1 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Windows\System32\Macromed\Flash\FlashUtil10l_ActiveX.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\STOPzilla!\STOPzilla.exe (iS3, Inc.)
PRC - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe (iS3, Inc.)
PRC - C:\downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe (Google Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Windows\System32\mfevtps.exe (McAfee, Inc.)
PRC - c:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\Orbitdownloader\orbitdm.exe (Orbitdownloader.com)
PRC - C:\Program Files\Orbitdownloader\orbitnet.exe (Orbitdownloader.com)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe (SEC)
PRC - C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe (SAMSUNG Electronics)
PRC - C:\Windows\System32\atieclxx.exe (AMD)
PRC - C:\Windows\System32\atiesrxx.exe (AMD)
PRC - C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe ()
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe (Broadcom Corporation.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\osk.exe (Microsoft Corporation)
PRC - C:\Program Files\Samsung\Samsung Update Plus\SUPNotifier.exe ()
PRC - C:\Program Files\LSI SoftModem\agrsmsvc.exe (LSI Corporation)
PRC - C:\Windows\System32\Rezip.exe ()
PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()
PRC - C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation)
PRC - C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing, Inc.)


========== Modules (SafeList) ==========

MOD - C:\downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\UIAutomationCore.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msswch.dll (Microsoft Corporation)
MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)
MOD - C:\Program Files\McAfee\SiteAdvisor\sahook.dll ()


========== Win32 Services (SafeList) ==========

SRV - (szserver) – C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe (iS3, Inc.)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
SRV - (mfevtp) – C:\Windows\System32\mfevtps.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (sftvsa) – C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) – C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (MSK80Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McProxy) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (AMD External Events Utility) – C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (OberonGameConsoleService) – C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe ()
SRV - (btwdins) – C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
SRV - (WwanSvc) – C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) – C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) – C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) – C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) – C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (RpcEptMapper) – C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PNRPsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) – C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) – C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) – C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (Dhcp) – C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) – C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) – C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX Installer (AxInstSV) – C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppIDSvc) – C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (sppsvc) – C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
SRV - (yksvc) – C:\Windows\System32\yk62x86.dll (Marvell)
SRV - (AgereModemAudio) – C:\Program Files\LSI SoftModem\agrsmsvc.exe (LSI Corporation)
SRV - (Rezip) – C:\Windows\System32\Rezip.exe ()
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()
SRV - (BcmSqlStartupSvc) – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (mfehidk) – C:\windows\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfefirek) – C:\Windows\System32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfewfpk) – C:\Windows\System32\drivers\mfewfpk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\Windows\System32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\Windows\System32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfenlfk) – C:\Windows\System32\drivers\mfenlfk.sys (McAfee, Inc.)
DRV - (cfwids) – C:\Windows\System32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (fssfltr) – C:\Windows\System32\drivers\fssfltr.sys (Microsoft Corporation)
DRV - (szkgfs) – C:\windows\system32\drivers\szkgfs.sys (iS3, Inc.)
DRV - (Sftvol) – C:\Windows\System32\drivers\Sftvollh.sys (Microsoft Corporation)
DRV - (Sftredir) – C:\Windows\System32\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV - (Sftplay) – C:\Windows\System32\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV - (Sftfs) – C:\Windows\System32\drivers\Sftfslh.sys (Microsoft Corporation)
DRV - (KSecPkg) – C:\windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (szkg5) – C:\windows\system32\DRIVERS\szkg.sys (iS3 Inc.)
DRV - (is3srv) – C:\windows\system32\drivers\is3srv.sys (iS3 Inc.)
DRV - (SynTP) – C:\Windows\System32\drivers\SynTP.sys (Synaptics Incorporated)
DRV - (AtiHdmiService) – C:\Windows\System32\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (athr) – C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (LSI Corporation)
DRV - (ZTEusbser6k) – C:\Windows\System32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbnmea) – C:\Windows\System32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) – C:\Windows\System32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (ZTEusbnet) – C:\Windows\System32\drivers\ZTEusbnet.sys (ZTE Corporation)
DRV - (cmdide) – C:\windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) – C:\windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) – C:\windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) – C:\windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) – C:\windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) – C:\windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) – C:\windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) – C:\windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) – C:\windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) – C:\windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) – C:\windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) – C:\windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) – C:\windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) – C:\windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (LSI_SCSI) – C:\windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) – C:\windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) – C:\windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) – C:\windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) – C:\windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) – C:\windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) – C:\windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) – C:\windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) – C:\windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) – C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) – C:\windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vhdmp) – C:\windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (vdrvroot) – C:\windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (WIMMount) – C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) – C:\windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) – C:\windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) – C:\windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) – C:\windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) – C:\windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) – C:\windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) – C:\windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) – C:\windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) – C:\windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) – C:\windows\system32\DRIVERS\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) – C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) – C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) – C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (RMCAST) – C:\Windows\System32\drivers\rmcast.sys (Microsoft Corporation)
DRV - (NdisCap) – C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwifimp) – C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (vwififlt) – C:\Windows\System32\drivers\vwififlt.sys (Microsoft Corporation)
DRV - (vwifibus) – C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) – C:\windows\system32\DRIVERS\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) – C:\windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (mshidkmdf) – C:\windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) – C:\windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) – C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) – C:\windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) – C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (discache) – C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (AcpiPmi) – C:\windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) – C:\windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) – C:\windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) – C:\windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) – C:\windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) – C:\windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) – C:\windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (RTL8167) – C:\Windows\System32\drivers\Rt86win7.sys (Realtek Corporation )
DRV - (b57nd60x) – C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (ebdrv) – C:\windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) – C:\windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (btwaudio) – C:\Windows\System32\drivers\btwaudio.sys (Broadcom Corporation.)
DRV - (btwavdt) – C:\Windows\System32\drivers\btwavdt.sys (Broadcom Corporation.)
DRV - (btwrchid) – C:\Windows\System32\drivers\btwrchid.sys (Broadcom Corporation.)
DRV - (yukonw7) – C:\Windows\System32\drivers\yk62x86.sys (Marvell)
DRV - (igfx) – C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (iaStor) – C:\windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (SABI) – C:\Windows\System32\drivers\SABI.sys (SAMSUNG ELECTRONICS)
DRV - (massfilter) – C:\Windows\System32\drivers\massfilter.sys (ZTE Incorporated)
DRV - (btwl2cap) – C:\Windows\System32\drivers\btwl2cap.sys (Broadcom Corporation.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?br…n&bmod=smsn
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2011/02/01 00:27:49 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/10/24 00:31:24 | 000,000,000 | —D | M]

[2010/10/24 01:31:22 | 000,000,000 | —D | M] (No name found) – C:\Users\steelfix1\AppData\Roaming\mozilla\Extensions
[2010/10/24 01:31:22 | 000,000,000 | —D | M] (No name found) – C:\Users\steelfix1\AppData\Roaming\mozilla\Extensions\[removed]

O1 HOSTS File: ([2011/02/07 07:08:11 | 000,000,860 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20101110023536.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O2 - BHO: (STOPzilla Browser Helper Object) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll (iS3, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {09EC805C-CB2E-4D53-B0D3-A75A428B81C7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present
O8 - Extra context menu item: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll (Google Inc.)
O8 - Extra context menu item: Send image to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} http://trial.trymicrosoftoffice.com/trialo…osoft/wrc32.ocx (WRC Class)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O30 - LSA: Security Packages - (pku2u) - C:\windows\System32\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\windows\System32\livessp.dll (Microsoft Corp.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 21:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2010/01/12 17:54:26 | 000,000,439 | R— | M] () - F:\AutoRun.dat – [ CDFS ]
O32 - AutoRun File - [2009/11/19 07:48:44 | 000,328,192 | R— | M] (ZTE CORPORATION) - F:\AutoRun.exe – [ CDFS ]
O32 - AutoRun File - [2009/08/27 18:07:28 | 000,025,214 | R— | M] () - F:\autorun.ico – [ CDFS ]
O32 - AutoRun File - [2009/10/21 08:25:12 | 000,000,047 | R— | M] () - F:\autorun.inf – [ CDFS ]
O33 - MountPoints2\{45520b44-df3d-11df-8dbe-0c6076ff8efc}\Shell - "" = AutoRun
O33 - MountPoints2\{45520b44-df3d-11df-8dbe-0c6076ff8efc}\Shell\AutoRun\command - "" = F:\AutoRun.exe – [2009/11/19 07:48:44 | 000,328,192 | R— | M] (ZTE CORPORATION)
O33 - MountPoints2\{77864d45-deea-11df-8db9-0c6076ff8efc}\Shell - "" = AutoRun
O33 - MountPoints2\{77864d45-deea-11df-8db9-0c6076ff8efc}\Shell\AutoRun\command - "" = F:\AutoRun.exe – [2009/11/19 07:48:44 | 000,328,192 | R— | M] (ZTE CORPORATION)
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe – [2009/11/19 07:48:44 | 000,328,192 | R— | M] (ZTE CORPORATION)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – Reg Error: Key error. File not found

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)
NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.)


========== Files/Folders - Created Within 30 Days ==========

[2011/02/08 20:27:40 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2011/02/07 17:00:18 | 000,000,000 | —D | C] – C:\windows\Minidump
[2011/02/07 06:39:02 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\STOPzilla
[2011/02/07 06:38:55 | 000,000,000 | —D | C] – C:\Program Files\STOPzilla!
[2011/02/07 06:38:54 | 000,000,000 | —D | C] – C:\Program Files\Common Files\iS3
[2011/02/07 06:38:53 | 000,000,000 | —D | C] – C:\ProgramData\STOPzilla!
[2011/02/03 18:10:50 | 000,132,560 | R— | C] (iS3, Inc.) – C:\windows\System32\IS3HTUI5.dll
[2011/02/03 18:10:50 | 000,022,992 | R— | C] (iS3, Inc.) – C:\windows\System32\SZIO5.dll
[2011/02/03 18:10:48 | 000,546,256 | R— | C] (iS3, Inc.) – C:\windows\System32\SZComp5.dll
[2011/02/03 18:10:48 | 000,452,048 | R— | C] (iS3, Inc.) – C:\windows\System32\SZBase5.dll
[2011/02/03 18:10:48 | 000,398,800 | R— | C] (iS3, Inc.) – C:\windows\System32\IS3DBA5.dll
[2011/02/03 18:10:48 | 000,099,792 | R— | C] (iS3, Inc.) – C:\windows\System32\IS3Svc5.dll
[2011/02/03 18:10:48 | 000,067,024 | R— | C] (iS3, Inc.) – C:\windows\System32\IS3Hks5.dll
[2011/02/03 18:10:48 | 000,028,624 | R— | C] (iS3, Inc.) – C:\windows\System32\IS3XDat5.dll
[2011/02/03 18:10:46 | 000,738,768 | R— | C] (iS3, Inc.) – C:\windows\System32\IS3Base5.dll
[2011/02/03 18:10:46 | 000,390,608 | R— | C] (iS3, Inc.) – C:\windows\System32\IS3UI5.dll
[2011/02/03 18:10:46 | 000,230,864 | R— | C] (iS3, Inc.) – C:\windows\System32\IS3Win325.dll
[2011/02/03 18:10:46 | 000,099,792 | R— | C] (iS3, Inc.) – C:\windows\System32\IS3Inet5.dll
[2011/02/03 17:31:55 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2011/02/03 17:30:31 | 000,472,808 | —- | C] (Sun Microsystems, Inc.) – C:\windows\System32\deployJava1.dll
[2011/02/03 17:30:31 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\windows\System32\javaws.exe
[2011/02/03 17:30:31 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\windows\System32\javaw.exe
[2011/02/03 17:30:31 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\windows\System32\java.exe
[2011/02/02 08:02:47 | 000,000,000 | —D | C] – C:\Users\steelfix1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth Devices
[2011/02/01 10:36:10 | 001,360,472 | —- | C] (Kaspersky Lab ZAO) – C:\Users\steelfix1\Desktop\TDSSKiller.exe
[2011/01/18 17:31:49 | 000,000,000 | —D | C] – C:\Users\steelfix1\Documents\05_-_MAME_(WITH_1692_ROMS)
[2011/01/13 05:08:51 | 000,000,000 | —D | C] – C:\Users\steelfix1\AppData\Local\ElevatedDiagnostics
[2011/01/12 18:02:29 | 000,573,440 | —- | C] (Microsoft Corporation) – C:\windows\System32\odbc32.dll
[2011/01/12 17:46:16 | 001,170,944 | —- | C] (Microsoft Corporation) – C:\windows\System32\d3d10warp.dll
[2011/01/12 17:46:16 | 001,074,176 | —- | C] (Microsoft Corporation) – C:\windows\System32\DWrite.dll
[2011/01/12 17:46:16 | 000,801,792 | —- | C] (Microsoft Corporation) – C:\windows\System32\FntCache.dll
[2011/01/12 17:46:16 | 000,739,840 | —- | C] (Microsoft Corporation) – C:\windows\System32\d2d1.dll
[2011/01/12 17:46:16 | 000,442,880 | —- | C] (Microsoft Corporation) – C:\windows\System32\XpsPrint.dll
[2011/01/12 17:46:16 | 000,283,648 | —- | C] (Microsoft Corporation) – C:\windows\System32\XpsGdiConverter.dll
[2011/01/12 17:46:15 | 001,495,040 | —- | C] (Microsoft Corporation) – C:\windows\System32\ExplorerFrame.dll
[2011/01/12 17:46:15 | 000,218,624 | —- | C] (Microsoft Corporation) – C:\windows\System32\d3d10_1core.dll
[2011/01/12 17:46:15 | 000,211,968 | —- | C] (Microsoft Corporation) – C:\windows\System32\drivers\dxgmms1.sys
[2011/01/12 17:46:15 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\windows\System32\d3d10_1.dll
[2011/01/12 17:46:15 | 000,135,168 | —- | C] (Microsoft Corporation) – C:\windows\System32\XpsRasterService.dll
[2011/01/12 17:46:15 | 000,107,520 | —- | C] (Microsoft Corporation) – C:\windows\System32\cdd.dll
[2011/01/09 23:03:12 | 000,000,000 | —D | C] – C:\Users\steelfix1\Documents\Club Gold Digger 1024 Wdx

========== Files - Modified Within 30 Days ==========
Post #5
========== Files - Modified Within 30 Days ==========

[2011/02/08 20:58:11 | 000,000,416 | —- | M] () – C:\windows\System32\drivers\kgpcpy.cfg
[2011/02/08 20:39:00 | 000,000,884 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/02/08 20:34:40 | 000,014,736 | -H– | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/02/08 20:34:40 | 000,014,736 | -H– | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/02/08 20:27:40 | 000,001,828 | —- | M] () – C:\Users\Public\Desktop\McAfee Security Center.lnk
[2011/02/08 20:26:58 | 000,000,880 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/02/08 20:26:45 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2011/02/08 20:26:41 | 2388,086,784 | -HS- | M] () – C:\hiberfil.sys
[2011/02/08 06:10:21 | 294,624,922 | —- | M] () – C:\windows\MEMORY.DMP
[2011/02/07 20:04:21 | 000,004,608 | —- | M] () – C:\Users\steelfix1\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/07 17:31:07 | 000,002,628 | —- | M] () – C:\Users\steelfix1\Documents\STOPzilla Black List Contents.htm
[2011/02/07 17:13:32 | 000,675,612 | —- | M] () – C:\windows\System32\perfh009.dat
[2011/02/07 17:13:32 | 000,128,320 | —- | M] () – C:\windows\System32\perfc009.dat
[2011/02/07 05:12:37 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2011/02/07 05:12:37 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2011/02/06 23:20:26 | 000,002,290 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2011/02/03 18:10:50 | 000,132,560 | R— | M] (iS3, Inc.) – C:\windows\System32\IS3HTUI5.dll
[2011/02/03 18:10:50 | 000,022,992 | R— | M] (iS3, Inc.) – C:\windows\System32\SZIO5.dll
[2011/02/03 18:10:48 | 000,546,256 | R— | M] (iS3, Inc.) – C:\windows\System32\SZComp5.dll
[2011/02/03 18:10:48 | 000,452,048 | R— | M] (iS3, Inc.) – C:\windows\System32\SZBase5.dll
[2011/02/03 18:10:48 | 000,398,800 | R— | M] (iS3, Inc.) – C:\windows\System32\IS3DBA5.dll
[2011/02/03 18:10:48 | 000,099,792 | R— | M] (iS3, Inc.) – C:\windows\System32\IS3Svc5.dll
[2011/02/03 18:10:48 | 000,067,024 | R— | M] (iS3, Inc.) – C:\windows\System32\IS3Hks5.dll
[2011/02/03 18:10:48 | 000,028,624 | R— | M] (iS3, Inc.) – C:\windows\System32\IS3XDat5.dll
[2011/02/03 18:10:46 | 000,738,768 | R— | M] (iS3, Inc.) – C:\windows\System32\IS3Base5.dll
[2011/02/03 18:10:46 | 000,390,608 | R— | M] (iS3, Inc.) – C:\windows\System32\IS3UI5.dll
[2011/02/03 18:10:46 | 000,230,864 | R— | M] (iS3, Inc.) – C:\windows\System32\IS3Win325.dll
[2011/02/03 18:10:46 | 000,099,792 | R— | M] (iS3, Inc.) – C:\windows\System32\IS3Inet5.dll
[2011/02/02 00:01:03 | 000,002,275 | —- | M] () – C:\Users\steelfix1\Documents\edin 1st gold arcade.wlmp
[2011/02/01 20:54:07 | 000,000,000 | -H– | M] () – C:\windows\System32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011/02/01 10:36:10 | 001,360,472 | —- | M] (Kaspersky Lab ZAO) – C:\Users\steelfix1\Desktop\TDSSKiller.exe
[2011/01/18 09:13:44 | 019,912,166 | —- | M] () – C:\Users\steelfix1\Documents\05_-_MAME_(WITH_1692_ROMS).zip
[2011/01/13 05:12:46 | 000,000,418 | —- | M] () – C:\Users\steelfix1\Documents\CD Drive - Shortcut.lnk

========== Files Created - No Company Name ==========

[2011/02/08 20:27:56 | 000,000,416 | —- | C] () – C:\windows\System32\drivers\kgpcpy.cfg
[2011/02/07 20:04:21 | 000,004,608 | —- | C] () – C:\Users\steelfix1\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/07 17:31:07 | 000,002,628 | —- | C] () – C:\Users\steelfix1\Documents\STOPzilla Black List Contents.htm
[2011/02/07 17:00:12 | 294,624,922 | —- | C] () – C:\windows\MEMORY.DMP
[2011/02/07 05:12:37 | 000,000,000 | RHS- | C] () – C:\MSDOS.SYS
[2011/02/07 05:12:37 | 000,000,000 | RHS- | C] () – C:\IO.SYS
[2011/02/04 21:19:20 | 000,007,891 | —- | C] () – C:\Users\steelfix1\Documents\AdobeFlashPlayerCatalog_SCUP.xml
[2011/02/02 00:01:03 | 000,002,275 | —- | C] () – C:\Users\steelfix1\Documents\edin 1st gold arcade.wlmp
[2011/02/01 20:54:07 | 000,000,000 | -H– | C] () – C:\windows\System32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011/01/18 00:00:40 | 019,912,166 | —- | C] () – C:\Users\steelfix1\Documents\05_-_MAME_(WITH_1692_ROMS).zip
[2011/01/13 05:12:46 | 000,000,418 | —- | C] () – C:\Users\steelfix1\Documents\CD Drive - Shortcut.lnk
[2010/11/13 05:15:24 | 000,000,010 | —- | C] () – C:\Users\steelfix1\AppData\Roaming\install
[2010/11/13 05:13:08 | 000,000,223 | —- | C] () – C:\Users\steelfix1\AppData\Roaming\sdfsdfgdsfgh.bat
[2010/10/29 01:29:53 | 000,004,151 | —- | C] () – C:\ProgramData\ojobkspa.ako
[2010/03/09 13:18:31 | 000,000,002 | —- | C] () – C:\windows\HotFixList.ini
[2010/03/09 13:17:11 | 000,131,368 | —- | C] () – C:\ProgramData\FullRemove.exe
[2009/08/25 14:54:32 | 000,033,664 | —- | C] () – C:\windows\System32\drivers\TsWlan.sys
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\windows\System32\OGACheckControl.dll
[2009/07/13 23:51:43 | 000,073,728 | —- | C] () – C:\windows\System32\BthpanContextHandler.dll
[2009/07/13 23:42:10 | 000,064,000 | —- | C] () – C:\windows\System32\BWContextHandler.dll

========== LOP Check ==========

[2011/02/07 07:18:51 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\4shared Desktop
[2010/10/24 21:27:52 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\GrabPro
[2010/10/29 01:29:55 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\MOVAVI
[2010/11/29 22:18:30 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\Movavi Video Converter 10
[2010/10/24 21:27:28 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\OpenCandy
[2011/02/08 20:50:19 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\Orbit
[2010/10/24 21:41:41 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\ProgSense
[2011/02/07 07:16:22 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\SoftGrid Client
[2010/10/23 21:20:59 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\Tatara Systems
[2010/10/24 20:27:16 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\TP
[2010/10/30 03:55:29 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\Usenet.nl
[2011/02/08 07:47:25 | 000,032,654 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< >

< >

< %SYSTEMDRIVE%\*.* >
[2009/06/10 21:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/06/10 21:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2011/02/08 20:26:41 | 2388,086,784 | -HS- | M] () – C:\hiberfil.sys
[2011/02/07 05:12:37 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2011/02/07 05:12:37 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2011/02/08 20:26:43 | 3184,119,808 | -HS- | M] () – C:\pagefile.sys
[2009/11/12 02:15:48 | 000,002,047 | —- | M] () – C:\RHDSetup.log
[2009/11/12 02:30:42 | 000,000,166 | —- | M] () – C:\Setup.log
[2011/02/08 20:25:52 | 000,071,230 | —- | M] () – C:\TDSSKiller.2.4.16.0_08.02.2011_20.23.57_log.txt
[2011/02/08 20:30:42 | 000,002,144 | —- | M] () – C:\TDSSKiller.2.4.16.0_08.02.2011_20.30.19_log.txt

< %systemroot%\Fonts\*.com >
[2009/07/14 04:52:25 | 000,026,040 | —- | M] () – C:\windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 04:52:25 | 000,026,489 | —- | M] () – C:\windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 04:52:25 | 000,029,779 | —- | M] () – C:\windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 04:52:25 | 000,043,318 | —- | M] () – C:\windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 21:31:19 | 000,000,065 | —- | M] () – C:\windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/14 01:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2009/07/14 01:16:19 | 000,029,696 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/09/23 00:32:56 | 000,301,936 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 04:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/10/23 21:20:41 | 000,000,221 | -HS- | M] () – C:\Users\steelfix1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/02/01 10:36:10 | 001,360,472 | —- | M] (Kaspersky Lab ZAO) – C:\Users\steelfix1\Desktop\TDSSKiller.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2009/06/10 21:20:04 | 000,000,802 | —- | M] () – C:\Windows\addins\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2010/10/24 02:31:02 | 000,000,402 | -HS- | M] () – C:\Users\steelfix1\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2009/08/17 05:16:58 | 000,131,368 | —- | M] () – C:\ProgramData\FullRemove.exe
[2010/10/29 01:29:53 | 000,004,151 | —- | M] () – C:\ProgramData\ojobkspa.ako

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-01-17 08:34:45

< >

< >

< End of report >
Post #6
Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • See this Link for programs that need to be disabled and instruction on how to disable them.
  • Remember to re-enable them when we're done.

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Post #7
ComboFix 11-02-08.02 - steelfix1 09/02/2011 4:56.1.2 - x86 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.3037.2159 [GMT 0:00] Running from: c:\downloads\ComboFix.exe AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} FW: McAfee Firewall *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C} SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} SP: STOPzilla Anti-Spyware *Disabled/Updated* {B2E69928-50DC-94CA-6A80-AAB054008761} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\programdata\FullRemove.exe c:\users\steelfix1\AppData\Roaming\install c:\users\steelfix1\AppData\Roaming\sdfsdfgdsfgh.bat . ((((((((((((((((((((((((( Files Created from 2011-01-09 to 2011-02-09 ))))))))))))))))))))))))))))))) . 2011-02-09 05:03 . 2011-02-09 05:04 ——– d—–w- c:\users\steelfix1\AppData\Local\temp 2011-02-09 05:03 . 2011-02-09 05:03 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-02-08 23:12 . 2011-01-07 07:27 34304 —-a-w- c:\windows\system32\atmlib.dll 2011-02-08 23:12 . 2011-01-07 05:33 294400 —-a-w- c:\windows\system32\atmfd.dll 2011-02-08 23:12 . 2010-10-27 04:43 3901824 —-a-w- c:\windows\system32\ntoskrnl.exe 2011-02-08 23:12 . 2010-10-27 04:40 1289536 —-a-w- c:\windows\system32\ntdll.dll 2011-02-08 23:12 . 2010-10-27 04:43 3957120 —-a-w- c:\windows\system32\ntkrnlpa.exe 2011-02-08 23:08 . 2010-12-21 05:38 204288 —-a-w- c:\windows\system32\upnp.dll 2011-02-08 23:08 . 2010-12-21 05:38 981504 —-a-w- c:\windows\system32\wininet.dll 2011-02-08 23:08 . 2010-12-21 05:38 204800 —-a-w- c:\windows\system32\WebClnt.dll 2011-02-08 23:08 . 2010-12-21 05:36 1389568 —-a-w- c:\windows\system32\msxml6.dll 2011-02-08 23:08 . 2010-12-21 05:36 1236992 —-a-w- c:\windows\system32\msxml3.dll 2011-02-08 23:07 . 2010-12-21 05:38 73728 —-a-w- c:\windows\system32\wscsvc.dll 2011-02-08 23:07 . 2010-12-21 05:38 51200 —-a-w- c:\windows\system32\wscapi.dll 2011-02-08 23:07 . 2010-12-21 05:38 350720 —-a-w- c:\windows\system32\winhttp.dll 2011-02-08 23:07 . 2010-12-21 05:38 14336 —-a-w- c:\windows\system32\slwga.dll 2011-02-08 23:07 . 2010-12-21 05:34 80384 —-a-w- c:\windows\system32\davclnt.dll 2011-02-08 22:55 . 2011-01-05 03:37 2329088 —-a-w- c:\windows\system32\win32k.sys 2011-02-08 22:55 . 2010-12-18 05:29 541184 —-a-w- c:\windows\system32\kerberos.dll 2011-02-08 22:55 . 2011-01-05 05:37 428032 —-a-w- c:\windows\system32\vbscript.dll 2011-02-08 22:38 . 2011-02-03 05:45 219008 —-a-w- c:\windows\system32\drivers\dxgmms1.sys 2011-02-07 06:38 . 2011-02-07 06:38 ——– d—–w- c:\program files\STOPzilla! 2011-02-07 06:38 . 2011-02-07 06:38 ——– d—–w- c:\program files\Common Files\iS3 2011-02-07 06:38 . 2011-02-09 05:03 ——– d—–w- c:\programdata\STOPzilla! 2011-02-03 18:10 . 2011-02-03 18:10 22992 —-a-r- c:\windows\system32\SZIO5.dll 2011-02-03 18:10 . 2011-02-03 18:10 132560 —-a-r- c:\windows\system32\IS3HTUI5.dll 2011-02-03 18:10 . 2011-02-03 18:10 99792 —-a-r- c:\windows\system32\IS3Svc5.dll 2011-02-03 18:10 . 2011-02-03 18:10 67024 —-a-r- c:\windows\system32\IS3Hks5.dll 2011-02-03 18:10 . 2011-02-03 18:10 546256 —-a-r- c:\windows\system32\SZComp5.dll 2011-02-03 18:10 . 2011-02-03 18:10 452048 —-a-r- c:\windows\system32\SZBase5.dll 2011-02-03 18:10 . 2011-02-03 18:10 398800 —-a-r- c:\windows\system32\IS3DBA5.dll 2011-02-03 18:10 . 2011-02-03 18:10 28624 —-a-r- c:\windows\system32\IS3XDat5.dll 2011-02-03 18:10 . 2011-02-03 18:10 99792 —-a-r- c:\windows\system32\IS3Inet5.dll 2011-02-03 18:10 . 2011-02-03 18:10 738768 —-a-r- c:\windows\system32\IS3Base5.dll 2011-02-03 18:10 . 2011-02-03 18:10 390608 —-a-r- c:\windows\system32\IS3UI5.dll 2011-02-03 18:10 . 2011-02-03 18:10 230864 —-a-r- c:\windows\system32\IS3Win325.dll 2011-02-03 17:31 . 2011-02-03 17:31 ——– d—–w- c:\program files\Common Files\Java 2011-02-03 17:30 . 2010-11-12 18:53 472808 —-a-w- c:\windows\system32\deployJava1.dll 2011-01-13 05:08 . 2011-01-13 05:08 ——– d—–w- c:\users\steelfix1\AppData\Local\ElevatedDiagnostics 2011-01-12 18:02 . 2010-10-16 04:34 573440 —-a-w- c:\windows\system32\odbc32.dll 2011-01-12 18:02 . 2010-10-16 04:33 372736 —-a-w- c:\program files\Common Files\System\ado\msadox.dll 2011-01-12 18:02 . 2010-10-16 04:33 352256 —-a-w- c:\program files\Common Files\System\ado\msadomd.dll 2011-01-12 18:02 . 2010-10-16 04:33 987136 —-a-w- c:\program files\Common Files\System\ado\msado15.dll 2011-01-12 18:02 . 2010-10-16 04:33 208896 —-a-w- c:\program files\Common Files\System\msadc\msadco.dll 2011-01-12 17:46 . 2010-11-02 04:46 728448 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys 2011-01-12 17:46 . 2010-11-02 04:41 442880 —-a-w- c:\windows\system32\XpsPrint.dll 2011-01-12 17:46 . 2010-11-02 04:41 283648 —-a-w- c:\windows\system32\XpsGdiConverter.dll 2011-01-12 17:46 . 2010-11-02 04:36 801792 —-a-w- c:\windows\system32\FntCache.dll 2011-01-12 17:46 . 2010-11-02 04:35 1074176 —-a-w- c:\windows\system32\DWrite.dll 2011-01-12 17:46 . 2010-11-02 04:35 1170944 —-a-w- c:\windows\system32\d3d10warp.dll 2011-01-12 17:46 . 2010-11-02 04:35 739840 —-a-w- c:\windows\system32\d2d1.dll 2011-01-12 17:46 . 2010-11-02 04:41 135168 —-a-w- c:\windows\system32\XpsRasterService.dll 2011-01-12 17:46 . 2010-11-02 04:35 218624 —-a-w- c:\windows\system32\d3d10_1core.dll 2011-01-12 17:46 . 2010-11-02 04:35 161792 —-a-w- c:\windows\system32\d3d10_1.dll 2011-01-12 17:46 . 2010-11-02 04:23 107520 —-a-w- c:\windows\system32\cdd.dll 2011-01-12 17:46 . 2010-06-26 05:14 1495040 —-a-w- c:\windows\system32\ExplorerFrame.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-02-03 18:26 . 2010-11-23 08:04 2594584 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll 2011-02-03 18:01 . 2010-11-23 07:34 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll 2011-02-02 18:01 . 2010-11-11 10:16 2594584 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll 2011-02-02 17:49 . 2010-11-11 10:06 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll 2011-01-08 17:07 . 2010-11-11 10:06 710976 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll 2010-12-26 16:45 . 2010-11-20 11:03 710976 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-12 39408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-8-11 795936] McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536] WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2010-11-22 118784] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer2"=wdmaud.drv [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" R0 is3srv;is3srv;c:\windows\system32\drivers\is3srv.sys [2009-12-07 61328] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-10-23 135664] R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2009-04-27 9216] R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232] R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-10-13 84264] R3 NDISKIO;NDISKIO;c:\users\STEELF~1\AppData\Local\Temp\00000919.nmc\nse\bin\ndiskio.sys [x] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000] R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-10-24 1343400] S0 szkg5;szkg5;c:\windows\system32\DRIVERS\szkg.sys [2009-12-07 61328] S0 szkgfs;szkgfs;c:\windows\system32\drivers\szkgfs.sys [2010-05-12 59280] S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [2010-10-13 64304] S1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2010-10-13 164840] S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-09-02 172032] S2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664] S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2009-01-23 203280] S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2010-03-10 271480] S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2010-03-10 271480] S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2010-10-13 188136] S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2010-10-13 141792] S2 OberonGameConsoleService;Oberon Media Game Console service;c:\program files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [2009-08-13 44312] S2 Rezip;Rezip;c:\windows\SYSTEM32\Rezip.exe [2009-03-05 311296] S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [2010-04-24 483688] S2 yksvc;Marvell Yukon Service;c:\windows\System32\svchost.exe [2009-07-14 20992] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 29472] S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-10-13 55840] S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-10-13 313288] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2010-04-24 550760] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2010-04-24 195944] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2010-04-24 21864] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2010-04-24 19304] S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [2010-04-24 209768] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-06-15 313856] S3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\DRIVERS\ZTEusbnet.sys [2009-07-21 114688] — Other Services/Drivers In Memory — *Deregistered* - mfeavfk01 [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] yksvcs REG_MULTI_SZ yksvc . Contents of the 'Scheduled Tasks' folder 2011-02-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-10-23 21:40] 2011-02-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-10-23 21:40] . . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com/ig IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201 IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204 IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203 IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html IE: Send image to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm TCP: {C92B5FBA-337A-47D9-957C-EBA3A499A956} = 82.132.254.2 82.132.254.3 DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx . - - - - ORPHANS REMOVED - - - - URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC} - (no file) Toolbar-Locked - (no file) WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) WebBrowser-{09EC805C-CB2E-4D53-B0D3-A75A428B81C7} - (no file) WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file) AddRemove-Betfred Casino - c:\casino\Betfred Casino\_SetupCasino_25ed.exe AddRemove-LSI Soft Modem - c:\windows\agrsmdel . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2011-02-09 05:06:34 ComboFix-quarantined-files.txt 2011-02-09 05:06 Pre-Run: 197,534,330,880 bytes free Post-Run: 197,551,734,784 bytes free - - End Of File - - 656FC10446BBC1D351964560233C369C
Post #9
  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the log please











Next

Run the following scan: Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.
Post #10
What/where's mbam set up mate? i don't know what it is, there is a gap in the txt you posted yesterday with a red x in the middle, two problems ive come across tonight aswell, my areas at the mins not that quick but now it's gone even slower, at one stage last night it went as far as around 3min a page and once i had two windows open with one i was working on for no reason both windows shut without doing anything and didn't come back. ???
Post #11
Sorry i missed out part of the instructions,here are the full ones.



Please download Malwarebytes from Here or Here

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the log please









Next

Run the following scan: Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.
Post #12
Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5738 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 11/02/2011 08:13:51 mbam-log-2011-02-11 (08-13-51).txt Scan type: Quick scan Objects scanned: 145020 Time elapsed: 6 minute(s), 1 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\downloads\setupcasino_25ed(1).exe (PUP.Casino) -> Quarantined and deleted successfully. c:\downloads\setupcasino_25ed.exe (PUP.Casino) -> Quarantined and deleted successfully.
Post #15
OTL logfile created on: 2/12/2011 5:02:21 AM - Run 3
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Downloads
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 55.00% Memory free
6.00 Gb Paging File | 4.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 225.33 Gb Total Space | 146.09 Gb Free Space | 64.83% Space Free | Partition Type: NTFS
Drive D: | 225.33 Gb Total Space | 95.73 Gb Free Space | 42.48% Space Free | Partition Type: NTFS
Drive F: | 33.48 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: SAMR720 | User Name: steelfix1 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\STOPzilla!\STOPzilla.exe (iS3, Inc.)
PRC - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe (iS3, Inc.)
PRC - C:\downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe (Google Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Windows\System32\mfevtps.exe (McAfee, Inc.)
PRC - c:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\Orbitdownloader\orbitdm.exe (Orbitdownloader.com)
PRC - C:\Program Files\Orbitdownloader\orbitnet.exe (Orbitdownloader.com)
PRC - c:\Program Files\McAfee.com\Agent\mcupdate.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\O2CM-CE\O2 Connection Manager\tscui.exe (O2)
PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe (SEC)
PRC - C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe (SAMSUNG Electronics)
PRC - C:\Windows\System32\atieclxx.exe (AMD)
PRC - C:\Windows\System32\atiesrxx.exe (AMD)
PRC - C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe ()
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe (Broadcom Corporation.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\osk.exe (Microsoft Corporation)
PRC - C:\Windows\System32\DeviceDisplayObjectProvider.exe (Microsoft Corporation)
PRC - C:\Program Files\Samsung\Samsung Update Plus\SUPNotifier.exe ()
PRC - C:\Program Files\LSI SoftModem\agrsmsvc.exe (LSI Corporation)
PRC - C:\Windows\System32\Rezip.exe ()
PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()
PRC - C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation)
PRC - C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing, Inc.)


========== Modules (SafeList) ==========

MOD - C:\downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\UIAutomationCore.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msswch.dll (Microsoft Corporation)
MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)
MOD - C:\Program Files\McAfee\SiteAdvisor\sahook.dll ()


========== Win32 Services (SafeList) ==========

SRV - (szserver) – C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe (iS3, Inc.)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
SRV - (mfevtp) – C:\Windows\System32\mfevtps.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (sftvsa) – C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) – C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (MSK80Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McProxy) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (AMD External Events Utility) – C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (OberonGameConsoleService) – C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe ()
SRV - (btwdins) – C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
SRV - (WwanSvc) – C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) – C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) – C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) – C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) – C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (RpcEptMapper) – C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PNRPsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) – C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) – C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) – C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (Dhcp) – C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) – C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) – C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX Installer (AxInstSV) – C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppIDSvc) – C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (sppsvc) – C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
SRV - (yksvc) – C:\Windows\System32\yk62x86.dll (Marvell)
SRV - (AgereModemAudio) – C:\Program Files\LSI SoftModem\agrsmsvc.exe (LSI Corporation)
SRV - (Rezip) – C:\Windows\System32\Rezip.exe ()
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()
SRV - (BcmSqlStartupSvc) – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (mfehidk) – C:\windows\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfefirek) – C:\Windows\System32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfewfpk) – C:\Windows\System32\drivers\mfewfpk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\Windows\System32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\Windows\System32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfenlfk) – C:\Windows\System32\drivers\mfenlfk.sys (McAfee, Inc.)
DRV - (cfwids) – C:\Windows\System32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (fssfltr) – C:\Windows\System32\drivers\fssfltr.sys (Microsoft Corporation)
DRV - (szkgfs) – C:\windows\system32\drivers\szkgfs.sys (iS3, Inc.)
DRV - (Sftvol) – C:\Windows\System32\drivers\Sftvollh.sys (Microsoft Corporation)
DRV - (Sftredir) – C:\Windows\System32\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV - (Sftplay) – C:\Windows\System32\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV - (Sftfs) – C:\Windows\System32\drivers\Sftfslh.sys (Microsoft Corporation)
DRV - (KSecPkg) – C:\windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (szkg5) – C:\windows\system32\DRIVERS\szkg.sys (iS3 Inc.)
DRV - (is3srv) – C:\windows\system32\drivers\is3srv.sys (iS3 Inc.)
DRV - (SynTP) – C:\Windows\System32\drivers\SynTP.sys (Synaptics Incorporated)
DRV - (AtiHdmiService) – C:\Windows\System32\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (athr) – C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (LSI Corporation)
DRV - (ZTEusbser6k) – C:\Windows\System32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbnmea) – C:\Windows\System32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) – C:\Windows\System32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (ZTEusbnet) – C:\Windows\System32\drivers\ZTEusbnet.sys (ZTE Corporation)
DRV - (cmdide) – C:\windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) – C:\windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) – C:\windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) – C:\windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) – C:\windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) – C:\windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) – C:\windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) – C:\windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) – C:\windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) – C:\windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) – C:\windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) – C:\windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) – C:\windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) – C:\windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (LSI_SCSI) – C:\windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) – C:\windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) – C:\windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) – C:\windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) – C:\windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) – C:\windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) – C:\windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) – C:\windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) – C:\windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) – C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) – C:\windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vhdmp) – C:\windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (vdrvroot) – C:\windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (WIMMount) – C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) – C:\windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) – C:\windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) – C:\windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) – C:\windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) – C:\windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) – C:\windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) – C:\windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) – C:\windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) – C:\windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) – C:\windows\system32\DRIVERS\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) – C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) – C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) – C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (RMCAST) – C:\Windows\System32\drivers\rmcast.sys (Microsoft Corporation)
DRV - (NdisCap) – C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwifimp) – C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (vwififlt) – C:\Windows\System32\drivers\vwififlt.sys (Microsoft Corporation)
DRV - (vwifibus) – C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) – C:\windows\system32\DRIVERS\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) – C:\windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (mshidkmdf) – C:\windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) – C:\windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) – C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) – C:\windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) – C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (discache) – C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (AcpiPmi) – C:\windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) – C:\windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) – C:\windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) – C:\windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) – C:\windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) – C:\windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) – C:\windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (RTL8167) – C:\Windows\System32\drivers\Rt86win7.sys (Realtek Corporation )
DRV - (b57nd60x) – C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (ebdrv) – C:\windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) – C:\windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (btwaudio) – C:\Windows\System32\drivers\btwaudio.sys (Broadcom Corporation.)
DRV - (btwavdt) – C:\Windows\System32\drivers\btwavdt.sys (Broadcom Corporation.)
DRV - (btwrchid) – C:\Windows\System32\drivers\btwrchid.sys (Broadcom Corporation.)
DRV - (yukonw7) – C:\Windows\System32\drivers\yk62x86.sys (Marvell)
DRV - (igfx) – C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (iaStor) – C:\windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (SABI) – C:\Windows\System32\drivers\SABI.sys (SAMSUNG ELECTRONICS)
DRV - (massfilter) – C:\Windows\System32\drivers\massfilter.sys (ZTE Incorporated)
DRV - (btwl2cap) – C:\Windows\System32\drivers\btwl2cap.sys (Broadcom Corporation.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2011/02/01 00:27:49 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/10/24 00:31:24 | 000,000,000 | —D | M]

[2010/10/24 01:31:22 | 000,000,000 | —D | M] (No name found) – C:\Users\steelfix1\AppData\Roaming\mozilla\Extensions
[2010/10/24 01:31:22 | 000,000,000 | —D | M] (No name found) – C:\Users\steelfix1\AppData\Roaming\mozilla\Extensions\[removed]

O1 HOSTS File: ([2011/02/07 07:08:11 | 000,000,860 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20101110023536.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O2 - BHO: (STOPzilla Browser Helper Object) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll (iS3, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [O2Start] C:\Program Files\O2CM-CE\O2 Connection Manager\tscui.exe (O2)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll (Google Inc.)
O8 - Extra context menu item: Send image to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} http://trial.trymicrosoftoffice.com/trialo…osoft/wrc32.ocx (WRC Class)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O30 - LSA: Security Packages - (pku2u) - C:\windows\System32\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\windows\System32\livessp.dll (Microsoft Corp.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 21:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2010/01/12 17:54:26 | 000,000,439 | R— | M] () - F:\AutoRun.dat – [ CDFS ]
O32 - AutoRun File - [2009/11/19 07:48:44 | 000,328,192 | R— | M] (ZTE CORPORATION) - F:\AutoRun.exe – [ CDFS ]
O32 - AutoRun File - [2009/08/27 18:07:28 | 000,025,214 | R— | M] () - F:\autorun.ico – [ CDFS ]
O32 - AutoRun File - [2009/10/21 08:25:12 | 000,000,047 | R— | M] () - F:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – Reg Error: Key error. File not found

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)
NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.)


========== Files/Folders - Created Within 30 Days ==========

[2011/02/11 18:48:37 | 010,070,886 | —- | C] (Igor Pavlov) – C:\Users\steelfix1\Desktop\MameUI64.139.exe
[2011/02/11 18:48:33 | 009,425,835 | —- | C] (Igor Pavlov) – C:\Users\steelfix1\Desktop\MameUI32.139.exe
[2011/02/11 18:48:11 | 000,000,000 | —D | C] – C:\Users\steelfix1\Desktop\samples
[2011/02/11 18:26:29 | 000,000,000 | —D | C] – C:\Users\steelfix1\Desktop\roms
[2011/02/11 18:24:46 | 000,000,000 | —D | C] – C:\Users\steelfix1\Desktop\MameUI32
[2011/02/11 16:04:38 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/02/11 08:16:04 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2011/02/11 07:38:47 | 000,000,000 | —D | C] – C:\Users\steelfix1\AppData\Roaming\Malwarebytes
[2011/02/11 07:38:41 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\windows\System32\drivers\mbamswissarmy.sys
[2011/02/11 07:38:41 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/02/11 07:38:40 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/02/11 07:38:36 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\windows\System32\drivers\mbam.sys
[2011/02/11 07:38:36 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/02/09 05:06:40 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/02/09 05:06:36 | 000,000,000 | —D | C] – C:\Users\steelfix1\AppData\Local\temp
[2011/02/09 04:55:16 | 000,000,000 | —D | C] – C:\windows\ERDNT
[2011/02/09 04:52:51 | 000,000,000 | —D | C] – C:\Qoobox
[2011/02/09 04:51:54 | 000,000,000 | —D | C] – C:\32788R22FWJFW
[2011/02/08 23:32:31 | 000,606,208 | —- | C] (Microsoft Corporation) – C:\windows\System32\mstime.dll
[2011/02/08 23:32:31 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\windows\System32\msfeeds.dll
[2011/02/08 23:32:31 | 000,381,440 | —- | C] (Microsoft Corporation) – C:\windows\System32\iedkcs32.dll
[2011/02/08 23:32:30 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\windows\System32\mshtml.tlb
[2011/02/08 23:32:30 | 000,386,048 | —- | C] (Microsoft Corporation) – C:\windows\System32\html.iec
[2011/02/08 23:32:30 | 000,185,856 | —- | C] (Microsoft Corporation) – C:\windows\System32\iepeers.dll
[2011/02/08 23:32:30 | 000,064,512 | —- | C] (Microsoft Corporation) – C:\windows\System32\msfeedsbs.dll
[2011/02/08 23:32:30 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\windows\System32\licmgr10.dll
[2011/02/08 23:32:30 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\windows\System32\msfeedssync.exe
[2011/02/08 23:12:53 | 000,294,400 | —- | C] (Adobe Systems Incorporated) – C:\windows\System32\atmfd.dll
[2011/02/08 23:12:53 | 000,034,304 | —- | C] (Adobe Systems) – C:\windows\System32\atmlib.dll
[2011/02/08 23:12:39 | 003,901,824 | —- | C] (Microsoft Corporation) – C:\windows\System32\ntoskrnl.exe
[2011/02/08 23:12:38 | 003,957,120 | —- | C] (Microsoft Corporation) – C:\windows\System32\ntkrnlpa.exe
[2011/02/08 23:08:01 | 000,204,288 | —- | C] (Microsoft Corporation) – C:\windows\System32\upnp.dll
[2011/02/08 23:07:59 | 000,080,384 | —- | C] (Microsoft Corporation) – C:\windows\System32\davclnt.dll
[2011/02/08 23:07:59 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\windows\System32\wscapi.dll
[2011/02/08 23:07:59 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\windows\System32\slwga.dll
[2011/02/08 22:55:59 | 002,329,088 | —- | C] (Microsoft Corporation) – C:\windows\System32\win32k.sys
[2011/02/08 22:55:23 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\windows\System32\jscript.dll
[2011/02/08 22:55:22 | 000,428,032 | —- | C] (Microsoft Corporation) – C:\windows\System32\vbscript.dll
[2011/02/08 22:38:38 | 000,219,008 | —- | C] (Microsoft Corporation) – C:\windows\System32\drivers\dxgmms1.sys
[2011/02/07 17:00:18 | 000,000,000 | —D | C] – C:\windows\Minidump
[2011/02/07 06:39:02 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\STOPzilla
[2011/02/07 06:38:55 | 000,000,000 | —D | C] – C:\Program Files\STOPzilla!
[2011/02/07 06:38:54 | 000,000,000 | —D | C] – C:\Program Files\Common Files\iS3
[2011/02/07 06:38:53 | 000,000,000 | —D | C] – C:\ProgramData\STOPzilla!
[2011/02/03 18:10:50 | 000,132,560 | R— | C] (iS3, Inc.) – C:\windows\System32\IS3HTUI5.dll
[2011/02/03 18:10:50 | 000,022,992 | R— | C] (iS3, Inc.) – C:\windows\System32\SZIO5.dll
[2011/02/03 18:10:48 | 000,546,256 | R— | C] (iS3, Inc.) – C:\windows\System32\SZComp5.dll
[2011/02/03 18:10:48 | 000,452,048 | R— | C] (iS3, Inc.) – C:\windows\System32\SZBase5.dll
[2011/02/03 18:10:48 | 000,398,800 | R— | C] (iS3, Inc.) – C:\windows\System32\IS3DBA5.dll
[2011/02/03 18:10:48 | 000,099,792 | R— | C] (iS3, Inc.) – C:\windows\System32\IS3Svc5.dll
[2011/02/03 18:10:48 | 000,067,024 | R— | C] (iS3, Inc.) – C:\windows\System32\IS3Hks5.dll
[2011/02/03 18:10:48 | 000,028,624 | R— | C] (iS3, Inc.) – C:\windows\System32\IS3XDat5.dll
[2011/02/03 18:10:46 | 000,738,768 | R— | C] (iS3, Inc.) – C:\windows\System32\IS3Base5.dll
[2011/02/03 18:10:46 | 000,390,608 | R— | C] (iS3, Inc.) – C:\windows\System32\IS3UI5.dll
[2011/02/03 18:10:46 | 000,230,864 | R— | C] (iS3, Inc.) – C:\windows\System32\IS3Win325.dll
[2011/02/03 18:10:46 | 000,099,792 | R— | C] (iS3, Inc.) – C:\windows\System32\IS3Inet5.dll
[2011/02/03 17:31:55 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2011/02/03 17:30:31 | 000,472,808 | —- | C] (Sun Microsystems, Inc.) – C:\windows\System32\deployJava1.dll
[2011/02/03 17:30:31 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\windows\System32\javaws.exe
[2011/02/03 17:30:31 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\windows\System32\javaw.exe
[2011/02/03 17:30:31 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\windows\System32\java.exe
[2011/02/01 10:36:10 | 001,360,472 | —- | C] (Kaspersky Lab ZAO) – C:\Users\steelfix1\Desktop\TDSSKiller.exe
[2011/01/18 17:31:49 | 000,000,000 | —D | C] – C:\Users\steelfix1\Documents\05_-_MAME_(WITH_1692_ROMS)
[2011/01/13 05:08:51 | 000,000,000 | —D | C] – C:\Users\steelfix1\AppData\Local\ElevatedDiagnostics

========== Files - Modified Within 30 Days ==========

[2011/02/12 04:39:00 | 000,000,884 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/02/12 01:56:46 | 000,002,290 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2011/02/12 01:39:00 | 000,000,880 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/02/11 17:38:11 | 000,000,960 | —- | M] () – C:\windows\System32\drivers\kgpcpy.cfg
[2011/02/11 15:09:55 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2011/02/11 08:23:11 | 000,014,736 | -H– | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/02/11 08:23:11 | 000,014,736 | -H– | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/02/11 08:16:04 | 000,001,828 | —- | M] () – C:\Users\Public\Desktop\McAfee Security Center.lnk
[2011/02/11 08:15:24 | 2388,086,784 | -HS- | M] () – C:\hiberfil.sys
[2011/02/11 07:38:41 | 000,001,071 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/02/09 21:36:06 | 000,675,612 | —- | M] () – C:\windows\System32\perfh009.dat
[2011/02/09 21:36:06 | 000,128,320 | —- | M] () – C:\windows\System32\perfc009.dat
[2011/02/09 21:34:25 | 000,002,067 | —- | M] () – C:\Users\Public\Desktop\O2 Connection Manager.lnk
[2011/02/09 03:39:28 | 000,409,784 | —- | M] () – C:\windows\System32\FNTCACHE.DAT
[2011/02/08 06:10:21 | 294,624,922 | —- | M] () – C:\windows\MEMORY.DMP
[2011/02/07 20:04:21 | 000,004,608 | —- | M] () – C:\Users\steelfix1\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/07 17:31:07 | 000,002,628 | —- | M] () – C:\Users\steelfix1\Documents\STOPzilla Black List Contents.htm
[2011/02/07 05:12:37 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2011/02/07 05:12:37 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2011/02/03 18:10:50 | 000,132,560 | R— | M] (iS3, Inc.) – C:\windows\System32\IS3HTUI5.dll
[2011/02/03 18:10:50 | 000,022,992 | R— | M] (iS3, Inc.) – C:\windows\System32\SZIO5.dll
[2011/02/03 18:10:48 | 000,546,256 | R— | M] (iS3, Inc.) – C:\windows\System32\SZComp5.dll
[2011/02/03 18:10:48 | 000,452,048 | R— | M] (iS3, Inc.) – C:\windows\System32\SZBase5.dll
[2011/02/03 18:10:48 | 000,398,800 | R— | M] (iS3, Inc.) – C:\windows\System32\IS3DBA5.dll
[2011/02/03 18:10:48 | 000,099,792 | R— | M] (iS3, Inc.) – C:\windows\System32\IS3Svc5.dll
[2011/02/03 18:10:48 | 000,067,024 | R— | M] (iS3, Inc.) – C:\windows\System32\IS3Hks5.dll
[2011/02/03 18:10:48 | 000,028,624 | R— | M] (iS3, Inc.) – C:\windows\System32\IS3XDat5.dll
[2011/02/03 18:10:46 | 000,738,768 | R— | M] (iS3, Inc.) – C:\windows\System32\IS3Base5.dll
[2011/02/03 18:10:46 | 000,390,608 | R— | M] (iS3, Inc.) – C:\windows\System32\IS3UI5.dll
[2011/02/03 18:10:46 | 000,230,864 | R— | M] (iS3, Inc.) – C:\windows\System32\IS3Win325.dll
[2011/02/03 18:10:46 | 000,099,792 | R— | M] (iS3, Inc.) – C:\windows\System32\IS3Inet5.dll
[2011/02/03 05:45:07 | 000,219,008 | —- | M] (Microsoft Corporation) – C:\windows\System32\drivers\dxgmms1.sys
[2011/02/02 00:01:03 | 000,002,275 | —- | M] () – C:\Users\steelfix1\Documents\edin 1st gold arcade.wlmp
[2011/02/01 20:54:07 | 000,000,000 | -H– | M] () – C:\windows\System32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011/02/01 10:36:10 | 001,360,472 | —- | M] (Kaspersky Lab ZAO) – C:\Users\steelfix1\Desktop\TDSSKiller.exe
[2011/01/18 09:13:44 | 019,912,166 | —- | M] () – C:\Users\steelfix1\Documents\05_-_MAME_(WITH_1692_ROMS).zip
[2011/01/13 05:12:46 | 000,000,418 | —- | M] () – C:\Users\steelfix1\Documents\CD Drive - Shortcut.lnk

========== Files Created - No Company Name ==========

[2011/02/11 08:16:15 | 000,000,960 | —- | C] () – C:\windows\System32\drivers\kgpcpy.cfg
[2011/02/11 07:38:41 | 000,001,071 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/02/09 04:55:24 | 000,098,816 | —- | C] () – C:\windows\sed.exe
[2011/02/09 04:55:24 | 000,080,412 | —- | C] () – C:\windows\grep.exe
[2011/02/09 04:55:24 | 000,068,096 | —- | C] () – C:\windows\zip.exe
[2011/02/07 20:04:21 | 000,004,608 | —- | C] () – C:\Users\steelfix1\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/07 17:31:07 | 000,002,628 | —- | C] () – C:\Users\steelfix1\Documents\STOPzilla Black List Contents.htm
[2011/02/07 17:00:12 | 294,624,922 | —- | C] () – C:\windows\MEMORY.DMP
[2011/02/07 05:12:37 | 000,000,000 | RHS- | C] () – C:\MSDOS.SYS
[2011/02/07 05:12:37 | 000,000,000 | RHS- | C] () – C:\IO.SYS
[2011/02/04 21:19:20 | 000,007,891 | —- | C] () – C:\Users\steelfix1\Documents\AdobeFlashPlayerCatalog_SCUP.xml
[2011/02/02 00:01:03 | 000,002,275 | —- | C] () – C:\Users\steelfix1\Documents\edin 1st gold arcade.wlmp
[2011/02/01 20:54:07 | 000,000,000 | -H– | C] () – C:\windows\System32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011/01/18 00:00:40 | 019,912,166 | —- | C] () – C:\Users\steelfix1\Documents\05_-_MAME_(WITH_1692_ROMS).zip
[2011/01/13 05:12:46 | 000,000,418 | —- | C] () – C:\Users\steelfix1\Documents\CD Drive - Shortcut.lnk
[2010/10/29 01:29:53 | 000,004,151 | —- | C] () – C:\ProgramData\ojobkspa.ako
[2010/03/09 13:18:31 | 000,000,002 | —- | C] () – C:\windows\HotFixList.ini
[2009/08/25 15:54:32 | 000,033,664 | —- | C] () – C:\windows\System32\drivers\TsWlan.sys
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\windows\System32\OGACheckControl.dll
[2009/07/13 23:51:43 | 000,073,728 | —- | C] () – C:\windows\System32\BthpanContextHandler.dll
[2009/07/13 23:42:10 | 000,064,000 | —- | C] () – C:\windows\System32\BWContextHandler.dll

========== LOP Check ==========

[2011/02/07 07:18:51 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\4shared Desktop
[2010/10/24 21:27:52 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\GrabPro
[2010/10/29 01:29:55 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\MOVAVI
[2010/11/29 22:18:30 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\Movavi Video Converter 10
[2010/10/24 21:27:28 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\OpenCandy
[2011/02/12 04:57:22 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\Orbit
[2010/10/24 21:41:41 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\ProgSense
[2011/02/10 05:42:50 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\SoftGrid Client
[2010/10/23 21:20:59 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\Tatara Systems
[2010/10/24 20:27:16 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\TP
[2010/10/30 03:55:29 | 000,000,000 | —D | M] – C:\Users\steelfix1\AppData\Roaming\Usenet.nl
[2011/02/08 07:47:25 | 000,032,654 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/06/10 21:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2011/02/09 05:06:34 | 000,015,644 | —- | M] () – C:\ComboFix.txt
[2009/06/10 21:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2011/02/11 08:15:24 | 2388,086,784 | -HS- | M] () – C:\hiberfil.sys
[2011/02/07 05:12:37 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2011/02/07 05:12:37 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2011/02/11 08:15:28 | 3184,119,808 | -HS- | M] () – C:\pagefile.sys
[2009/11/12 02:15:48 | 000,002,047 | —- | M] () – C:\RHDSetup.log
[2009/11/12 02:30:42 | 000,000,166 | —- | M] () – C:\Setup.log
[2011/02/08 20:25:52 | 000,071,230 | —- | M] () – C:\TDSSKiller.2.4.16.0_08.02.2011_20.23.57_log.txt
[2011/02/08 20:30:42 | 000,002,144 | —- | M] () – C:\TDSSKiller.2.4.16.0_08.02.2011_20.30.19_log.txt

< %systemroot%\Fonts\*.com >
[2009/07/14 04:52:25 | 000,026,040 | —- | M] () – C:\windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 04:52:25 | 000,026,489 | —- | M] () – C:\windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 04:52:25 | 000,029,779 | —- | M] () – C:\windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 04:52:25 | 000,043,318 | —- | M] () – C:\windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 21:31:19 | 000,000,065 | —- | M] () – C:\windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/14 01:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2009/07/14 01:16:19 | 000,029,696 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/09/23 00:32:56 | 000,301,936 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 04:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/10/23 21:20:41 | 000,000,221 | -HS- | M] () – C:\Users\steelfix1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/07/30 21:41:27 | 009,425,835 | —- | M] (Igor Pavlov) – C:\Users\steelfix1\Desktop\MameUI32.139.exe
[2010/07/30 21:41:16 | 010,070,886 | —- | M] (Igor Pavlov) – C:\Users\steelfix1\Desktop\MameUI64.139.exe
[2011/02/01 10:36:10 | 001,360,472 | —- | M] (Kaspersky Lab ZAO) – C:\Users\steelfix1\Desktop\TDSSKiller.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2009/06/10 21:20:04 | 000,000,802 | —- | M] () – C:\Windows\addins\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2010/10/24 02:31:02 | 000,000,402 | -HS- | M] () – C:\Users\steelfix1\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2010/10/29 01:29:53 | 000,004,151 | —- | M] () – C:\ProgramData\ojobkspa.ako

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-02-09 03:03:48

< >

< >

< End of report >

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI