What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Think this computer is in virus overload

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi everybody. I recently got a computer off my Brother whilst I wait on a new one being delivered but this thing seems to be full of viruses. Over the last few days I've noticed -

1The audio from ads begin playing through IE, even though I've not started it. It disappears after the advert is complete (Seems to be for Vanish Wash, though I doubt that means anything).
2When I'm doing a google search on Firefox, when I click a link, it directs me to somewhere else entirely. For example, when searching for this forum I was taken to "http://www.southwesttraining.com/". This happens more often than not.
3When I try to bring up the task manager is says "Windows cannot find 'C:\Windows\system32\taskmgr.exe". Make sure you typed the name correctly, and then try again." This is when I right click the task bar and select task manager. When I try going through CTRL, Alt + Delete and select Task Manager, nothing happens at all.

When I was running HijackThis I also recieved this notificiation, I'm not sure if it points to another virus or something :

For some reason your system denied write acces to the Hosts file. If any hijacked domains are in this file, HiJackThis may NOT be able to fix this. If that happens, you need to edit the file yourself". Then gives me instructions on how to do it.

This is what HijackThis gave me :

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:03:00, on 02/03/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.19019)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Acer\Empowering Technology\SysMonitor.exe
C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Northstar\SmartCopy\SmartCopy.exe
C:\Program Files\Northstar\SmartLauncher\SmartLauncher.exe
C:\Users\Deception\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…;m=aspire_m3201
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.ask.com?o=14306&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…;m=aspire_m3201
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…;m=aspire_m3201
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {472734EA-242A-422b-ADF8-83D1E48CC825} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Program Files\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [EmpoweringTechnology] C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe boot
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [TrayServer] C:\Program Files\MAGIX\Movies on DVD 7\TrayServer.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [cUMFnOImmwEhX.exe] C:\ProgramData\cUMFnOImmwEhX.exe
O4 - HKCU\..\Run: [D6DXJ8uGBxe] C:\ProgramData\D6DXJ8uGBxe.exe
O4 - HKCU\..\Run: [RemoveIT Pro v7Ent] C:\Program Files\InCode Solutions\RemoveIT Pro v7 Enterprise\removeit.exe
O4 - Startup: Dropbox.lnk = C:\Users\Deception\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: SmartCopy.lnk = C:\Program Files\Northstar\SmartCopy\SmartCopy.exe
O4 - Global Startup: SmartLauncher.lnk = C:\Program Files\Northstar\SmartLauncher\SmartLauncher.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: digiSPTIService - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Pro Tools\digiSPTIService.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe

–
End of file - 10432 bytes


Thank you in advance for anyone that can help in anyway, I really appreciate it x
Post #2
Hi UrMyStar, welcome to the forum.

To make cleaning this machine easier
  • Please do not uninstall/install any programs unless asked to
    It is more difficult when files/programs are appearing in/disappearing from the logs.
  • Please do not run any scans other than those requested
  • Please follow all instructions in the order posted
  • All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
  • Do not attach any logs/reports, etc.. unless specifically requested to do so.
  • If you have problems with or do not understand the instructions, Please ask before continuing.
  • Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Open hijackthis, do a system scan only and checkmark these lines, if present


O4 - HKCU\..\Run: [cUMFnOImmwEhX.exe] C:\ProgramData\cUMFnOImmwEhX.exe
O4 - HKCU\..\Run: [D6DXJ8uGBxe] C:\ProgramData\D6DXJ8uGBxe.exe


Close ALL other windows/browsers and click Fix Checked. Answer Yes if prompted. Close HJT.

Reboot your computer.

Next

Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.

Next

Go HERE to get a randomly named copy of GMER. Scroll down to the Download section and click Download EXE. Save it to your desktop.

Before scanning with GMER, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

  • Right click on the file you downloaded and click "Run as Adminstrator" . If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If GMER will not run in normal windows, please run it in Safe Mode

Next

Please download DDS and save it to your desktop.
  • Disable any script blocking protection
  • Right click dds.scr and click "Run as Adminstrator" to run the tool.
  • When done, DDS.txt will open.An additional log called Attach.txt should appear minimized on the task bar.
  • Save both reports to your desktop before closing the DDS window.

Please post back with
  • MBRCheck log
  • GMER log
  • Both logs from DDS
Thanks
Post #4
Hi UrMyStar,

I see you do not have an active antivirus program installed. I will give you link to some good free ones after we are finished. Please limit the internet activity of this computer to this thread and downloading tools.

Please read through the instructions to familarize youself with what to expect when the tool runs.

It is vitally important that combofix is renamed before it is even started to download


Please download ComboFix from Link 1or Link 2 to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

  • If you are using Firefox, make sure that your download settings are as follows:
    -Tools->Options->Main tab
    -Set to "Always ask me where to Save the files".
  • During the download, before you save it to your desktop, rename Combofix to jgh.exe

  • It is important you rename Combofix during the download, but not after.
  • Please do not rename Combofix to other names, but only to the one indicated.
  • Close any open browsers/windows before running the tool.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
  • Right click on combofix.exe (jgh.exe), click Run as Administrator & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with the combofix log. How's the computer?

Thanks
Post #5
Hi :) I've attached the log. The computer seems okay. I had a couple of the ads after I had ran the first set of instructions. Just now, I've not had anything but I still can't get Task Manager and there is also no programs running in the system tray apart from my internet connection and my audio control. I don't know if this is normal?

Attachments:

Post #6
Hi UrMyStar,

Looks like we got most of it. Le's see if we can sort out the other problems.

Download OTL to your desktop.
  • Right click on OTL.exe and click "Run as Administrator" to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output
  • Check the boxes beside LOP Check and Purity Check.
  • In the window under Custom Scans/Fixes copy and paste the following



    /md5start
    iexplore.*
    explorer.*
    winlogon.*
    dll
    zx.dll
    hlp.dat
    D6DXJ8uGBxe.exe
    cUMFnOImmwEhX.exe
    geyekrwsp.dll
    taskmgr.*
    olepro32.dll
    /md5stop
    c:\users\Deception\AppData\Roaming\Muzap\*.* /s
    C:\users\Deception\AppData\Roaming\Fyiw\*.* /s

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. Please post only the OTL.txt.

Please copy and paste the log into your next reply.

Thanks
Post #7
Thanks for the quick responses, I really appreciate it.

This is the OTL.txt you asked me to copy and paste :)

OTL logfile created on: 03/03/2011 01:18:27 - Run 1
OTL by OldTimer - Version 3.2.22.2 Folder = C:\Users\Deception\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 64.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 113.36 Gb Total Space | 34.70 Gb Free Space | 30.61% Space Free | Partition Type: NTFS
Drive D: | 170.08 Gb Total Space | 88.00 Gb Free Space | 51.74% Space Free | Partition Type: NTFS
Drive E: | 4.38 Gb Total Space | 0.19 Gb Free Space | 4.36% Space Free | Partition Type: UDF

Computer Name: DECEPTION-PC | User Name: Deception | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Deception\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Digidesign\Drivers\MMERefresh.exe (Digidesign, A Division of Avid Technology, Inc.)
PRC - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
PRC - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe ()
PRC - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe (CyberLink)


========== Modules (SafeList) ==========

MOD - C:\Users\Deception\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (BJDEMB) – File not found
SRV - (AudioEndpointBuilderRpcSs) – File not found
SRV - (Akamai) – c:\Program Files\Common Files\Akamai\netsession_win_dbc0250.dll ()
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (DigiRefresh) – C:\Program Files\Digidesign\Drivers\MMERefresh.exe (Digidesign, A Division of Avid Technology, Inc.)
SRV - (digiSPTIService) – C:\Program Files\Digidesign\Pro Tools\digiSPTIService.exe (Digidesign, A Division of Avid Technology, Inc.)
SRV - (LBTServ) – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (eDataSecurity Service) – C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
SRV - (ETService) – C:\Program Files\Acer\Empowering Technology\Service\ETService.exe ()
SRV - (Acer HomeMedia Connect Service) – C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe (CyberLink)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (UPnPService) – C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe (Magix AG)
SRV - (FirebirdServerMAGIXInstance) – C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe (MAGIX®)


========== Driver Services (SafeList) ==========

DRV - (catchme) – File not found
DRV - (pxrts) – C:\Windows\System32\drivers\pxrts.sys (Prevx)
DRV - (pxscan) – C:\Windows\System32\drivers\pxscan.sys (Prevx)
DRV - (pxkbf) – C:\Windows\System32\drivers\pxkbf.sys (Prevx)
DRV - (dtsoftbus01) – C:\Windows\System32\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV - (NPF) – C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (appliandMP) – C:\Windows\System32\drivers\appliand.sys (Applian Technologies Inc.)
DRV - (appliand) – C:\Windows\System32\drivers\appliand.sys (Applian Technologies Inc.)
DRV - (StarOpen) – C:\Windows\System32\drivers\StarOpen.sys ()
DRV - (WMDrive) – C:\Windows\System32\drivers\WMDrive.sys ()
DRV - (SAVRKBootTasks) – C:\Windows\System32\SAVRKBootTasks.sys (Sophos Plc)
DRV - (DigiNet) – C:\Windows\System32\drivers\diginet.sys (Digidesign, A Division of Avid Technology, Inc.)
DRV - (dalwdmservice) – C:\Windows\System32\drivers\Dalwdm.sys (Digidesign, A Division of Avid Technology, Inc.)
DRV - (LMouKE) – C:\Windows\System32\drivers\LMouKE.Sys (Logitech, Inc.)
DRV - (LMouFilt) – C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (L8042mou) – C:\Windows\System32\drivers\L8042mou.Sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (L8042Kbd) – C:\Windows\System32\drivers\L8042Kbd.sys (Logitech, Inc.)
DRV - (iLokDrvr) – C:\Windows\System32\drivers\iLokDrvr.sys (PACE Anti-Piracy, Inc.)
DRV - (TPkd) – C:\Windows\System32\drivers\TPkd.sys (PACE Anti-Piracy, Inc.)
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (int15) – C:\Windows\System32\drivers\int15.sys (Acer, Inc.)
DRV - (USB28xxBGA) – C:\Windows\System32\drivers\emBDA.sys (eMPIA Technology, Inc.)
DRV - (tvicport) – C:\Windows\System32\drivers\TVicPort.sys (EnTech Taiwan)
DRV - (zntport) – C:\Windows\System32\drivers\zntport.sys (Zeal SoftStudio)
DRV - (ahcix86s) – C:\Windows\system32\drivers\ahcix86s.sys (AMD Technologies Inc.)
DRV - (USB28xxOEM) – C:\Windows\System32\drivers\emOEM.sys (eMPIA Technology, Inc.)
DRV - (AtiPcie) ATI PCI Express (3GIO) – C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)
DRV - (sscdmdm) – C:\Windows\System32\drivers\sscdmdm.sys (MCCI)
DRV - (sscdmdfl) – C:\Windows\System32\drivers\sscdmdfl.sys (MCCI)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) – C:\Windows\System32\drivers\sscdbus.sys (MCCI)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…;m=aspire_m3201

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://global.acer.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://uk.ask.com?o=14306&l;=dis
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = ;*.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.digitalspy.co.uk/"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.5.0.429
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.1
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.10
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.071301000019
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0.8
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:1.11
FF - prefs.js..extensions.enabledItems: [removed]:0.8.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {07b2a769-ed19-4483-87ce-c643914c9626}:1.6
FF - prefs.js..extensions.enabledItems: {2458abc0-f443-11dd-87af-0800200c9a66}:3.6.3.1.03.04.10

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.14\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/02 10:40:00 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.14\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/02 10:40:00 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0b2\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 2\components [2010/12/09 13:21:33 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0b2\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 2\plugins

[2010/01/18 20:37:09 | 000,000,000 | —D | M] (No name found) – C:\Users\Deception\AppData\Roaming\Mozilla\Extensions
[2010/01/18 20:37:08 | 000,000,000 | —D | M] (No name found) – C:\Users\Deception\AppData\Roaming\Mozilla\Extensions\[removed]
[2009/05/07 09:27:03 | 000,000,000 | —D | M] (No name found) – C:\Users\Deception\AppData\Roaming\Mozilla\Extensions\[removed]
[2011/03/02 23:12:02 | 000,000,000 | —D | M] (No name found) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\170innu8.deception\extensions
[2010/11/16 10:45:55 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\170innu8.deception\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/02/17 10:12:05 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\170innu8.deception\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/02/09 13:28:43 | 000,000,000 | —D | M] (Pixlr Grabber) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\170innu8.deception\extensions\{d47a9f51-8281-43fa-f450-f28ef8735e9a}
[2011/02/09 13:28:39 | 000,000,000 | —D | M] (DownThemAll!) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\170innu8.deception\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2011/02/09 13:28:43 | 000,000,000 | —D | M] (Greasemonkey) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\170innu8.deception\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011/01/14 22:22:05 | 000,000,000 | —D | M] (PhotoJacker: Photo Album Downloader for Facebook (fka FacePAD)) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\170innu8.deception\extensions\[removed]
[2010/11/16 11:22:44 | 000,000,000 | —D | M] (Linky) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\170innu8.deception\extensions\[removed]
[2010/11/16 11:22:44 | 000,000,000 | —D | M] (MegaUpload DownloadHelper) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\170innu8.deception\extensions\[removed]
[2010/11/16 11:25:04 | 000,000,000 | —D | M] (Multi Links) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\170innu8.deception\extensions\multilinks@plugin
[2010/11/16 11:22:50 | 000,000,000 | —D | M] (Cooliris) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\170innu8.deception\extensions\[removed]
[2010/11/16 11:22:44 | 000,000,000 | —D | M] (RapidShare DownloadHelper) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\170innu8.deception\extensions\[removed]
[2011/02/17 10:12:05 | 000,000,000 | —D | M] (TinEye Reverse Image Search) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\170innu8.deception\extensions\[removed]
[2010/11/16 11:22:44 | 000,000,000 | —D | M] (1-Click YouTube Video Downloader) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\170innu8.deception\extensions\[removed]
[2010/11/15 22:18:32 | 000,000,000 | —D | M] (No name found) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\vh7tkqx5.default\extensions
[2009/11/03 09:15:29 | 000,000,000 | —D | M] (ANTHEM) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\vh7tkqx5.default\extensions\{07b2a769-ed19-4483-87ce-c643914c9626}
[2010/05/30 15:30:13 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\vh7tkqx5.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/04/10 07:51:27 | 000,000,000 | —D | M] (Bloody Red) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\vh7tkqx5.default\extensions\{2458abc0-f443-11dd-87af-0800200c9a66}
[2010/10/14 16:07:42 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\vh7tkqx5.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/09/04 12:56:48 | 000,000,000 | —D | M] (Adblock Plus) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\vh7tkqx5.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/05/30 15:30:12 | 000,000,000 | —D | M] (DownThemAll!) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\vh7tkqx5.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2010/04/10 07:51:33 | 000,000,000 | —D | M] (Greasemonkey) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\vh7tkqx5.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010/10/30 23:18:06 | 000,000,000 | —D | M] (FacePAD: Facebook Photo Album Downloader) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\vh7tkqx5.default\extensions\[removed]
[2009/06/01 17:54:51 | 000,000,000 | —D | M] (Move Media Player) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\vh7tkqx5.default\extensions\[removed]
[2010/02/11 21:58:00 | 000,000,000 | —D | M] (Snap Links Plus) – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\vh7tkqx5.default\extensions\[removed]
[2009/07/17 23:02:48 | 000,002,476 | —- | M] () – C:\Users\Deception\AppData\Roaming\Mozilla\Firefox\Profiles\vh7tkqx5.default\searchplugins\BearShareWebSearch.xml
[2011/02/16 00:09:23 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/06/26 11:16:09 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/23 17:22:50 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/12/04 13:32:46 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/08 12:43:03 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/02/16 00:09:23 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
File not found (No name found) – C:\PROGRAM FILES\AUTOCOMPLETEPRO\[removed]
File not found (No name found) – C:\PROGRAM FILES\AVG\AVG8\FIREFOX
[2009/12/05 09:08:30 | 000,000,000 | —D | M] (RealPlayer Browser Record Plugin) – C:\PROGRAM FILES\REAL\REALPLAYER\BROWSERRECORD\FIREFOX\EXT
[2011/02/02 21:40:24 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2011/03/02 22:24:47 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - Reg Error: Value error. File not found
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\Program Files\real\realplayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - File not found
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Value error. File not found
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\Program Files\Acer\Empowering Technology\SysMonitor.exe ()
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe (Digidesign, A Division of Avid Technology, Inc.)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated)
O4 - HKLM..\Run: [EmpoweringTechnology] File not found
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe ()
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TrayServer] C:\Program Files\MAGIX\Movies on DVD 7\Trayserver.exe (MAGIX AG)
O4 - HKLM..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Incorporated)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - Startup: C:\Users\Deception\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Deception\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Deception\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Deception\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 21:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – Reg Error: Key error. File not found

========== Files/Folders - Created Within 30 Days ==========

[2011/03/03 01:15:40 | 000,581,120 | —- | C] (OldTimer Tools) – C:\Users\Deception\Desktop\OTL.exe
[2011/03/02 22:30:51 | 000,000,000 | —D | C] – C:\Users\Deception\AppData\Local\temp
[2011/03/02 22:29:52 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/03/02 22:07:26 | 000,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/03/02 22:07:26 | 000,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/03/02 22:07:26 | 000,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/03/02 21:57:19 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2011/03/02 21:52:06 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2011/03/02 21:51:45 | 000,000,000 | —D | C] – C:\Qoobox
[2011/03/02 10:59:16 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2011/03/02 10:59:16 | 000,000,000 | —D | C] – C:\Users\Deception\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011/03/02 01:09:49 | 000,000,000 | —D | C] – C:\Users\Deception\Documents\My Streaming Media
[2011/03/02 01:09:44 | 000,000,000 | —D | C] – C:\Users\Deception\AppData\Local\Jaksta_Technologies_Pty_L
[2011/03/02 01:07:54 | 000,000,000 | —D | C] – C:\Users\Deception\AppData\Roaming\Replay Media Catcher 4
[2011/03/02 01:07:45 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Applian Technologies
[2011/03/02 01:07:41 | 000,000,000 | —D | C] – C:\Program Files\Applian Technologies
[2011/03/01 22:19:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RemoveIT Pro v7 (Trial)
[2011/03/01 22:19:14 | 000,000,000 | —D | C] – C:\Program Files\InCode Solutions
[2011/03/01 22:12:25 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/03/01 22:11:18 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/03/01 22:10:44 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/03/01 22:09:03 | 000,000,000 | —D | C] – C:\Program Files\SecurityXploded
[2011/03/01 22:05:01 | 000,076,696 | —- | C] (Prevx) – C:\Windows\System32\drivers\pxrts.sys
[2011/03/01 22:05:00 | 000,026,096 | —- | C] (Prevx) – C:\Windows\System32\drivers\pxkbf.sys
[2011/02/28 23:26:32 | 000,000,000 | —D | C] – C:\Users\Deception\Documents\My Received Files
[2011/02/27 14:58:29 | 000,000,000 | —D | C] – C:\Users\Deception\AppData\Roaming\Muzap
[2011/02/27 14:58:29 | 000,000,000 | —D | C] – C:\Users\Deception\AppData\Roaming\Fyiw
[2011/02/23 15:03:50 | 000,000,000 | —D | C] – C:\Windows\System32\WindowsPowerShell
[2011/02/23 15:01:43 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrsmgr.dll
[2011/02/23 15:01:23 | 000,040,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrs.exe
[2011/02/23 15:01:23 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrshost.exe
[2011/02/23 15:01:23 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wsmprovhost.exe
[2011/02/23 15:01:21 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wsmplpxy.dll
[2011/02/23 15:01:21 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrssrv.dll
[2011/02/23 15:01:19 | 000,081,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wevtfwd.dll
[2011/02/23 15:01:19 | 000,079,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wecutil.exe
[2011/02/23 15:01:19 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wecapi.dll
[2011/02/23 15:01:19 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WsmRes.dll
[2011/02/23 15:01:19 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pwrshplugin.dll
[2011/02/23 15:01:09 | 000,252,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WSManMigrationPlugin.dll
[2011/02/23 15:01:09 | 000,246,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WSManHTTPConfig.exe
[2011/02/23 15:01:09 | 000,241,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrscmd.dll
[2011/02/23 15:01:09 | 000,214,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WsmWmiPl.dll
[2011/02/23 15:01:09 | 000,145,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WsmAuto.dll
[2011/02/18 19:06:53 | 000,000,000 | —D | C] – C:\myDiary
[2011/02/18 19:06:15 | 000,000,000 | —D | C] – C:\Program Files\Diary
[2011/02/18 18:07:59 | 000,000,000 | —D | C] – C:\Users\Deception\Documents\Book
[2011/02/16 00:09:41 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2011/02/16 00:09:01 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2011/02/16 00:09:01 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2011/02/16 00:09:01 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2011/02/14 15:17:43 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HideMyBrowserFree
[2011/02/14 15:17:42 | 000,000,000 | —D | C] – C:\Program Files\HideMyBrowserFree
[2011/02/10 23:14:48 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\C-Force
[2011/02/10 23:14:34 | 000,286,720 | —- | C] (Microsoft Corporation) – C:\Windows\Setup1.exe
[2011/02/10 23:14:32 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\ST6UNST.EXE
[2011/02/09 13:25:15 | 002,039,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/02/09 13:25:12 | 003,602,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2011/02/09 13:25:12 | 003,550,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2011/02/09 13:25:05 | 001,172,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10warp.dll
[2011/02/09 13:25:05 | 001,068,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DWrite.dll
[2011/02/09 13:25:04 | 001,554,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xpsservices.dll
[2011/02/09 13:25:04 | 000,979,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MFH264Dec.dll
[2011/02/09 13:25:04 | 000,876,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsPrint.dll
[2011/02/09 13:25:04 | 000,683,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d2d1.dll
[2011/02/09 13:25:04 | 000,288,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsGdiConverter.dll
[2011/02/09 13:25:04 | 000,135,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsRasterService.dll
[2011/02/09 13:25:03 | 000,357,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MFHEAACdec.dll
[2011/02/09 13:25:03 | 000,302,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfmp4src.dll
[2011/02/09 13:25:03 | 000,261,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfreadwrite.dll
[2011/02/09 13:25:02 | 002,873,344 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mf.dll
[2011/02/09 13:25:02 | 001,029,120 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10.dll
[2011/02/09 13:25:02 | 000,847,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\OpcServices.dll
[2011/02/09 13:25:02 | 000,478,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxgi.dll
[2011/02/09 13:25:02 | 000,219,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1core.dll
[2011/02/09 13:25:02 | 000,160,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1.dll
[2011/02/09 13:25:01 | 000,667,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\printfilterpipelinesvc.exe
[2011/02/09 13:25:01 | 000,486,400 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10level9.dll
[2011/02/09 13:25:01 | 000,209,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfplat.dll
[2011/02/09 13:25:01 | 000,189,952 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10core.dll
[2011/02/09 13:25:00 | 000,098,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfps.dll
[2011/02/09 13:25:00 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cdd.dll
[2011/02/09 13:25:00 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\printfilterpipelineprxy.dll
[2011/02/09 13:24:49 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/02/09 13:24:49 | 000,602,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/02/09 13:24:48 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/02/09 13:24:48 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/02/09 13:24:48 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/02/09 13:24:48 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/02/09 13:24:48 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/02/09 13:24:48 | 000,173,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/02/09 13:24:48 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/02/09 13:24:48 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/02/09 13:24:48 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/02/09 13:24:48 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2011/02/09 13:24:48 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2011/02/09 13:24:48 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/02/09 13:24:48 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/02/09 13:24:48 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/02/09 13:24:48 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/02/09 13:24:42 | 000,292,352 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2011/02/09 13:24:42 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2011/02/07 11:22:46 | 000,000,000 | —D | C] – C:\ProgramData\WinMount
[2011/02/07 11:11:59 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Python 2.7
[2011/02/07 11:11:16 | 000,000,000 | —D | C] – C:\Python27
[2011/02/07 11:09:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Blender Foundation
[2011/02/07 11:08:23 | 000,000,000 | —D | C] – C:\Users\Deception\AppData\Roaming\Blender Foundation
[2011/02/07 10:56:50 | 000,000,000 | —D | C] – C:\ProgramData\NCH Swift Sound
[2011/02/07 10:56:47 | 000,000,000 | —D | C] – C:\ProgramData\NCH Software
[2011/02/07 10:56:25 | 000,000,000 | —D | C] – C:\Program Files\NCH Software
[2011/02/07 10:56:22 | 000,000,000 | —D | C] – C:\Users\Deception\AppData\Roaming\NCH Software
[2011/02/05 01:53:34 | 000,000,000 | —D | C] – C:\Users\Deception\Documents\Camtasia Studio
[2011/02/05 01:52:20 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Camtasia Studio 7
[2011/02/05 01:51:53 | 000,000,000 | —D | C] – C:\Program Files\Common Files\TechSmith Shared
[2011/02/05 01:51:50 | 000,000,000 | —D | C] – C:\Program Files\TechSmith
[2011/02/01 11:37:47 | 000,000,000 | —D | C] – C:\Users\Deception\Documents\MAGIX downloads
[2011/01/25 00:33:00 | 000,426,496 | —- | C] (IECorp) – C:\ProgramData\ddFCbyTMrPiox.dll
[2010/08/09 09:47:50 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Users\Deception\AppData\Local\filever.exe
[2008/07/22 08:01:25 | 000,049,152 | —- | C] ( ) – C:\Windows\Interop.IWshRuntimeLibrary.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/03/03 01:15:41 | 000,581,120 | —- | M] (OldTimer Tools) – C:\Users\Deception\Desktop\OTL.exe
[2011/03/03 00:24:27 | 000,003,216 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/03/03 00:24:27 | 000,003,216 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/03/02 22:31:56 | 000,608,760 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/03/02 22:31:56 | 000,108,268 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/03/02 22:24:47 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2011/03/02 22:24:26 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/03/02 21:50:45 | 004,279,013 | R— | M] () – C:\Users\Deception\Desktop\jgh.exe
[2011/03/02 19:58:34 | 000,624,128 | —- | M] () – C:\Users\Deception\Desktop\dds.scr
[2011/03/02 19:05:57 | 000,296,448 | —- | M] () – C:\Users\Deception\Desktop\ic0l8zmy.exe
[2011/03/02 10:59:16 | 000,001,956 | —- | M] () – C:\Users\Deception\Desktop\HiJackThis.lnk
[2011/03/02 05:52:00 | 359,250,673 | —- | M] () – C:\Windows\MEMORY.DMP
[2011/03/02 01:07:45 | 000,001,956 | —- | M] () – C:\Users\Public\Desktop\Replay Media Catcher 4.lnk
[2011/03/01 23:40:32 | 092,301,534 | —- | M] () – C:\Users\Deception\Desktop\xxxstewartuk.mp4
[2011/03/01 23:07:36 | 000,029,372 | —- | M] () – C:\Users\Deception\AppData\Roaming\wklnhst.dat
[2011/03/01 22:12:26 | 000,001,628 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/03/01 22:05:01 | 000,076,696 | —- | M] (Prevx) – C:\Windows\System32\drivers\pxrts.sys
[2011/03/01 22:05:01 | 000,032,008 | —- | M] (Prevx) – C:\Windows\System32\drivers\pxscan.sys
[2011/03/01 22:05:00 | 000,026,096 | —- | M] (Prevx) – C:\Windows\System32\drivers\pxkbf.sys
[2011/03/01 22:04:54 | 000,000,293 | —- | M] () – C:\Windows\wininit.ini
[2011/03/01 00:33:30 | 000,010,240 | —- | M] () – C:\Users\Deception\Documents\Tweets.wps
[2011/02/28 23:41:53 | 000,009,216 | —- | M] () – C:\Users\Deception\Desktop\Reflections of my Former Self.wps
[2011/02/28 02:38:53 | 000,009,216 | —- | M] () – C:\Users\Deception\Documents\mastercard.wps
[2011/02/28 00:38:02 | 000,052,289 | —- | M] () – C:\Users\Deception\Desktop\madison_welch_madison_with_zoe_stollery_cqoKHES.sized.jpg
[2011/02/27 21:55:13 | 000,010,240 | —- | M] () – C:\Users\Deception\Documents\macs stuff.wps
[2011/02/27 09:51:37 | 007,406,924 | R— | M] () – C:\Users\Deception\Desktop\MadisonWelch_Zoo_May_D6.avi
[2011/02/27 02:00:42 | 000,075,571 | —- | M] () – C:\Users\Deception\Desktop\jordan_619_233284a.jpg
[2011/02/27 00:28:02 | 000,009,216 | —- | M] () – C:\Users\Deception\Documents\19.wps
[2011/02/27 00:05:22 | 000,009,216 | —- | M] () – C:\Users\Deception\Documents\Shorts (Horror).wps
[2011/02/26 01:13:39 | 000,158,720 | —- | M] () – C:\Users\Deception\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/23 19:41:15 | 000,025,403 | —- | M] () – C:\Users\Deception\Desktop\Abi.jpg
[2011/02/22 19:31:47 | 022,032,089 | —- | M] () – C:\Users\Deception\Desktop\another geordie%20slut.3g2
[2011/02/20 21:56:31 | 093,073,574 | —- | M] () – C:\Users\Deception\Desktop\New Video(8).flv
[2011/02/20 21:46:14 | 024,983,542 | —- | M] () – C:\Users\Deception\Desktop\Sweetvanillaa 26.10.10.avi
[2011/02/20 21:18:31 | 000,033,792 | —- | M] () – C:\Users\Deception\Documents\Big DVD Case.xlr
[2011/02/20 02:51:18 | 000,011,776 | —- | M] () – C:\Users\Deception\Documents\Series.wps
[2011/02/19 16:55:34 | 028,688,591 | —- | M] () – C:\Users\Deception\Desktop\Andrepeated 30.flv
[2011/02/19 16:46:52 | 000,010,752 | —- | M] () – C:\Users\Deception\Documents\dvds.wps
[2011/02/19 16:13:27 | 000,000,870 | —- | M] () – C:\Users\Deception\Desktop\DVD Profiler.lnk
[2011/02/17 19:01:56 | 000,286,720 | —- | M] (Microsoft Corporation) – C:\Windows\Setup1.exe
[2011/02/10 23:14:33 | 000,073,216 | —- | M] (Microsoft Corporation) – C:\Windows\ST6UNST.EXE
[2011/02/09 19:01:23 | 000,000,929 | —- | M] () – C:\Users\Deception\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2011/02/09 15:24:08 | 003,735,856 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/02/02 21:40:39 | 000,157,472 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2011/02/02 21:40:38 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2011/02/02 21:40:36 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2011/02/02 21:40:23 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\deployJava1.dll
[2011/02/02 17:11:20 | 000,222,080 | —- | M] (Microsoft Corporation) – C:\Windows\System32\MpSigStub.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/03/02 22:07:26 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2011/03/02 22:07:26 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/03/02 22:07:26 | 000,089,088 | —- | C] () – C:\Windows\MBR.exe
[2011/03/02 22:07:26 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/03/02 22:07:26 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/03/02 21:50:27 | 004,279,013 | R— | C] () – C:\Users\Deception\Desktop\jgh.exe
[2011/03/02 19:58:30 | 000,624,128 | —- | C] () – C:\Users\Deception\Desktop\dds.scr
[2011/03/02 19:05:56 | 000,296,448 | —- | C] () – C:\Users\Deception\Desktop\ic0l8zmy.exe
[2011/03/02 10:59:16 | 000,001,956 | —- | C] () – C:\Users\Deception\Desktop\HiJackThis.lnk
[2011/03/02 01:07:45 | 000,001,956 | —- | C] () – C:\Users\Public\Desktop\Replay Media Catcher 4.lnk
[2011/03/01 23:37:01 | 092,301,534 | —- | C] () – C:\Users\Deception\Desktop\xxxstewartuk.mp4
[2011/03/01 22:12:26 | 000,001,628 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/03/01 11:44:27 | 359,250,673 | —- | C] () – C:\Windows\MEMORY.DMP
[2011/02/28 23:41:53 | 000,009,216 | —- | C] () – C:\Users\Deception\Desktop\Reflections of my Former Self.wps
[2011/02/28 02:38:50 | 000,009,216 | —- | C] () – C:\Users\Deception\Documents\mastercard.wps
[2011/02/28 00:37:59 | 000,052,289 | —- | C] () – C:\Users\Deception\Desktop\madison_welch_madison_with_zoe_stollery_cqoKHES.sized.jpg
[2011/02/27 19:57:17 | 000,010,240 | —- | C] () – C:\Users\Deception\Documents\macs stuff.wps
[2011/02/27 09:51:37 | 007,406,924 | R— | C] () – C:\Users\Deception\Desktop\MadisonWelch_Zoo_May_D6.avi
[2011/02/27 02:00:36 | 000,075,571 | —- | C] () – C:\Users\Deception\Desktop\jordan_619_233284a.jpg
[2011/02/27 00:28:02 | 000,009,216 | —- | C] () – C:\Users\Deception\Documents\19.wps
[2011/02/27 00:04:44 | 000,009,216 | —- | C] () – C:\Users\Deception\Documents\Shorts (Horror).wps
[2011/02/23 19:41:12 | 000,025,403 | —- | C] () – C:\Users\Deception\Desktop\Abi.jpg
[2011/02/23 15:01:11 | 000,201,184 | —- | C] () – C:\Windows\System32\winrm.vbs
[2011/02/23 15:01:11 | 000,004,675 | —- | C] () – C:\Windows\System32\wsmanconfig_schema.xml
[2011/02/23 15:01:11 | 000,002,426 | —- | C] () – C:\Windows\System32\WsmTxt.xsl
[2011/02/22 19:30:40 | 022,032,089 | —- | C] () – C:\Users\Deception\Desktop\another geordie%20slut.3g2
[2011/02/20 21:47:58 | 093,073,574 | —- | C] () – C:\Users\Deception\Desktop\New Video(8).flv
[2011/02/20 21:43:29 | 024,983,542 | —- | C] () – C:\Users\Deception\Desktop\Sweetvanillaa 26.10.10.avi
[2011/02/20 19:18:32 | 000,033,792 | —- | C] () – C:\Users\Deception\Documents\Big DVD Case.xlr
[2011/02/19 16:54:33 | 028,688,591 | —- | C] () – C:\Users\Deception\Desktop\Andrepeated 30.flv
[2011/02/19 16:13:27 | 000,000,870 | —- | C] () – C:\Users\Deception\Desktop\DVD Profiler.lnk
[2011/02/18 15:11:19 | 000,011,776 | —- | C] () – C:\Users\Deception\Documents\Series.wps
[2011/02/10 13:08:56 | 000,001,666 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AccessDiver.lnk
[2011/01/25 00:39:20 | 000,000,272 | —- | C] () – C:\ProgramData\~D6DXJ8uGBxe
[2011/01/25 00:39:20 | 000,000,152 | —- | C] () – C:\ProgramData\~D6DXJ8uGBxer
[2010/12/27 00:23:32 | 000,000,118 | —- | C] () – C:\Users\Deception\AppData\Local\DECEPTION-PC.cfg
[2010/11/23 20:52:00 | 000,000,036 | —- | C] () – C:\Users\Deception\AppData\Local\housecall.guid.cache
[2010/08/09 08:28:58 | 000,217,088 | —- | C] () – C:\Windows\System32\qtmlClient.dll
[2010/07/28 18:31:30 | 000,000,038 | —- | C] () – C:\Windows\avisplitter.ini
[2010/07/28 18:31:29 | 000,790,528 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2010/07/28 18:31:29 | 000,134,144 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2010/07/28 18:31:29 | 000,108,032 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2010/07/28 18:14:29 | 000,165,376 | —- | C] () – C:\Windows\System32\unrar.dll
[2010/06/25 17:03:12 | 000,053,299 | —- | C] () – C:\Windows\System32\pthreadVC.dll
[2010/05/18 12:41:29 | 000,001,456 | —- | C] () – C:\Users\Deception\AppData\Local\Adobe Save for Web 12.0 Prefs
[2010/04/16 21:39:31 | 000,000,056 | —- | C] () – C:\Windows\kgt2k.INI
[2010/02/20 23:09:33 | 000,000,026 | -H– | C] () – C:\ProgramData\.811261211181235583101118113995
[2009/12/23 19:39:14 | 000,155,636 | -H– | C] () – C:\Windows\System32\mlfcache.dat
[2009/09/14 06:35:41 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/09/14 06:35:41 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/07/30 00:26:00 | 000,000,293 | —- | C] () – C:\Windows\wininit.ini
[2009/07/01 18:03:40 | 000,000,000 | —- | C] () – C:\Windows\PowerReg.dat
[2009/07/01 18:00:36 | 000,037,376 | —- | C] () – C:\Windows\System32\drivers\WMDrive.sys
[2009/05/30 10:05:06 | 000,000,000 | —- | C] () – C:\ProgramData\LauncherAccess.dt
[2009/05/30 09:54:08 | 000,005,632 | —- | C] () – C:\Windows\System32\drivers\StarOpen.sys
[2009/05/20 19:20:20 | 000,000,050 | —- | C] () – C:\Windows\cdplayer.ini
[2009/04/18 10:21:59 | 000,120,200 | —- | C] () – C:\Windows\System32\DLLDEV32i.dll
[2009/04/18 10:21:22 | 000,006,211 | —- | C] () – C:\Windows\mgxoschk.ini
[2009/04/18 10:18:44 | 000,303,104 | —- | C] () – C:\Windows\emunist.exe
[2009/04/18 10:18:43 | 000,001,295 | —- | C] () – C:\Windows\TVEpaDrv.ini
[2009/04/15 14:06:05 | 000,448,512 | —- | C] () – C:\Windows\System32\avformat-50.dll
[2009/04/15 14:06:05 | 000,019,968 | —- | C] () – C:\Windows\System32\avutil-49.dll
[2009/04/15 14:06:04 | 003,345,408 | —- | C] () – C:\Windows\System32\avcodec-51.dll
[2009/04/10 14:04:37 | 000,000,026 | -H– | C] () – C:\ProgramData\.119889580931711767808769176
[2009/04/10 14:03:23 | 000,000,021 | -H– | C] () – C:\ProgramData\.24554863501262644635642126105
[2009/04/06 15:06:52 | 000,237,568 | —- | C] () – C:\Windows\System32\rmc_rtspdl.dll
[2009/03/29 14:10:18 | 000,000,412 | —- | C] () – C:\Windows\MAXLINK.INI
[2009/03/14 00:06:42 | 000,158,720 | —- | C] () – C:\Users\Deception\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/03/07 04:20:04 | 000,000,680 | —- | C] () – C:\Users\Deception\AppData\Local\d3d9caps.dat
[2009/03/01 06:34:44 | 000,000,014 | —- | C] () – C:\Windows\popcinfo.dat
[2009/02/27 17:12:18 | 000,029,372 | —- | C] () – C:\Users\Deception\AppData\Roaming\wklnhst.dat
[2009/02/27 16:54:51 | 000,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2009/02/27 16:09:42 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/09/26 02:47:16 | 000,000,044 | —- | C] () – C:\Windows\Acer(Normal).ini
[2008/09/26 02:47:16 | 000,000,042 | —- | C] () – C:\Windows\Acer(Wide).ini
[2008/09/26 01:53:00 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2008/08/14 17:40:42 | 000,176,214 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2008/04/09 06:14:46 | 003,107,788 | —- | C] () – C:\Windows\System32\atiumdva.dat
[2008/04/09 06:14:45 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2008/04/09 06:14:44 | 000,081,920 | —- | C] () – C:\Windows\System32\ATIODE.exe
[2008/04/09 06:14:44 | 000,040,960 | —- | C] () – C:\Windows\System32\ATIODCLI.exe
[2008/03/15 23:06:25 | 000,001,024 | RH– | C] () – C:\Windows\System32\NTIOFM4.dll
[2008/03/15 23:06:25 | 000,001,024 | RH– | C] () – C:\Windows\System32\NTIBUN5.dll
[2008/03/15 22:36:54 | 000,487,424 | —- | C] () – C:\Windows\System32\INT15.dll
[2008/03/15 22:33:51 | 000,001,694 | —- | C] () – C:\Windows\RtDefLvl.ini
[2008/03/15 22:33:51 | 000,000,520 | —- | C] () – C:\Windows\System32\drivers\RTEQEX0.dat
[2008/03/15 22:33:51 | 000,000,008 | —- | C] () – C:\Windows\System32\drivers\RtkHDAud.dat
[2008/03/05 23:38:44 | 000,090,112 | —- | C] () – C:\Windows\System32\atibrtmon.exe
[2006/11/02 12:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 12:47:37 | 003,735,856 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 12:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 10:33:01 | 000,608,760 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 10:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 10:33:01 | 000,108,268 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 10:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 10:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 08:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 08:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 07:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 07:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/06/02 21:15:44 | 000,294,912 | —- | C] () – C:\Windows\System32\LDecVorbis.dll
[2006/05/24 16:37:27 | 000,027,648 | —- | C] () – C:\Windows\System32\AVSredirect.dll
[2006/02/24 07:41:59 | 000,438,272 | —- | C] () – C:\Windows\System32\OpenQuicktimeLib.dll
[2006/02/24 07:41:59 | 000,061,440 | —- | C] () – C:\Windows\System32\libfaac.dll
[2006/02/23 15:36:20 | 001,798,144 | —- | C] () – C:\Windows\System32\ltmm_n.dll
[2006/02/23 15:36:20 | 000,262,144 | —- | C] () – C:\Windows\System32\LMOggSpl.dll
[2006/02/23 15:36:20 | 000,237,568 | —- | C] () – C:\Windows\System32\LMOggMux.dll
[2005/02/15 17:23:18 | 000,524,288 | —- | C] () – C:\Windows\System32\vspxcore.dll
[2001/12/26 23:12:30 | 000,065,536 | —- | C] () – C:\Windows\System32\multiplex_vcd.dll
[2001/09/04 06:46:38 | 000,110,592 | —- | C] () – C:\Windows\System32\Hmpg12.dll
[2001/07/30 23:33:56 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC.dll
[2001/07/24 05:04:36 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC_MMX.dll

========== LOP Check ==========

[2010/08/08 10:55:03 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\.purple
[2008/03/15 22:47:09 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Acer GameZone Console
[2009/08/11 20:33:41 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
[2009/03/01 06:35:23 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Big Fish Games
[2011/02/07 11:08:23 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Blender Foundation
[2010/01/11 15:56:51 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\BloodTies
[2010/07/29 10:03:38 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\BSplayer
[2010/07/29 09:59:42 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\BSplayer Pro
[2009/12/13 08:38:21 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Canon
[2011/01/07 15:09:35 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Digidesign
[2010/03/07 14:49:40 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\DivoGames
[2011/03/02 19:03:17 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Dropbox
[2009/04/15 14:06:11 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Eltima Software
[2010/08/08 10:53:55 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\enchant
[2009/07/20 20:22:09 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\ERS G-Studio
[2009/02/27 16:07:30 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\eSobi
[2010/06/26 13:55:27 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Facebook
[2010/01/20 21:32:43 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Final Draft
[2009/03/01 21:11:37 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\FloodLightGames
[2010/01/22 08:36:34 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Friday's games
[2011/02/28 21:52:50 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Fyiw
[2009/08/16 19:21:23 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\GameInvest
[2009/07/20 20:05:19 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Games
[2010/08/09 08:24:40 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\GetRightToGo
[2009/07/01 18:12:39 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Leadertech
[2009/05/08 22:50:30 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\LimeWire
[2009/07/23 22:02:15 | 000,000,000 | -HSD | M] – C:\Users\Deception\AppData\Roaming\lowsec
[2009/04/18 10:40:11 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\MAGIX
[2011/02/11 22:47:11 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\ManyCam
[2011/02/28 22:02:07 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Muzap
[2010/08/10 09:49:02 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Orbit
[2010/08/09 08:43:51 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\PACE Anti-Piracy
[2009/05/01 19:51:21 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Pi Eye Games
[2010/03/05 22:43:44 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\PlayFirst
[2011/01/16 20:25:02 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Propellerhead Software
[2011/03/02 01:09:48 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Replay Media Catcher 4
[2009/05/30 10:05:23 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Samsung
[2009/03/29 14:10:10 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\ScanSoft
[2010/05/17 00:44:52 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Smart FLV Converter Pro
[2010/08/03 13:19:20 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Spacejock Software
[2010/10/11 17:21:51 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\SulusGames
[2009/02/27 17:12:20 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Template
[2010/08/09 08:47:22 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Trillium Lane
[2010/01/27 20:55:24 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\TVSM
[2010/08/03 18:33:57 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2009/11/18 12:29:21 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Valusoft
[2010/01/10 22:13:16 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\ViquaSoft
[2010/10/23 13:26:08 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Virtual City
[2009/07/01 22:30:07 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\WinMount
[2010/08/30 09:18:44 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\Writer's Cafe 2
[2009/07/14 19:58:46 | 000,000,000 | —D | M] – C:\Users\Deception\AppData\Roaming\YoudaGames
[2011/03/02 22:22:54 | 000,032,644 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========



< MD5 for: EXPLORER.EXE >
[2008/10/29 06:20:29 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008/10/29 06:29:41 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008/10/30 03:59:17 | 002,927,616 | —- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009/04/11 06:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\ERDNT\cache\explorer.exe
[2009/04/11 06:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\explorer.exe
[2009/04/11 06:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008/10/28 02:15:02 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008/01/21 02:24:24 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: EXPLORER.EXE.MUI >
[2006/11/02 12:41:18 | 000,036,864 | —- | M] (Microsoft Corporation) MD5=192DD053B43250E264383CDC3D564A18 – C:\Windows\en-US\explorer.exe.mui
[2006/11/02 12:41:18 | 000,036,864 | —- | M] (Microsoft Corporation) MD5=192DD053B43250E264383CDC3D564A18 – C:\Windows\winsxs\x86_microsoft-windows-explorer.resources_31bf3856ad364e35_6.0.6000.16386_en-us_03bbc52176b6ba20\explorer.exe.mui

< MD5 for: EXPLORER.EXE-A80E4F97.PF >
[2011/03/02 22:29:54 | 000,317,670 | —- | M] () MD5=A37B8DA83675E8AAABCE776484C4C6DC – C:\Windows\Prefetch\EXPLORER.EXE-A80E4F97.pf

< MD5 for: IEXPLORE.EXE >
[2008/04/25 04:22:36 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=07ED775D6DB4BFA96D7CFB09EB228418 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16681_none_2d26424d1d17e8b7\iexplore.exe
[2009/01/15 04:14:36 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=0844F5B9CB3BB85A917D347EF1565B6C – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16809_none_2d84c7c91ccfce35\iexplore.exe
[2008/02/22 02:44:11 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=182CAF7403705ACCB51211A761080B8F – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20777_none_2dc0b0c03628049a\iexplore.exe
[2009/11/21 06:42:38 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=1B6362BB14FCEB9E76BCF9A953B04788 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18865_none_120f459f2ff7e1f8\iexplore.exe
[2009/03/03 04:18:52 | 000,636,072 | —- | M] (Microsoft Corporation) MD5=1DD66A2851DACDEC32EAE8F9A8865ABD – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.21023_none_2df29b2236034119\iexplore.exe
[2009/04/24 16:25:27 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=1F44940EF1D07D0BDAF80E55853DFBD0 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16851_none_2d46b5dd1cff8f32\iexplore.exe
[2010/02/23 15:06:13 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=25DB705A7DC85C208B3CF2D20F118AA7 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22995_none_127872a6492dd595\iexplore.exe
[2009/04/11 06:27:44 | 000,636,080 | —- | M] (Microsoft Corporation) MD5=2C5168C856455CC43C4B4E1CC1920001 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6002.18005_none_314d791517204c15\iexplore.exe
[2009/08/27 05:23:17 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=2E48756F12C21F46895036AC089AAD97 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18828_none_123d862d2fd4be39\iexplore.exe
[2010/01/02 14:58:26 | 000,638,216 | —- | M] (Microsoft Corporation) MD5=3D8DA00B028DEA9517066F1CECBFC4A2 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22973_none_128c11ea491f6b05\iexplore.exe
[2010/05/04 06:32:18 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=48A6109E8DF0365195298CC527B7426A – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23019_none_12d2cb5048e98eab\iexplore.exe
[2010/09/08 06:26:34 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=4A719476A6393B1DCACFEB4F3AC6599C – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23067_none_129abb204913e7b2\iexplore.exe
[2009/07/22 06:04:09 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=4B5AEA50CE77FBA4C2D169622DC9B489 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22903_none_12d7c15e48e6a76e\iexplore.exe
[2010/11/02 06:03:13 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=5AB037B17F8A87D052F5A88E0D29A3C8 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18999_none_11f2d8e9300c984e\iexplore.exe
[2008/01/21 02:23:50 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=5B92133D3E7FB2644677686305E29E81 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18000_none_2f62000919fe80c9\iexplore.exe
[2010/05/04 06:00:35 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=5C9B1062EA7A44E8F6BFDE994B68C7AA – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18928_none_123d88132fd4bb60\iexplore.exe
[2010/06/26 06:06:48 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=7420BE0E7D3D1320054F7ACA0594953D – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18943_none_1222e6c92fe9748f\iexplore.exe
[2010/12/18 07:19:44 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=7852371DA9EFBC17B645558E23780EAC – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23111_none_12cacae648f0c11a\iexplore.exe
[2009/08/27 13:31:08 | 000,638,216 | —- | M] (Microsoft Corporation) MD5=7DD482E4A2E3CBB0A72F718C342F5B75 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22918_none_12d1f2e448ea4212\iexplore.exe
[2010/01/02 06:40:20 | 000,638,216 | —- | M] (Microsoft Corporation) MD5=88BD42DAE7CFFEB256CA7145A15E4843 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18882_none_11f6a4e9300acdd5\iexplore.exe
[2009/03/03 04:32:44 | 000,636,072 | —- | M] (Microsoft Corporation) MD5=8BA2B7A05F88BE0D45237A0994AD8366 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22389_none_2f9e23da3354de78\iexplore.exe
[2011/01/23 19:20:49 | 000,719,873 | —- | M] () MD5=8CC534ECEE1B4213AF8C92BEA9271C2C – C:\Users\Deception\Downloads\iExplore.exe
[2010/11/02 07:13:47 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=92A17B0A89D14815AACC62CD190B6CE3 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23091_none_127449a04931a37b\iexplore.exe
[2008/02/21 04:43:03 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=9437CA21CD48C9B6BFD6F5AC0143D251 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16643_none_2d5382911cf5aba1\iexplore.exe
[2009/03/03 04:40:22 | 000,636,072 | —- | M] (Microsoft Corporation) MD5=9E6C1527D9A2C64BFD780AA23075380F – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18226_none_2f5265b91a094b03\iexplore.exe
[2008/04/25 02:04:08 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=9F1427F203CA078005C9943800929640 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20823_none_2df2c11a360310b0\iexplore.exe
[2010/02/23 06:39:16 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=9F52FBE99C749E3F32C75124F09F1B03 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18904_none_124f26c32fc81e22\iexplore.exe
[2009/03/08 21:09:24 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18702_none_124d22632fc9f126\iexplore.exe
[2010/12/18 06:28:35 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=B988D7F127B94BD5BF8356FE81B985C4 – C:\Program Files\Internet Explorer\iexplore.exe
[2010/12/18 06:28:35 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=B988D7F127B94BD5BF8356FE81B985C4 – C:\Windows\ERDNT\cache\iexplore.exe
[2010/12/18 06:28:35 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=B988D7F127B94BD5BF8356FE81B985C4 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19019_none_1249306b2fcbec08\iexplore.exe
[2009/07/21 21:53:43 | 000,638,216 | —- | M] (Microsoft Corporation) MD5=C33BD196A0301F9B23D9A003D30ED8B0 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18813_none_124354a72fd12395\iexplore.exe
[2009/04/24 16:03:18 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=D5271AC4A06AD9D1E2EA0151B79B2657 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.21046_none_2ddffc283610c500\iexplore.exe
[2010/09/08 06:02:42 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=D5A730DFDEAE005373E62BC2A866E3BB – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18975_none_120477992ffffb10\iexplore.exe
[2009/04/24 16:01:36 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=D6157423C117F24D24695866A1D0A93F – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22418_none_2fe8d4ea331cfeb1\iexplore.exe
[2009/11/21 15:05:17 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=E7F8DF50E483D165BB01F367D3519AA7 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22956_none_12a4b2a0490c7f28\iexplore.exe
[2009/03/03 04:22:10 | 000,636,072 | —- | M] (Microsoft Corporation) MD5=EA4BE33726155F89D89A3FE7142878E0 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16830_none_2d5b556b1cf03df9\iexplore.exe
[2010/06/26 06:52:42 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=F05B3A2C6CB319DD1377AD566CF5ECE5 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23040_none_12a958f24909fe6f\iexplore.exe
[2009/01/15 04:18:47 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=F0B1CA517977BA2FF6DA33F1B966C488 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20996_none_2daa146a36391d73\iexplore.exe
[2009/04/24 16:08:04 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=F294D8EEB05C835EC44A12CE0A1DFE7A – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18248_none_2f3ec6751a17b593\iexplore.exe

< MD5 for: IEXPLORE.EXE.EXE.VIR >
[2008/01/21 02:24:39 | 000,163,840 | —- | M] (Microsoft Corporation) MD5=EF8AE178FAE3C5F97E383753EB1DF3BA – C:\Qoobox\Quarantine\C\Windows\System32\iexplore.exe.exe.vir

< MD5 for: IEXPLORE.EXE.MUI >
[2006/11/02 12:41:15 | 000,016,384 | —- | M] (Microsoft Corporation) MD5=3CCDDDBC49DEACA370F39A9F0E146A1B – C:\Windows\winsxs\x86_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_6.0.6000.16386_en-us_3b55b11a57da5590\iexplore.exe.mui
[2009/03/08 21:27:11 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/03/08 21:27:11 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Windows\winsxs\x86_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_8.0.6001.18702_en-us_207795706a90d6c1\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE-812AD5F1.PF >
[2011/03/02 21:57:23 | 000,013,548 | —- | M] () MD5=F06F06CB9C22E29C603680187110EE73 – C:\Windows\Prefetch\IEXPLORE.EXE-812AD5F1.pf

< MD5 for: IEXPLORE.EXE-908C99F8.PF >
[2011/03/02 22:03:00 | 000,079,150 | —- | M] () MD5=0C5BABE877B38FC1A4352E8A86E09863 – C:\Windows\Prefetch\IEXPLORE.EXE-908C99F8.pf

< MD5 for: OLEPRO32.DLL >
[2009/04/11 06:28:23 | 000,088,576 | —- | M] (Microsoft Corporation) MD5=A944A73CEC5921B871542FE5CC5E03E4 – C:\Windows\winsxs\x86_microsoft-windows-ole-automation-legacy_31bf3856ad364e35_6.0.6002.18005_none_3bff339efed611ca\olepro32.dll
[2008/01/21 02:23:42 | 000,088,576 | —- | M] (Microsoft Corporation) MD5=AE70AE6F0760793D4893C3735EEC7292 – C:\Windows\winsxs\x86_microsoft-windows-ole-automation-legacy_31bf3856ad364e35_6.0.6001.18000_none_3a13ba9301b4467e\olepro32.dll
[2009/07/14 01:16:12 | 000,090,112 | —- | M] (Microsoft Corporation) MD5=C10459DBDC2099C5A8428CB7D87DB85F – C:\Windows\System32\olepro32.dll

< MD5 for: TASKMGR.EXE >
[2008/01/21 02:24:39 | 000,163,840 | —- | M] (Microsoft Corporation) MD5=EF8AE178FAE3C5F97E383753EB1DF3BA – C:\Windows\winsxs\x86_microsoft-windows-taskmgr_31bf3856ad364e35_6.0.6001.18000_none_14622f2da933f0c7\taskmgr.exe

< MD5 for: TASKMGR.EXE.MUI >
[2006/11/02 12:41:15 | 000,040,960 | —- | M] (Microsoft Corporation) MD5=5C682D66A0883A83A1A7EF7A674B7DF9 – C:\Windows\System32\en-US\taskmgr.exe.mui
[2006/11/02 12:41:15 | 000,040,960 | —- | M] (Microsoft Corporation) MD5=5C682D66A0883A83A1A7EF7A674B7DF9 – C:\Windows\winsxs\x86_microsoft-windows-taskmgr.resources_31bf3856ad364e35_6.0.6000.16386_en-us_d4a55056622813a6\taskmgr.exe.mui

< MD5 for: WINLOGON.EXE >
[2009/04/11 06:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\ERDNT\cache\winlogon.exe
[2009/04/11 06:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\System32\winlogon.exe
[2009/04/11 06:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008/01/21 02:24:49 | 000,314,880 | —- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2008/01/21 02:25:40 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=26AC28BF50DC112BAA794A83E08588F0 – C:\Windows\System32\en-US\winlogon.exe.mui
[2008/01/21 02:25:40 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=26AC28BF50DC112BAA794A83E08588F0 – C:\Windows\winsxs\x86_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.0.6001.18000_en-us_caf8918b0416723a\winlogon.exe.mui
[2006/11/02 12:40:50 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=A1D2856F3EC3C86EBBF1442B0245A8B3 – C:\Windows\winsxs\x86_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.0.6000.16386_en-us_c8c1cf8f072b6166\winlogon.exe.mui

< MD5 for: WINLOGON.EXE-B020DC41.PF >
[2011/02/27 14:46:56 | 000,032,918 | —- | M] () MD5=F3E4DE4F27BAA8EEDB0C5ED6853A539A – C:\Windows\Prefetch\WINLOGON.EXE-B020DC41.pf

< MD5 for: WINLOGON.MOF >
[2006/09/18 21:41:56 | 000,002,794 | —- | M] () MD5=545C578F290B9CDD280966939935B9EA – C:\Windows\System32\wbem\winlogon.mof
[2006/09/18 21:41:56 | 000,002,794 | —- | M] () MD5=545C578F290B9CDD280966939935B9EA – C:\Windows\winsxs\x86_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.0.6000.16386_none_7e0207d478fccc94\winlogon.mof

< c:\users\Deception\AppData\Roaming\Muzap\*.* /s >

< C:\users\Deception\AppData\Roaming\Fyiw\*.* /s >

========== Alternate Data Streams ==========

@Alternate Data Stream - 98 bytes -> C:\ProgramData\TEMP:580E04D8
@Alternate Data Stream - 76 bytes -> C:\Users\Deception\Documents\Films:Roxio EMC Stream
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:F1A5FE8B
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:8AB6C1D7
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:DF0BC727
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:4F636E25
@Alternate Data Stream - 1090 bytes -> C:\ProgramData\Microsoft:48Lem9B4V1UMXPx8yU4R7qam7
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:957E9765
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:861A898F
@Alternate Data Stream - 1078 bytes -> C:\Program Files\Common Files\microsoft shared:13SHG3Ryr1q0qhsp31ESPDmed
@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:3E7393FC
@Alternate Data Stream - 1023 bytes -> C:\ProgramData\Microsoft:r8fJhU5gUq3lP2tASCLyP
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:364682BC

< End of report >
Post #8
Hi UrMyStar,

I need some information on some unidentified files. We will use Virustotal Please submit these files for analysis

To submit a file to virustotal, please click on this link

Http://www.virustotal.com

copy and paste the following into the upload a file box

c:\windows\System32\drivers\bxhyjstl.sys


scroll down a bit and click "send file", wait for the results and post them in your next reply.

Please note that sometimes the scans take a few minutes.


Next

We'll use combofix again but run it differently.

Please follow all previous instructions regarding security programs.

Open a new Notepad session
  • Click the Start button, click run
  • in the run box type notepad
  • click ok
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

FCopy::
C:\Windows\winsxs\x86_microsoft-windows-taskmgr_31bf3856ad364e35_6.0.6001.18000_none_14622f2da933f0c7\taskmgr.exe | C:\Windows\system32\taskmgr.exe

Folder::
c:\users\Deception\AppData\Roaming\Muzap
C:\users\Deception\AppData\Roaming\Fyiw

In the notepad
  • Click File, Save as…, and set the Save in to your Desktop
  • In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
  • Click save
Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

Please post back with
  • VirusTotal results
  • combofix log
Task Manager working now?

Thanks
Post #9
Hi :) When I tried to upload the file at virustotal, a pop up appeared saying "bxhyjstl.sys. File not found. Please check the file name and try again". I didn't want to continue with the next part of your post incase it done damage to the computer in some way. Sorry for the set back
Post #12
Hi UrMyStar,

The file copy didn't work. Let's try it another way.

Next, create this batch file.

Open a new Notepad session
  • Click the Start button, click run
  • in the run box type notepad
  • click ok
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all the text in the code box below into the Notepad.
Do Not copy the word CODE

copy "C:\Windows\winsxs\x86_microsoft-windows-taskmgr_31bf3856ad364e35_6.0.6001.18000_none_14622f2da933f0c7\taskmgr.exe" C:\Windows\system32

In the notepad
  • Click File, Save as…, and set the Save in to your Desktop
  • In the filename box, type (including quotation marks) as the filename: "myfix.bat"
  • Click save

You will have a new file on your desktop called myfix.bat with an icon that looks like this 📎bat.PNG

Right click myfix.bat and select "run as adminsitrator" to run it.

Try to open task manager.

Any luck?
Post #14 last edited
Hi UrMyStar,

Good job.

You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Please post back with he mbam log. Any remaining issues?

Thanks
Post #15
Hey, Ran Malwarebytes. Everything seems okay, Task manager is back and I've not had any of those annoying ads :) Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5950 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.19019 04/03/2011 10:47:57 mbam-log-2011-03-04 (10-47-57).txt Scan type: Quick scan Objects scanned: 182796 Time elapsed: 6 minute(s), 0 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\Software\ere94fe5o32 (Trojan.FakeAV) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{6AC8121D-832B-6C6B-F639-610AD34EED95} (Trojan.ZbotR.Gen) -> Value: {6AC8121D-832B-6C6B-F639-610AD34EED95} -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\programdata\ddfcbytmrpiox.dll (Rogue.FakeHDD) -> Quarantined and deleted successfully. c:\Users\deception\AppData\Roaming\Wewicy\unxo.exe (Trojan.ZbotR.Gen) -> Quarantined and deleted successfully.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI