Spyware / Malware / Virus Removal

win 7 antivirus 2012

11 min read

Looking for the outcome? Ask AI

h1gg1 Topic Starter

Post #1July 7, 2011, 2:29 PM UTC last edited July 7, 2011, 2:37 PM UTC

Not long ago i reverted to factory settings as my pc was infected to a degree that nothing would work - black screen syndrome!!

Since then, 3 weeks ago, it has been running like a dream. I have redownloaded Zonalarm to keep the nasties way but low and behold i have picked up win 7 antivirus 2012 !!!

Have tried to follow instructions on bleeping computer but to no avail. (This included running Rkill and then Malwarebytes Antimalware).

I did have a look in the 'self fixes for spyware / malware' section but could not see a fix for this particular virus.

Can you guys help as well as just giving my pc a clean bill of health?

Regards,

Steve H.

BlackPegasus

Post #2July 8, 2011, 1:00 AM UTC

Hello h1gg1 and Welcome to WhatTheTech Forums

My name is BlackPegasus.

Malware Logs can sometimes take a lot of time to research and interpret.
Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for
further explanation.
Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to
get your system clean.
Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out
the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
PLEASE NOTE: If you do not reply after 3 days your thread will be closed.
Please be aware that I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to
ensure that I am giving you the best possible advice.
This may cause a delay in response time, but I will do my best to keep it as short as possible.
I will reply back shortly with instructions.

h1gg1

Post #3July 8, 2011, 12:25 PM UTC

Thanks Black Pegasus, for taking me on, i look forward to your helpful reply.

BlackPegasus

Post #4July 8, 2011, 3:38 PM UTC

Hello h1gg1,

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Vista and Windows 7 users:

These tools MUST be run from the executable. (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")
======================

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

======================
Please download aswMBR ( 511KB ) to your desktop.

Double click the aswMBR.exe icon to run it
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

======================
Please include in your next reply:
1. Any problem executing the instructions?
2. OTL log
3. aswMBR log

h1gg1

Post #5July 8, 2011, 7:32 PM UTC

No problems undertaking your instructions

OTL logfile created on: 7/8/2011 8:19:25 PM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\steve\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.87 Gb Total Physical Memory | 1.61 Gb Available Physical Memory | 56.16% Memory free
5.74 Gb Paging File | 4.14 Gb Available in Paging File | 72.06% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 148.81 Gb Total Space | 115.57 Gb Free Space | 77.66% Space Free | Partition Type: NTFS
Drive D: | 148.88 Gb Total Space | 141.97 Gb Free Space | 95.35% Space Free | Partition Type: NTFS
Drive F: | 3.72 Gb Total Space | 3.24 Gb Free Space | 86.97% Space Free | Partition Type: FAT32
Drive G: | 465.76 Gb Total Space | 372.03 Gb Free Space | 79.88% Space Free | Partition Type: NTFS

Computer Name: STEVE-TOSH | User Name: steve | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\steve\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe (Nero AG)
PRC - C:\Program Files (x86)\Toshiba\TOSHIBA Online Product Information\TOPI.exe (TOSHIBA)
PRC - C:\Program Files (x86)\Toshiba\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION)
PRC - c:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
PRC - C:\Program Files (x86)\Toshiba\ConfigFree\CFSwMgr.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files (x86)\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)

========== Modules (SafeList) ==========

MOD - C:\Users\steve\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9
a\msvcr80.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9
a\msvcp80.dll (Microsoft Corporation)
MOD - C:\Program Files\CheckPoint\ZAForceField\WOW64\Plugins\ISWSHEX.dll (Check Point Software Technologies)
MOD - C:\Program Files\CheckPoint\ZAForceField\WOW64\AK\icsak.dll (Check Point Software Technologies)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\wintrust.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV:64bit: - (IswSvc) – C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe (Check Point Software Technologies)
SRV:64bit: - (TOSHIBA HDD SSD Alert Service) – C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (TosCoSrv) – C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (TODDSrv) – C:\Windows\SysNative\TODDSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (vsmon) – C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
SRV - (sftvsa) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (TemproMonitoringService) Notebook Performance Tuning Service (TEMPRO) – C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe (Toshiba Europe GmbH)
SRV - (cfWiMAXService) – C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe (TOSHIBA CORPORATION)
SRV - (Nero BackItUp Scheduler 4.0) – c:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (TMachInfo) – C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (ConfigFree Service) – C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)

========== Driver Services (SafeList) ==========

DRV:64bit: - (icsak) – C:\Program Files\CheckPoint\ZAForceField\AK\icsak.sys (Check Point Software Technologies)
DRV:64bit: - (ISWKL) – C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies)
DRV:64bit: - (Vsdatant) – C:\Windows\SysNative\drivers\vsdatant.sys (Check Point Software Technologies LTD)
DRV:64bit: - (kl2) – C:\Windows\SysNative\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV:64bit: - (KL1) – C:\Windows\SysNative\drivers\kl1.sys (Kaspersky Lab ZAO)
DRV:64bit: - (KLIF) – C:\Windows\SysNative\drivers\klif.sys (Kaspersky Lab)
DRV:64bit: - (Sftvol) – C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)
DRV:64bit: - (Sftplay) – C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV:64bit: - (Sftredir) – C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV:64bit: - (Sftfs) – C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (L1C) – C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (RSUSBSTOR) – C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (CnxtHdAudService) – C:\Windows\SysNative\drivers\CHDRT64.sys (Conexant Systems Inc.)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (tdcmdpst) – C:\Windows\SysNative\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV:64bit: - (TVALZ) – C:\Windows\SysNative\drivers\TVALZ_O.SYS (TOSHIBA Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (FwLnk) – C:\Windows\SysNative\drivers\FwLnk.sys (TOSHIBA Corporation)
DRV:64bit: - (PGEffect) – C:\Windows\SysNative\drivers\PGEffect.sys (TOSHIBA Corporation)
DRV:64bit: - (Ntfs) – C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {a94e8dc9-07aa-45a7-8af2-a0375473a5cd} - C:\Program Files (x86)\ZoneAlarm_Extreme_Security\prxtbZone.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://toshiba.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.co.uk/
IE - HKCU\..\URLSearchHook: {a94e8dc9-07aa-45a7-8af2-a0375473a5cd} - C:\Program Files (x86)\ZoneAlarm_Extreme_Security\prxtbZone.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..network.proxy.type: 0

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\PROGRAM FILES\CHECKPOINT\ZAFORCEFIELD\TRUSTCHECKER [2011/07/02 18:30:51 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker [2011/07/02 18:30:51 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/07/02 09:39:56 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2011/06/20 21:49:57 | 000,000,000 | —D | M] (No name found) – C:\Users\steve\AppData\Roaming\Mozilla\Extensions
[2011/07/02 18:15:39 | 000,000,000 | —D | M] (No name found) – C:\Users\steve\AppData\Roaming\Mozilla\Firefox\Profiles\7oegxzz3.default\extensions
[2011/07/02 18:15:40 | 000,000,000 | —D | M] (ZoneAlarm Extreme Security Community Toolbar) – C:\Users\steve\AppData\Roaming\Mozilla\Firefox\Profiles\7oegxzz3.default\extensions\{a94e8dc9-07aa-45a7-8af2-a0375473a5cd}
[2011/06/20 21:49:33 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
File not found (No name found) –
[2011/04/14 17:46:07 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010/01/01 09:00:00 | 000,001,538 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\amazon-en-GB.xml
[2010/01/01 09:00:00 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2010/01/01 09:00:00 | 000,000,947 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\chambers-en-GB.xml
[2010/01/01 09:00:00 | 000,001,180 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-en-GB.xml
[2010/01/01 09:00:00 | 000,001,135 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2009/06/10 22:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (ZoneAlarm Extreme Security Toolbar) - {a94e8dc9-07aa-45a7-8af2-a0375473a5cd} - C:\Program Files (x86)\ZoneAlarm_Extreme_Security\prxtbZone.dll (Conduit Ltd.)
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\Toshiba\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll ()
O3:64bit: - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.
O3 - HKLM\..\Toolbar: (ZoneAlarm Extreme Security Toolbar) - {a94e8dc9-07aa-45a7-8af2-a0375473a5cd} - C:\Program Files (x86)\ZoneAlarm_Extreme_Security\prxtbZone.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Extreme Security Toolbar) - {A94E8DC9-07AA-45A7-8AF2-A0375473A5CD} - C:\Program Files (x86)\ZoneAlarm_Extreme_Security\prxtbZone.dll (Conduit Ltd.)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4:64bit: - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [cAudioFilterAgent] C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
O4:64bit: - HKLM..\Run: [SmartFaceVWatcher] C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatcher.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [Toshiba Registration] C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe (Toshiba Europe GmbH)
O4:64bit: - HKLM..\Run: [Toshiba TEMPRO] C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH)
O4:64bit: - HKLM..\Run: [TosNC] C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [NBAgent] c:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe (Nero AG)
O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TWebCamera] C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe (TOSHIBA CORPORATION.)
O4 - HKLM..\Run: [ZoneAlarm] C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [TOSHIBA Online Product Information] C:\Program Files (x86)\Toshiba\TOSHIBA Online Product Information\TOPI.exe (TOSHIBA)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/07/08 20:17:33 | 000,579,584 | —- | C] (OldTimer Tools) – C:\Users\steve\Desktop\OTL.exe
[2011/07/06 22:51:58 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Roaming\Malwarebytes
[2011/07/06 22:51:53 | 000,039,984 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011/07/06 22:51:53 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/07/06 22:51:52 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/07/06 22:51:47 | 000,025,912 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2011/07/06 22:51:46 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011/07/04 09:31:15 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Roaming\#ISW.FS#
[2011/07/04 09:30:33 | 000,000,000 | —D | C] – C:\Users\steve\Documents\ForceField Shared Files
[2011/07/03 08:53:36 | 000,000,000 | —D | C] – C:\ProgramData\Kaspersky SDK
[2011/07/02 19:00:23 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Roaming\MailFrontier
[2011/07/02 18:15:46 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Roaming\CheckPoint
[2011/07/02 18:15:38 | 000,000,000 | —D | C] – C:\Program Files (x86)\Conduit
[2011/07/02 18:15:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\ConduitEngine
[2011/07/02 18:15:37 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Local\Conduit
[2011/07/02 18:15:36 | 000,000,000 | —D | C] – C:\Program Files (x86)\ZoneAlarm_Extreme_Security
[2011/07/02 18:14:53 | 000,000,000 | —D | C] – C:\Program Files\CheckPoint
[2011/07/02 18:14:05 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Check Point
[2011/07/02 18:14:04 | 000,000,000 | —D | C] – C:\ProgramData\CheckPoint
[2011/07/02 18:13:48 | 000,374,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\netio.sys
[2011/07/02 18:13:22 | 000,000,000 | —D | C] – C:\Program Files (x86)\CheckPoint
[2011/07/02 09:31:43 | 000,000,000 | —D | C] – C:\Program Files (x86)\Zone Labs
[2011/07/02 09:31:31 | 000,000,000 | —D | C] – C:\Windows\Internet Logs
[2011/06/29 07:38:48 | 000,252,928 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\drvinst.exe
[2011/06/29 07:38:47 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\devrtl.dll
[2011/06/29 07:38:43 | 002,228,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mssrch.dll
[2011/06/29 07:38:43 | 001,401,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mssrch.dll
[2011/06/29 07:38:42 | 002,326,016 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tquery.dll
[2011/06/29 07:38:42 | 001,553,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\tquery.dll
[2011/06/29 07:38:42 | 000,491,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mssph.dll
[2011/06/29 07:38:41 | 000,779,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mssvp.dll
[2011/06/29 07:38:41 | 000,666,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mssvp.dll
[2011/06/29 07:38:41 | 000,337,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mssph.dll
[2011/06/29 07:38:41 | 000,288,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mssphtb.dll
[2011/06/29 07:38:41 | 000,249,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SearchProtocolHost.exe
[2011/06/29 07:38:41 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mssphtb.dll
[2011/06/29 07:38:41 | 000,113,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SearchFilterHost.exe
[2011/06/29 07:38:41 | 000,075,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msscntrs.dll
[2011/06/29 07:38:40 | 000,059,392 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msscntrs.dll
[2011/06/27 18:04:36 | 000,000,000 | RH-D | C] – C:\MSOCache
[2011/06/25 08:49:23 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2011/06/24 17:41:05 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Starter (English)
[2011/06/24 17:36:15 | 000,000,000 | —D | C] – C:\ProgramData\VirtualizedApplications
[2011/06/24 07:10:50 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Local\SoftGrid Client
[2011/06/24 07:10:49 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Roaming\SoftGrid Client
[2011/06/24 07:09:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\DESIGNER
[2011/06/24 07:09:56 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Office
[2011/06/24 07:09:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Application Virtualization Client
[2011/06/24 07:09:37 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Roaming\TP
[2011/06/23 22:24:28 | 000,000,000 | —D | C] – C:\Users\steve\Documents\Work stuff
[2011/06/23 22:24:07 | 000,000,000 | —D | C] – C:\Users\steve\Documents\Woking Road Plans
[2011/06/23 22:24:00 | 000,000,000 | —D | C] – C:\Users\steve\Documents\Tansee
[2011/06/23 22:23:11 | 000,000,000 | —D | C] – C:\Users\steve\Documents\Job application info
[2011/06/23 22:22:27 | 000,000,000 | —D | C] – C:\Users\steve\Documents\baby pics
[2011/06/23 22:22:20 | 000,000,000 | —D | C] – C:\Users\steve\Documents\Angie's recipes
[2011/06/23 22:22:14 | 000,000,000 | —D | C] – C:\Users\steve\Documents\Angies House Stuff
[2011/06/23 22:22:11 | 000,000,000 | —D | C] – C:\Users\steve\Documents\Account budgets
[2011/06/22 13:50:53 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Local\Adobe
[2011/06/21 21:26:48 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Roaming\Adobe
[2011/06/21 21:26:32 | 000,404,640 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011/06/21 21:26:32 | 000,000,000 | —D | C] – C:\Windows\SysWow64\Macromed
[2011/06/21 07:49:01 | 000,000,000 | R–D | C] – C:\Users\steve\Desktop\Unused desktop folders
[2011/06/21 07:16:05 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft.NET
[2011/06/20 23:08:46 | 000,000,000 | —D | C] – C:\Program Files (x86)\MSXML 4.0
[2011/06/20 21:49:38 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Roaming\Mozilla
[2011/06/20 21:49:38 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Local\Mozilla
[2011/06/20 21:49:31 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2011/06/20 18:17:43 | 000,000,000 | —D | C] – C:\Windows\SysWow64\Wat
[2011/06/20 18:17:42 | 000,000,000 | —D | C] – C:\Windows\SysNative\Wat
[2011/06/20 09:49:37 | 001,942,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dfshim.dll
[2011/06/20 09:49:37 | 001,130,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dfshim.dll
[2011/06/20 09:49:37 | 000,320,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\PresentationHost.exe
[2011/06/20 09:49:37 | 000,295,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\PresentationHost.exe
[2011/06/20 09:49:37 | 000,109,912 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\PresentationHostProxy.dll
[2011/06/20 09:49:37 | 000,099,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\PresentationHostProxy.dll
[2011/06/20 09:49:37 | 000,049,472 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\netfxperf.dll
[2011/06/20 09:49:37 | 000,048,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\netfxperf.dll
[2011/06/20 09:49:22 | 000,294,912 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\browserchoice.exe
[2011/06/20 07:19:40 | 000,142,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\poqexec.exe
[2011/06/20 07:19:40 | 000,123,904 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\poqexec.exe
[2011/06/20 07:19:38 | 002,870,272 | —- | C] (Microsoft Corporation) – C:\Windows\explorer.exe
[2011/06/20 07:19:38 | 002,614,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\explorer.exe
[2011/06/20 07:19:36 | 000,961,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\CPFilters.dll
[2011/06/20 07:19:35 | 001,118,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\sbe.dll
[2011/06/20 07:19:35 | 000,850,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\sbe.dll
[2011/06/20 07:19:35 | 000,723,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\EncDec.dll
[2011/06/20 07:19:35 | 000,642,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\CPFilters.dll
[2011/06/20 07:19:35 | 000,534,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\EncDec.dll
[2011/06/20 07:19:35 | 000,259,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mpg2splt.ax
[2011/06/20 07:19:35 | 000,199,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mpg2splt.ax
[2011/06/20 07:19:33 | 000,148,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\t2embed.dll
[2011/06/20 07:19:33 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\t2embed.dll
[2011/06/20 07:19:31 | 002,085,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ole32.dll
[2011/06/20 07:19:28 | 001,169,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskschd.dll
[2011/06/20 07:19:28 | 000,524,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wmicmiplugin.dll
[2011/06/20 07:19:28 | 000,496,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\taskschd.dll
[2011/06/20 07:19:28 | 000,473,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskcomp.dll
[2011/06/20 07:19:28 | 000,464,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskeng.exe
[2011/06/20 07:19:28 | 000,305,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\taskcomp.dll
[2011/06/20 07:19:28 | 000,285,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\schtasks.exe
[2011/06/20 07:19:28 | 000,179,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\schtasks.exe
[2011/06/20 07:19:26 | 000,483,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\StructuredQuery.dll
[2011/06/20 07:19:14 | 000,552,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msdri.dll
[2011/06/20 07:19:14 | 000,288,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MSNP.ax
[2011/06/20 07:19:14 | 000,204,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MSNP.ax
[2011/06/20 07:18:52 | 000,476,160 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XpsGdiConverter.dll
[2011/06/20 07:18:52 | 000,288,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XpsGdiConverter.dll
[2011/06/20 07:18:46 | 005,509,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl.exe
[2011/06/20 07:18:46 | 003,957,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntkrnlpa.exe
[2011/06/20 07:18:45 | 003,901,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntoskrnl.exe
[2011/06/20 07:18:24 | 000,703,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2011/06/20 07:18:24 | 000,599,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeeds.dll
[2011/06/20 07:18:24 | 000,256,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2011/06/20 07:18:24 | 000,247,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2011/06/20 07:18:24 | 000,185,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2011/06/20 07:18:24 | 000,097,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2011/06/20 07:18:24 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2011/06/20 07:18:24 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2011/06/20 07:18:23 | 000,482,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2011/06/20 07:18:23 | 000,386,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2011/06/20 07:18:23 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2011/06/20 07:18:23 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2011/06/20 07:18:23 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2011/06/20 07:18:23 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2011/06/20 07:18:17 | 000,633,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\comctl32.dll
[2011/06/20 07:18:13 | 000,852,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2011/06/20 07:18:13 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2011/06/20 07:18:13 | 000,612,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2011/06/20 07:18:07 | 000,264,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\upnp.dll
[2011/06/20 07:18:06 | 000,204,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\upnp.dll
[2011/06/20 07:18:05 | 000,100,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\davclnt.dll
[2011/06/20 07:18:05 | 000,080,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\davclnt.dll
[2011/06/20 07:18:05 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wscapi.dll
[2011/06/20 07:18:05 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wscapi.dll
[2011/06/20 07:18:05 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\slwga.dll
[2011/06/20 07:18:05 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\slwga.dll
[2011/06/20 07:18:01 | 000,052,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rtutils.dll
[2011/06/20 07:18:01 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\rtutils.dll
[2011/06/20 07:17:55 | 000,662,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XpsPrint.dll
[2011/06/20 07:17:55 | 000,442,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XpsPrint.dll
[2011/06/20 07:17:53 | 001,395,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfc42.dll
[2011/06/20 07:17:53 | 001,359,872 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfc42u.dll
[2011/06/20 07:17:52 | 001,164,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfc42u.dll
[2011/06/20 07:17:52 | 001,137,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfc42.dll
[2011/06/20 07:17:46 | 000,367,104 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2011/06/20 07:17:46 | 000,294,912 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2011/06/20 07:17:46 | 000,046,080 | —- | C] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2011/06/20 07:17:46 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2011/06/20 07:17:44 | 000,214,016 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2011/06/20 07:17:41 | 001,837,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10warp.dll
[2011/06/20 07:17:40 | 004,068,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mf.dll
[2011/06/20 07:17:40 | 001,888,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WMVDECOD.DLL
[2011/06/20 07:17:40 | 001,540,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\DWrite.dll
[2011/06/20 07:17:40 | 001,170,944 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3d10warp.dll
[2011/06/20 07:17:40 | 001,074,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\DWrite.dll
[2011/06/20 07:17:40 | 000,902,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d2d1.dll
[2011/06/20 07:17:40 | 000,739,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d2d1.dll
[2011/06/20 07:17:39 | 003,181,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mf.dll
[2011/06/20 07:17:39 | 001,863,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ExplorerFrame.dll
[2011/06/20 07:17:38 | 001,619,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WMVDECOD.DLL
[2011/06/20 07:17:38 | 001,495,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ExplorerFrame.dll
[2011/06/20 07:17:38 | 000,265,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\dxgmms1.sys
[2011/06/20 07:17:38 | 000,257,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfreadwrite.dll
[2011/06/20 07:17:38 | 000,229,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XpsRasterService.dll
[2011/06/20 07:17:38 | 000,206,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfps.dll
[2011/06/20 07:17:38 | 000,196,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfreadwrite.dll
[2011/06/20 07:17:38 | 000,144,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cdd.dll
[2011/06/20 07:17:38 | 000,135,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XpsRasterService.dll
[2011/06/20 07:17:33 | 000,082,944 | —- | C] (Radius Inc.) – C:\Windows\SysWow64\iccvid.dll
[2011/06/20 07:17:32 | 000,027,008 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\Diskdump.sys
[2011/06/20 07:17:30 | 000,395,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\webio.dll
[2011/06/20 07:17:30 | 000,314,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\webio.dll
[2011/06/20 07:17:28 | 000,356,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dnsapi.dll
[2011/06/20 07:17:28 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dnscacheugc.exe
[2011/06/20 07:17:28 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dnscacheugc.exe
[2011/06/20 07:17:27 | 001,024,512 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wmpmde.dll
[2011/06/20 07:17:26 | 000,738,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wmpmde.dll
[2011/06/20 07:17:14 | 000,320,512 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10_1core.dll
[2011/06/20 07:17:14 | 000,218,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3d10_1core.dll
[2011/06/20 07:17:14 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10_1.dll
[2011/06/20 07:17:14 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3d10_1.dll
[2011/06/20 07:17:02 | 001,739,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntdll.dll
[2011/06/20 07:16:56 | 001,446,912 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\lsasrv.dll
[2011/06/20 07:16:52 | 000,640,896 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winload.efi
[2011/06/20 07:16:52 | 000,603,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winload.exe
[2011/06/20 07:16:52 | 000,556,928 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winresume.efi
[2011/06/20 07:16:52 | 000,518,160 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winresume.exe
[2011/06/20 07:16:52 | 000,020,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kdusb.dll
[2011/06/20 07:16:52 | 000,019,328 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kd1394.dll
[2011/06/20 07:16:52 | 000,017,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kdcom.dll
[2011/06/20 07:16:49 | 000,861,184 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\oleaut32.dll
[2011/06/20 07:16:47 | 000,954,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfc40.dll
[2011/06/20 07:16:47 | 000,954,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfc40u.dll
[2011/06/20 07:16:46 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\prevhost.exe
[2011/06/20 07:16:46 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\prevhost.exe
[2011/06/20 07:16:44 | 014,627,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wmp.dll
[2011/06/20 07:16:43 | 011,406,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wmp.dll
[2011/06/20 07:16:42 | 012,625,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wmploc.DLL
[2011/06/20 07:16:42 | 012,625,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wmploc.DLL
[2011/06/20 07:16:40 | 003,138,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstscax.dll
[2011/06/20 07:16:40 | 002,690,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstscax.dll
[2011/06/20 07:16:39 | 001,097,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstsc.exe
[2011/06/20 07:16:39 | 001,034,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstsc.exe
[2011/06/20 07:16:38 | 000,267,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\FXSCOVER.exe
[2011/06/20 07:16:35 | 000,112,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\consent.exe
[2011/06/20 07:16:31 | 000,720,896 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\odbc32.dll
[2011/06/20 07:16:31 | 000,573,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\odbc32.dll
[2011/06/20 07:16:29 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\sscore.dll
[2011/06/20 00:05:45 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Local\TOSHIBA_Corporation
[2011/06/19 23:56:12 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Roaming\Toshiba
[2011/06/19 23:55:18 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Roaming\Nero
[2011/06/19 23:55:11 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Local\Toshiba
[2011/06/19 23:54:47 | 000,000,000 | R–D | C] – C:\Users\steve\Searches
[2011/06/19 23:54:47 | 000,000,000 | R–D | C] – C:\Users\steve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011/06/19 23:54:47 | 000,000,000 | -H-D | C] – C:\Users\steve\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2011/06/19 23:54:39 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Roaming\Identities
[2011/06/19 23:54:37 | 000,000,000 | R–D | C] – C:\Users\steve\Contacts
[2011/06/19 23:54:34 | 000,220,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wintrust.dll
[2011/06/19 23:54:34 | 000,172,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wintrust.dll
[2011/06/19 23:54:33 | 000,139,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cabview.dll
[2011/06/19 23:54:33 | 000,132,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\cabview.dll
[2011/06/19 23:53:44 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Local\VirtualStore
[2011/06/19 23:50:58 | 000,000,000 | —D | C] – C:\ProgramData\ToshibaEurope
[2011/06/19 23:50:22 | 000,000,000 | –SD | C] – C:\Users\steve\AppData\Roaming\Microsoft
[2011/06/19 23:50:22 | 000,000,000 | R–D | C] – C:\Users\steve\Videos
[2011/06/19 23:50:22 | 000,000,000 | R–D | C] – C:\Users\steve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011/06/19 23:50:22 | 000,000,000 | R–D | C] – C:\Users\steve\Saved Games
[2011/06/19 23:50:22 | 000,000,000 | R–D | C] – C:\Users\steve\Pictures
[2011/06/19 23:50:22 | 000,000,000 | R–D | C] – C:\Users\steve\Music
[2011/06/19 23:50:22 | 000,000,000 | R–D | C] – C:\Users\steve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011/06/19 23:50:22 | 000,000,000 | R–D | C] – C:\Users\steve\Links
[2011/06/19 23:50:22 | 000,000,000 | R–D | C] – C:\Users\steve\Favorites
[2011/06/19 23:50:22 | 000,000,000 | R–D | C] – C:\Users\steve\Downloads
[2011/06/19 23:50:22 | 000,000,000 | R–D | C] – C:\Users\steve\Documents
[2011/06/19 23:50:22 | 000,000,000 | R–D | C] – C:\Users\steve\Desktop
[2011/06/19 23:50:22 | 000,000,000 | R–D | C] – C:\Users\steve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011/06/19 23:50:22 | 000,000,000 | -HSD | C] – C:\Users\steve\AppData\Local\Temporary Internet Files
[2011/06/19 23:50:22 | 000,000,000 | -HSD | C] – C:\Users\steve\Templates
[2011/06/19 23:50:22 | 000,000,000 | -HSD | C] – C:\Users\steve\Start Menu
[2011/06/19 23:50:22 | 000,000,000 | -HSD | C] – C:\Users\steve\SendTo
[2011/06/19 23:50:22 | 000,000,000 | -HSD | C] – C:\Users\steve\Recent
[2011/06/19 23:50:22 | 000,000,000 | -HSD | C] – C:\Users\steve\PrintHood
[2011/06/19 23:50:22 | 000,000,000 | -HSD | C] – C:\Users\steve\NetHood
[2011/06/19 23:50:22 | 000,000,000 | -HSD | C] – C:\Users\steve\Documents\My Videos
[2011/06/19 23:50:22 | 000,000,000 | -HSD | C] – C:\Users\steve\Documents\My Pictures
[2011/06/19 23:50:22 | 000,000,000 | -HSD | C] – C:\Users\steve\Documents\My Music
[2011/06/19 23:50:22 | 000,000,000 | -HSD | C] – C:\Users\steve\My Documents
[2011/06/19 23:50:22 | 000,000,000 | -HSD | C] – C:\Users\steve\Local Settings
[2011/06/19 23:50:22 | 000,000,000 | -HSD | C] – C:\Users\steve\AppData\Local\History
[2011/06/19 23:50:22 | 000,000,000 | -HSD | C] – C:\Users\steve\Cookies
[2011/06/19 23:50:22 | 000,000,000 | -HSD | C] – C:\Users\steve\Application Data
[2011/06/19 23:50:22 | 000,000,000 | -HSD | C] – C:\Users\steve\AppData\Local\Application Data
[2011/06/19 23:50:22 | 000,000,000 | -H-D | C] – C:\Users\steve\AppData
[2011/06/19 23:50:22 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Local\Temp
[2011/06/19 23:50:22 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Local\Microsoft
[2011/06/19 23:50:22 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Roaming\Media Center Programs
[2011/06/19 23:50:22 | 000,000,000 | —D | C] – C:\Users\steve\AppData\Roaming\Macromedia
[2011/06/19 23:42:51 | 000,000,000 | —D | C] – C:\Windows\OemDrv
[2011/06/19 23:41:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Office
[2011/06/19 23:40:36 | 000,000,000 | —D | C] – C:\Windows\Downloaded Installations
[2011/06/19 23:36:34 | 000,000,000 | —D | C] – C:\Windows\SoftwareDistribution
[2011/06/19 23:36:32 | 000,035,008 | —- | C] (TOSHIBA Corporation) – C:\Windows\SysNative\drivers\PGEffect.sys
[2011/06/19 23:34:59 | 001,550,848 | —- | C] (Atheros Communications, Inc.) – C:\Windows\SysNative\drivers\athrx.sys
[2011/06/19 23:34:59 | 000,000,000 | —D | C] – C:\Program Files (x86)\Atheros
[2011/06/19 23:34:54 | 000,000,000 | —D | C] – C:\ProgramData\Atheros
[2011/06/19 23:34:12 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/06/19 23:31:51 | 000,000,000 | -HSD | C] – C:\System Volume Information
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/07/08 20:17:57 | 000,016,080 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/07/08 20:17:57 | 000,016,080 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/07/08 20:17:35 | 000,579,584 | —- | M] (OldTimer Tools) – C:\Users\steve\Desktop\OTL.exe
[2011/07/08 20:10:13 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/07/08 20:10:06 | 2312,085,504 | -HS- | M] () – C:\hiberfil.sys
[2011/07/07 08:19:38 | 000,727,182 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2011/07/07 08:19:38 | 000,628,904 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2011/07/07 08:19:38 | 000,110,798 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2011/07/06 22:51:53 | 000,001,076 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/07/06 21:56:33 | 001,008,041 | —- | M] () – C:\Users\steve\Desktop\rkill.com
[2011/07/06 21:52:35 | 006,128,632 | —- | M] () – C:\Users\steve\Desktop\New Rich Text Document.rtf
[2011/07/02 18:31:02 | 000,416,398 | —- | M] () – C:\Windows\SysNative\drivers\vsconfig.xml
[2011/07/02 18:15:28 | 000,000,144 | —- | M] () – C:\Windows\SysWow64\lkfl.dat
[2011/07/02 18:15:28 | 000,000,128 | —- | M] () – C:\Windows\SysWow64\pdfl.dat
[2011/07/02 18:15:28 | 000,000,080 | —- | M] () – C:\Windows\SysWow64\ibfl.dat
[2011/06/29 10:52:16 | 000,274,320 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2011/06/25 08:47:01 | 000,735,230 | —- | M] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/06/23 23:08:14 | 000,001,089 | —- | M] () – C:\Users\steve\Desktop\Documents - Shortcut.lnk
[2011/06/21 21:26:32 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011/06/20 00:03:16 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011/06/20 00:00:54 | 000,001,444 | —- | M] () – C:\Users\steve\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/06/19 23:47:11 | 000,039,252 | —- | M] () – C:\Windows\SysWow64\license.rtf
[2011/06/19 23:47:11 | 000,039,252 | —- | M] () – C:\Windows\SysNative\license.rtf
[2011/06/19 23:44:25 | 000,000,000 | RHS- | M] () – C:\Windows\SysWow64\drivers\TOSHIBA_Satellite C650_12248-EN_PSC08E-01W00.MRK
[2011/06/19 23:36:38 | 000,000,000 | —- | M] () – C:\Windows\NDSTray.INI
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/07/06 22:51:53 | 000,001,076 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/07/06 21:56:23 | 001,008,041 | —- | C] () – C:\Users\steve\Desktop\rkill.com
[2011/07/06 21:46:18 | 006,128,632 | —- | C] () – C:\Users\steve\Desktop\New Rich Text Document.rtf
[2011/07/02 18:16:08 | 000,416,398 | —- | C] () – C:\Windows\SysNative\drivers\vsconfig.xml
[2011/07/02 18:15:28 | 000,000,144 | —- | C] () – C:\Windows\SysWow64\lkfl.dat
[2011/07/02 18:15:28 | 000,000,128 | —- | C] () – C:\Windows\SysWow64\pdfl.dat
[2011/07/02 18:15:28 | 000,000,080 | —- | C] () – C:\Windows\SysWow64\ibfl.dat
[2011/06/24 07:10:06 | 000,735,230 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/06/23 23:08:14 | 000,001,089 | —- | C] () – C:\Users\steve\Desktop\Documents - Shortcut.lnk
[2011/06/23 22:22:50 | 007,322,034 | —- | C] () – C:\Users\steve\Documents\Sony Ericsson X8 user guide.pdf
[2011/06/20 21:49:34 | 000,001,117 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011/06/20 00:03:16 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011/06/20 00:00:54 | 000,001,444 | —- | C] () – C:\Users\steve\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/06/19 23:54:51 | 000,001,450 | —- | C] () – C:\Users\steve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011/06/19 23:50:22 | 000,000,290 | —- | C] () – C:\Users\steve\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2011/06/19 23:50:22 | 000,000,272 | —- | C] () – C:\Users\steve\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2011/06/19 23:44:25 | 000,000,000 | RHS- | C] () – C:\Windows\SysWow64\drivers\TOSHIBA_Satellite C650_12248-EN_PSC08E-01W00.MRK
[2011/06/19 23:41:13 | 000,002,435 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2010.lnk
[2011/06/19 23:36:38 | 000,000,000 | —- | C] () – C:\Windows\NDSTray.INI
[2011/06/19 23:31:51 | 2312,085,504 | -HS- | C] () – C:\hiberfil.sys
[2010/02/20 09:22:24 | 000,982,240 | —- | C] () – C:\Windows\SysWow64\igkrng500.bin
[2010/02/20 09:22:24 | 000,439,308 | —- | C] () – C:\Windows\SysWow64\igcompkrng500.bin
[2010/02/20 09:22:24 | 000,092,356 | —- | C] () – C:\Windows\SysWow64\igfcg500m.bin
[2010/02/20 08:27:36 | 000,208,896 | —- | C] () – C:\Windows\SysWow64\iglhsip32.dll
[2010/02/20 08:27:36 | 000,143,360 | —- | C] () – C:\Windows\SysWow64\iglhcp32.dll
[2009/07/14 06:38:36 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/14 03:35:51 | 000,000,741 | —- | C] () – C:\Windows\SysWow64\NOISE.DAT
[2009/07/14 03:34:42 | 000,215,943 | —- | C] () – C:\Windows\SysWow64\dssec.dat
[2009/07/14 01:10:29 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/14 00:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 22:59:36 | 000,139,824 | —- | C] () – C:\Windows\SysWow64\igfcg500.bin
[2009/07/13 22:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 22:26:10 | 000,673,088 | —- | C] () – C:\Windows\SysWow64\mlang.dat

========== LOP Check ==========

[2011/07/06 19:50:54 | 000,000,000 | —D | M] – C:\Users\steve\AppData\Roaming\#ISW.FS#
[2011/07/02 18:15:46 | 000,000,000 | —D | M] – C:\Users\steve\AppData\Roaming\CheckPoint
[2011/07/02 19:00:23 | 000,000,000 | —D | M] – C:\Users\steve\AppData\Roaming\MailFrontier
[2011/07/07 07:41:11 | 000,000,000 | —D | M] – C:\Users\steve\AppData\Roaming\SoftGrid Client
[2011/06/19 23:56:12 | 000,000,000 | —D | M] – C:\Users\steve\AppData\Roaming\Toshiba
[2011/06/24 07:10:58 | 000,000,000 | —D | M] – C:\Users\steve\AppData\Roaming\TP
[2009/07/14 06:08:49 | 000,019,974 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

OTL Extras logfile created on: 7/8/2011 8:19:25 PM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\steve\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.87 Gb Total Physical Memory | 1.61 Gb Available Physical Memory | 56.16% Memory free
5.74 Gb Paging File | 4.14 Gb Available in Paging File | 72.06% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 148.81 Gb Total Space | 115.57 Gb Free Space | 77.66% Space Free | Partition Type: NTFS
Drive D: | 148.88 Gb Total Space | 141.97 Gb Free Space | 95.35% Space Free | Partition Type: NTFS
Drive F: | 3.72 Gb Total Space | 3.24 Gb Free Space | 86.97% Space Free | Partition Type: FAT32
Drive G: | 465.76 Gb Total Space | 372.03 Gb Free Space | 79.88% Space Free | Partition Type: NTFS

Computer Name: STEVE-TOSH | User Name: steve | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %* File not found
cmdfile [open] – "%1" %* File not found
comfile [open] – "%1" %* File not found
exefile [open] – "%1" %* File not found
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %* File not found
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1" File not found
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l File not found
scrfile [open] – "%1" /S File not found
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{90140000-006D-0409-1000-0000000FF1CE}" = Microsoft Office Click-to-Run 2010
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{A0E99122-25C1-4CA4-9063-499A2A814EB6}" = TOSHIBA ReelTime
"{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Media Creator
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{C14518AF-1A0F-4D39-8011-69BAA01CD380}" = TOSHIBA Bulletin Board
"{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
"{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORMCLauncher
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F67FA545-D8E5-4209-86B1-AEE045D1003F}" = TOSHIBA Face Recognition
"CNXT_AUDIO_HDA" = Conexant HD Audio
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{0420F95C-11FF-4E02-B967-6CC22B188F9F}" = Nero BackItUp
"{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"{073B89C3-BA88-41B5-965F-B35A88EAE838}" = TOSHIBA Supervisor Password
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1B87C40B-A60B-4EF3-9A68-706CF4B69978}" = Toshiba Assist
"{20400DBD-E6DB-45B8-9B6B-1DD7033818EC}" = Nero InfoTool Help
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{2097927C-9C47-46D2-9578-7E1FA702A1D0}" = ZoneAlarm Antivirus
"{2290A680-4083-410A-ADCC-7092C67FC052}" = TOSHIBA Online Product Information
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2348B586-C9AE-46CE-936C-A68E9426E214}" = Nero StartSmart Help
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java™ 6 Update 17
"{2B000B80-A3FA-4B92-A5FF-D9AD402B6701}" = Toshiba TEMPRO
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver
"{33CF58F5-48D8-4575-83D6-96F574E4D83A}" = Nero DriveSpeed
"{397516AE-7DFE-4F90-84E0-BD616D559434}" = Nero BurnRights
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3D5044A5-97B8-45C0-B956-BB2376569188}" = Windows Live Movie Maker
"{51E2F9B3-A972-4F58-B4EF-4D9676D9F5D1}" = Nero RescueAgent
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{595A3116-40BB-4E0F-A2E8-D7951DA56270}" = NeroExpress
"{5E6F6CF3-BACC-4144-868C-E14622C658F3}" = TOSHIBA Web Camera Application
"{607BE7BF-7C28-4ADB-A4A0-385962B901C3}" = TOSHIBA ConfigFree
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{6C3CF7AC-5AB0-42D9-93C0-68166A57AFB6}" = Nero Express
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TOSHIBA Recovery Media Creator Reminder
"{7748AC8C-18E3-43BB-959B-088FAEA16FB2}" = Nero StartSmart
"{7829DB6F-A066-4E40-8912-CB07887C20BB}" = Nero BurnRights
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{83202942-84B3-4C50-8622-B8C0AA2D2885}" = Nero Express Help
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{869200DB-287A-4DC0-B02B-2B6787FBCD4C}" = Nero DiscSpeed
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E9CEA3B-EBD1-439C-A01D-830CB39613C6}" = TOSHIBA Hardware Setup
"{90140011-0066-0409-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - English
"{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}" = Toshiba Manuals
"{9168d95f-e754-422e-acde-f2b098122816}" = Nero 9 Essentials
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{983CD6FE-8320-4B80-A8F6-0D0366E0AA22}" = TOSHIBA Media Controller
"{9DA0961E-FCFE-EEF2-04AA-32631F7CEC9E}" = Photo Service - powered by myphotobook
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{AC6569FA-6919-442A-8552-073BE69E247A}" = TOSHIBA Service Station
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3
"{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center
"{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter
"{C3A32068-8AB1-4327-BB16-BED9C6219DC7}" = Atheros Driver Installation Program
"{C81A2FE0-3574-00A9-CED4-BDAA334CBE8E}" = Nero Online Upgrade
"{CC019E3F-59D2-4486-8D4B-878105B62A71}" = Nero DiscSpeed Help
"{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{E08CC458-41FB-4BB5-9B08-2C83DB55A5B9}" = Nero BackItUp and Burn
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E5C7D048-F9B4-4219-B323-8BDB01A2563D}" = Nero DriveSpeed Help
"{E666C514-9B73-4186-97F1-2741A1F2474D}" = ZoneAlarm Firewall
"{E69C195E-88BD-477D-A66E-12CC3D4CDD36}" = ZoneAlarm Security
"{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer
"{EA2424A4-D86E-4D07-A6C1-9A2034F0CB3E}" = ZoneAlarm DataLock
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Graphics Media Accelerator Driver
"{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}" = TOSHIBA Media Controller Plug-in
"{F4041DCE-3FE1-4E18-8A9E-9DE65231EE36}" = Nero ControlCenter
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F6BDD7C5-89ED-4569-9318-469AA9732572}" = Nero BurnRights Help
"{FBCDFD61-7DCF-4E71-9226-873BA0053139}" = Nero InfoTool
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"conduitEngine" = Conduit Engine
"eu.myphotobook.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1" = Photo Service - powered by myphotobook
"InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TOSHIBA Recovery Media Creator Reminder
"InstallShield_{A0E99122-25C1-4CA4-9063-499A2A814EB6}" = TOSHIBA ReelTime
"InstallShield_{C14518AF-1A0F-4D39-8011-69BAA01CD380}" = TOSHIBA Bulletin Board
"InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
"InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORMCLauncher
"InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}" = TOSHIBA Face Recognition
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.0.1200
"Mozilla Firefox 4.0.1 (x86 en-GB)" = Mozilla Firefox 4.0.1 (x86 en-GB)
"Office14.Click2Run" = Microsoft Office Click-to-Run 2010
"WinLiveSuite_Wave3" = Windows Live Essentials
"ZoneAlarm Extreme Security" = ZoneAlarm Extreme Security

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 27/06/2011 12:52:11 | Computer Name = steve-tosh | Source = Application Error | ID = 1000
Description = Faulting application name: CVHSVC.EXE, version: 14.0.4750.1000, time
stamp: 0x4b8a36d5 Faulting module name: ole32.dll, version: 6.1.7600.16624, time
stamp: 0x4c297c56 Exception code: 0xc0000005 Fault offset: 0x00028afc Faulting process
id: 0xe04 Faulting application start time: 0x01cc34e96c3bed25 Faulting application
path: C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
Faulting
module path: C:\Windows\syswow64\ole32.dll Report Id: cce2be25-a0dd-11e0-aade-00266c7c64f6

Error - 29/06/2011 03:29:49 | Computer Name = steve-tosh | Source = BackItUp5 | ID = 3374
Description = Backup process failed.

Error - 29/06/2011 17:30:20 | Computer Name = steve-tosh | Source = BackItUp5 | ID = 3374
Description = Backup process failed.

Error - 30/06/2011 01:30:25 | Computer Name = steve-tosh | Source = BackItUp5 | ID = 3374
Description = Backup process failed.

Error - 30/06/2011 11:29:36 | Computer Name = steve-tosh | Source = BackItUp5 | ID = 3374
Description = Backup process failed.

Error - 01/07/2011 11:26:30 | Computer Name = steve-tosh | Source = BackItUp5 | ID = 3374
Description = Backup process failed.

Error - 02/07/2011 04:39:58 | Computer Name = steve-tosh | Source = McLogEvent | ID = 5004
Description =

Error - 02/07/2011 04:39:58 | Computer Name = steve-tosh | Source = McLogEvent | ID = 5022
Description =

Error - 02/07/2011 04:39:58 | Computer Name = steve-tosh | Source = McLogEvent | ID = 5004
Description =

Error - 02/07/2011 04:39:58 | Computer Name = steve-tosh | Source = McLogEvent | ID = 5022
Description =

[ System Events ]
Error - 20/06/2011 14:16:34 | Computer Name = steve-tosh | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk1\DR1.

Error - 24/06/2011 02:47:03 | Computer Name = steve-tosh | Source = Service Control Manager | ID = 7043
Description = The Windows Update service did not shut down properly after receiving
a preshutdown control.

Error - 25/06/2011 03:50:23 | Computer Name = steve-tosh | Source = Service Control Manager | ID = 7043
Description = The Windows Update service did not shut down properly after receiving
a preshutdown control.

Error - 28/06/2011 13:44:38 | Computer Name = steve-tosh | Source = DCOM | ID = 10010
Description =

Error - 28/06/2011 13:45:26 | Computer Name = steve-tosh | Source = DCOM | ID = 10010
Description =

Error - 29/06/2011 02:27:33 | Computer Name = steve-tosh | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the LanmanServer service.

Error - 29/06/2011 02:28:03 | Computer Name = steve-tosh | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the WSearch service.

Error - 29/06/2011 02:28:03 | Computer Name = steve-tosh | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the AeLookupSvc service.

Error - 02/07/2011 02:26:35 | Computer Name = steve-tosh | Source = DCOM | ID = 10010
Description =

Error - 02/07/2011 13:16:14 | Computer Name = steve-tosh | Source = Service Control Manager | ID = 7030
Description = The TrueVector Internet Monitor service is marked as an interactive
service. However, the system is configured to not allow interactive services.
This service may not function properly.

< End of report >

aswMBR version 0.9.7.705 Copyright© 2011 AVAST Software
Run date: 2011-07-08 20:29:59
—————————–
20:29:59.303 OS Version: Windows x64 6.1.7600
20:29:59.303 Number of processors: 2 586 0x170A
20:29:59.303 ComputerName: STEVE-TOSH UserName: steve
20:30:00.458 Initialize success
20:30:27.597 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
20:30:27.597 Disk 0 Vendor: TOSHIBA_ GH10 Size: 305245MB BusType: 3
20:30:27.644 Disk 0 MBR read successfully
20:30:27.644 Disk 0 MBR scan
20:30:27.644 Disk 0 Windows 7 default MBR code
20:30:27.660 Service scanning
20:30:28.830 Disk 0 trace - called modules:
20:30:28.877 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
20:30:28.892 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8003de2790]
20:30:28.892 3 CLASSPNP.SYS[fffff88001a1743f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80030c3050]
20:30:28.892 Scan finished successfully
20:31:10.561 Disk 0 MBR has been saved successfully to "C:\Users\steve\Desktop\MBR.dat"
20:31:10.561 The log file has been saved successfully to "C:\Users\steve\Desktop\aswMBR.txt"

end of scans

BlackPegasus

Post #6July 9, 2011, 4:47 PM UTC

Hello h1gg1,

I'm not seeing much wrong in your log. Do you still get warnings that your computer is infected?

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Vista and Windows 7 users:

These tools MUST be run from the executable. (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")
========================

Download and Run ComboFix

Please download ComboFix from one of the following links.

Link 1.

Link 2.

**IMPORTANT !!! Save ComboFix.exe to your Desktop**
Please disable any Antivirus or Firewall you have active, as shown in this topic. Please close all open application windows.
Double click on ComboFix.exe & follow the prompts
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply

A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper
===========================
Please include in your next reply:
1. Any problem executing the instructions?
2. Combofix log
3. How is the computer behaving?

h1gg1

Post #7July 10, 2011, 9:26 PM UTC

Sorry for the delay in response, i am having trouble running Combofix. Combofix states that it should take approx 10 mins to scan but could easily double for badly infected pc's, tried to run last night at 8pm but got to stage 40 of the scan at 12.35pm and had to go to bed so switched off pc. Tried scan again tonight and after 3 hours only got to stage 4!! something is not right here?? To answer your question re: do i think i am still infected, the answer is a definite yes for the following reasons; Pc is slow and takes an age to open i.e. I am getting the message every time i open internet explorer, 'Website wants to open content using this programme on your computer C\user\steve\AppData\local\mch.exe. I believe this is related to Win 7 antivirus. i am also getting various Win 7 antivirus warnign and scanning pop ups. Will try and attempt another Combofix scan tomorrow night when i get in from work but bear with me as i am trying to respond with a log!!

BlackPegasus

Post #8July 11, 2011, 2:04 PM UTC

Hello h1gg1,

Try renaming Combofix if that doesn't work try running in Safemode.

Delete the combofix you have on the desktop then do this:

Download Combofix from any of the links below but rename it to iexplore.exe before saving it to your desktop.

Link 1
Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save iexplore.exe to your Desktop

Double click on the iexplore.exe ComboFix.exe & follow the prompts.
Be sure to download any updates.

If that didn't work, then try booting into safe mode and running it again

To Enter Safemode

Go to Start> Shut off your Computer> Restart
As the computer starts to boot-up, Tap the F8 KEY repeatedly,
this will bring up a menu.
Use the Up and Down Arrow Keys to scroll up to Safemode
Then press the Enter Key on your Keyboard
go into your usual account

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt so we can continue cleaning the system.

=================
Please include in your next reply:
1. Any problem executing the instructions?
2. Combofix log
3. How is the computer behaving?

h1gg1

Post #9July 11, 2011, 9:51 PM UTC

Went into safe mode and that seemed to dot the trick, thanks for your patience with me. Log as follows; ComboFix 11-07-11.02 - steve 11/07/2011 22:39:49.6.2 - x64 MINIMAL Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.2940.2034 [GMT 1:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: ZoneAlarm Antivirus *Disabled/Updated* {DE038A5B-9EDD-18A9-2361-FF7D98D43730} FW: ZoneAlarm Firewall *Enabled* {E6380B7E-D4B2-19F1-083E-56486607704B} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: ZoneAlarm Anti-Spyware *Disabled/Updated* {65626BBF-B8E7-1727-19D1-C40FE3537D8D} * Created a new restore point . . ((((((((((((((((((((((((( Files Created from 2011-06-11 to 2011-07-11 ))))))))))))))))))))))))))))))) . . 2011-07-11 21:44 . 2011-07-11 21:44 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-07-08 19:15 . 2011-06-07 17:10 8873296 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D978420E-4E7F-42CB-B5A3-C78C7CACE161}\mpengine.dll 2011-07-06 21:51 . 2011-05-29 08:11 39984 —-a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys 2011-07-06 21:51 . 2011-07-06 21:51 ——– d—–w- c:\programdata\Malwarebytes 2011-07-06 21:51 . 2011-05-29 08:11 25912 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-07-06 21:51 . 2011-07-06 21:51 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2011-07-03 07:53 . 2011-07-03 07:53 ——– d—–w- c:\programdata\Kaspersky SDK 2011-07-02 17:15 . 2011-07-02 17:15 ——– d—–w- c:\program files (x86)\Conduit 2011-07-02 17:15 . 2011-07-02 17:15 0 —-a-w- c:\windows\SysWow64\ConduitEngine.tmp 2011-07-02 17:15 . 2011-07-02 17:15 ——– d—–w- c:\program files (x86)\ZoneAlarm_Extreme_Security 2011-07-02 17:14 . 2011-07-02 17:14 ——– d—–w- c:\program files\CheckPoint 2011-07-02 17:14 . 2011-07-02 17:14 ——– d—–w- c:\programdata\CheckPoint 2011-07-02 17:13 . 2010-04-09 11:06 374664 —-a-w- c:\windows\system32\drivers\netio.sys 2011-07-02 17:13 . 2011-07-02 17:14 ——– d—–w- c:\program files (x86)\CheckPoint 2011-07-02 08:31 . 2011-07-02 08:31 ——– d—–w- c:\program files (x86)\Zone Labs 2011-07-02 08:31 . 2011-07-02 08:31 ——– d—–w- c:\windows\Internet Logs 2011-06-27 17:04 . 2011-06-27 17:04 ——– d—–r- C:\MSOCache 2011-06-24 16:36 . 2011-06-24 16:40 ——– d—–w- c:\programdata\VirtualizedApplications 2011-06-24 06:09 . 2011-06-25 07:46 ——– d—–w- c:\program files (x86)\Microsoft Application Virtualization Client 2011-06-24 05:53 . 2010-01-12 09:11 33792 —-a-w- c:\windows\system32\Spool\prtprocs\x64\ssp7mpc.dll 2011-06-21 20:26 . 2011-06-21 20:26 404640 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2011-06-21 20:26 . 2011-06-21 20:26 ——– d—–w- c:\windows\SysWow64\Macromed 2011-06-21 06:16 . 2011-06-21 06:16 ——– d—–w- c:\program files (x86)\Microsoft.NET 2011-06-20 22:08 . 2011-06-20 22:08 ——– d—–w- c:\program files (x86)\MSXML 4.0 2011-06-20 17:17 . 2011-06-20 17:17 ——– d—–w- c:\windows\SysWow64\Wat 2011-06-20 17:17 . 2011-06-20 17:17 ——– d—–w- c:\windows\system32\Wat 2011-06-20 09:09 . 2010-09-14 06:45 367104 —-a-w- c:\windows\system32\wcncsvc.dll 2011-06-20 09:09 . 2010-09-14 06:07 276992 —-a-w- c:\windows\SysWow64\wcncsvc.dll 2011-06-20 08:49 . 2009-11-25 11:47 99176 —-a-w- c:\windows\SysWow64\PresentationHostProxy.dll 2011-06-20 08:49 . 2009-11-25 11:47 49472 —-a-w- c:\windows\SysWow64\netfxperf.dll 2011-06-20 08:49 . 2009-11-25 11:47 48960 —-a-w- c:\windows\system32\netfxperf.dll 2011-06-20 08:49 . 2009-11-25 11:47 297808 —-a-w- c:\windows\SysWow64\mscoree.dll 2011-06-20 08:49 . 2009-11-25 11:47 295264 —-a-w- c:\windows\SysWow64\PresentationHost.exe 2011-06-20 08:49 . 2009-11-25 11:47 1130824 —-a-w- c:\windows\SysWow64\dfshim.dll 2011-06-20 08:49 . 2009-11-25 11:47 109912 —-a-w- c:\windows\system32\PresentationHostProxy.dll 2011-06-20 08:49 . 2009-11-25 11:47 444752 —-a-w- c:\windows\system32\mscoree.dll 2011-06-20 08:49 . 2009-11-25 11:47 320352 —-a-w- c:\windows\system32\PresentationHost.exe 2011-06-20 08:49 . 2009-11-25 11:47 1942856 —-a-w- c:\windows\system32\dfshim.dll 2011-06-20 08:49 . 2010-02-23 08:16 294912 —-a-w- c:\windows\system32\browserchoice.exe 2011-06-20 08:44 . 2010-03-04 04:40 184832 —-a-w- c:\windows\system32\drivers\usbvideo.sys 2011-06-20 08:44 . 2010-03-04 04:32 243712 —-a-w- c:\windows\system32\drivers\ks.sys 2011-06-20 06:20 . 2010-12-18 06:11 714752 —-a-w- c:\windows\system32\kerberos.dll 2011-06-20 06:20 . 2010-12-18 05:29 541184 —-a-w- c:\windows\SysWow64\kerberos.dll 2011-06-20 06:20 . 2010-03-05 07:52 84992 —-a-w- c:\windows\system32\asycfilt.dll 2011-06-20 06:20 . 2010-03-05 07:42 67584 —-a-w- c:\windows\SysWow64\asycfilt.dll 2011-06-20 06:20 . 2011-04-27 02:57 102400 —-a-w- c:\windows\system32\drivers\dfsc.sys 2011-06-20 06:18 . 2011-02-24 06:30 476160 —-a-w- c:\windows\system32\XpsGdiConverter.dll 2011-06-20 06:17 . 2011-03-12 12:03 662528 —-a-w- c:\windows\system32\XpsPrint.dll 2011-06-20 06:16 . 2009-12-11 10:29 153160 —-a-w- c:\windows\system32\drivers\ksecpkg.sys 2011-06-20 06:11 . 2011-05-24 18:14 270720 ——w- c:\windows\system32\MpSigStub.exe 2011-06-19 22:54 . 2009-12-29 08:03 220672 —-a-w- c:\windows\system32\wintrust.dll 2011-06-19 22:54 . 2009-12-29 06:55 172032 —-a-w- c:\windows\SysWow64\wintrust.dll 2011-06-19 22:54 . 2010-01-09 07:19 139264 —-a-w- c:\windows\system32\cabview.dll 2011-06-19 22:54 . 2010-01-09 06:52 132608 —-a-w- c:\windows\SysWow64\cabview.dll 2011-06-19 22:50 . 2011-06-19 22:50 ——– d—–w- c:\programdata\ToshibaEurope 2011-06-19 22:50 . 2011-07-06 18:27 ——– d—–w- c:\users\steve 2011-06-19 22:42 . 2011-06-19 22:42 ——– d—–w- c:\windows\OemDrv 2011-06-19 22:40 . 2011-06-19 22:40 ——– d—–w- c:\windows\Downloaded Installations 2011-06-19 22:36 . 2009-06-22 16:06 35008 —-a-w- c:\windows\system32\drivers\PGEffect.sys 2011-06-19 22:34 . 2011-06-19 22:34 ——– d—–w- c:\program files (x86)\Atheros 2011-06-19 22:34 . 2009-11-06 11:56 1550848 —-a-w- c:\windows\system32\drivers\athrx.sys 2011-06-19 22:34 . 2011-06-19 22:35 ——– d—–w- c:\programdata\Atheros . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-05-07 16:51 . 2011-05-07 16:51 454232 —-a-w- c:\windows\system32\drivers\vsdatant.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{a94e8dc9-07aa-45a7-8af2-a0375473a5cd}"= "c:\program files (x86)\ZoneAlarm_Extreme_Security\prxtbZone.dll" [2011-03-28 176936] . [HKEY_CLASSES_ROOT\clsid\{a94e8dc9-07aa-45a7-8af2-a0375473a5cd}] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{a94e8dc9-07aa-45a7-8af2-a0375473a5cd}] 2011-03-28 16:22 176936 —-a-w- c:\program files (x86)\ZoneAlarm_Extreme_Security\prxtbZone.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{a94e8dc9-07aa-45a7-8af2-a0375473a5cd}"= "c:\program files (x86)\ZoneAlarm_Extreme_Security\prxtbZone.dll" [2011-03-28 176936] . [HKEY_CLASSES_ROOT\clsid\{a94e8dc9-07aa-45a7-8af2-a0375473a5cd}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TOSHIBA Online Product Information"="c:\program files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe" [2010-03-03 4581280] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2009-10-06 1294136] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672] "NBAgent"="c:\program files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe" [2010-03-09 1086760] "TWebCamera"="c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2010-02-24 2454840] "ZoneAlarm"="c:\program files (x86)\CheckPoint\ZoneAlarm\zatray.exe" [2011-06-24 71824] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "TOSHIBA Online Product Information"="c:\program files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe" [2010-03-03 4581280] . c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ TRDCReminder.lnk - c:\program files (x86)\Toshiba\TRDCReminder\TRDCReminder.exe [2009-9-1 481184] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "EnableLinkedConnections"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x] R3 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe [2010-02-11 124368] R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-10-06 51512] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2010-01-28 249200] S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-03-10 46448] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664] S2 ISWKL;ZoneAlarm ForceField ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2011-05-30 33672] S2 IswSvc;ZoneAlarm ForceField IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [2011-05-30 825984] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-04-24 483688] S3 FwLnk;FwLnk Driver;c:\windows\system32\DRIVERS\FwLnk.sys [x] S3 icsak;icsak;c:\program files\CheckPoint\ZAForceField\AK\icsak.sys [2011-05-30 45448] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x] S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-04-24 209768] S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-02-05 137560] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x] . . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-03-18 166424] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-03-18 391192] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-03-18 410648] "cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2010-03-10 520760] "SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-11-19 307768] "Toshiba TEMPRO"="c:\program files (x86)\Toshiba TEMPRO\TemproTray.exe" [2010-02-11 1050072] "TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-02-05 709976] "TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376] "Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaReminder.exe" [2010-02-12 136136] "ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2011-05-30 1125504] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://google.co.uk/ mLocal Page = c:\windows\SysWOW64\blank.htm TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\steve\AppData\Roaming\Mozilla\Firefox\Profiles\7oegxzz3.default\ FF - prefs.js: network.proxy.type - 0 . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Toolbar-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file) Toolbar-Locked - (no file) WebBrowser-{A94E8DC9-07AA-45A7-8AF2-A0375473A5CD} - (no file) HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE HKLM-Run-SmoothView - c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe HKLM-Run-00TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe HKLM-Run-TosReelTimeMonitor - c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe HKLM-Run-TosNC - c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe HKLM-Run-SmartFaceVWatcher - c:\program files (x86)\Toshiba\SmartFaceV\SmartFaceVWatcher.exe AddRemove-conduitEngine - c:\program files (x86)\ConduitEngine\ConduitEngineUninstall.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe c:\program files (x86)\TOSHIBA\ConfigFree\NDSTray.exe c:\program files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe . ************************************************************************** . Completion time: 2011-07-11 22:50:29 - machine was rebooted ComboFix-quarantined-files.txt 2011-07-11 21:50 . Pre-Run: 123,710,349,312 bytes free Post-Run: 123,647,361,024 bytes free . - - End Of File - - 18C5BB8EF5502F509327466F55D697BD

BlackPegasus

Post #10July 12, 2011, 1:46 PM UTC

Hello h1gg1,

I should be thanking you for being patience.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
*mch*
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt
=============
Please include in your next reply:
1. Any problem executing the instructions?
2. SystemLook.txt

h1gg1

Post #11July 12, 2011, 8:08 PM UTC

SystemLook 04.09.10 by jpshortstuff
Log created at 21:05 on 12/07/2011 by steve
Administrator - Elevation successful
WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results.

========== filefind ==========

Searching for "*mch*"
C:\Program Files (x86)\Java\jre6\lib\zi\Asia\Kamchatka –a—- 1040 bytes [08:14 08/04/2010] [08:14 08/04/2010] F7D3044EDE69ECC32DBC759AC849EF80
C:\Windows\inf\mchgr.inf –a—- 93878 bytes [05:31 14/07/2009] [05:31 14/07/2009] AE24471762A7E0F7509770F99218AAEE
C:\Windows\inf\mchgr.PNF –a—- 133632 bytes [04:50 14/07/2009] [04:50 14/07/2009] 9F5876D2385B3729A2D475693A97A301
C:\Windows\Prefetch\MCHOST.EXE-7C07A572.pf –a—- 32688 bytes [22:51 19/06/2011] [08:39 02/07/2011] FB24D96DB35DE18589288267C950DADE
C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_mchgr.inf_31bf3856ad364e35_6.1.7601.17514_none_7320af8f6febd179.manif
est –a—- 14749 bytes [06:16 26/06/2011] [05:23 20/11/2010] 362712304243ACA36A2968DE4CB337B4
C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_mchgr.inf_31bf3856ad364e35_6.1.7601.17514_none_7320af8f6febd179\mchgr.inf –a—- 93878 bytes [06:20 26/06/2011] [04:15 20/11/2010] 90626B34C1E0994243B713113E4207F6
C:\Windows\System32\DriverStore\en-US\mchgr.inf_loc –a—- 18218 bytes [05:35 14/07/2009] [02:26 14/07/2009] 5CAC2BFAB9249423B4DA8270C696C7DD
C:\Windows\System32\DriverStore\FileRepository\mchgr.inf_amd64_neutral_7cf7ee04af725210\mchgr.inf –a—- 93878 bytes [20:39 13/07/2009] [20:39 13/07/2009] AE24471762A7E0F7509770F99218AAEE
C:\Windows\System32\DriverStore\FileRepository\mchgr.inf_amd64_neutral_7cf7ee04af725210\mchgr.PNF –a—- 128008 bytes [05:31 14/07/2009] [05:31 14/07/2009] 7F913D33F1052338452203D3BF4E407B
C:\Windows\winsxs\amd64_mchgr.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_fd11d213229f2cdd\mchgr.inf_loc –a—- 18218 bytes [05:35 14/07/2009] [02:26 14/07/2009] 5CAC2BFAB9249423B4DA8270C696C7DD
C:\Windows\winsxs\amd64_mchgr.inf_31bf3856ad364e35_6.1.7600.16385_none_70ef9bc772fd4ddf\mchgr.inf –a—- 93878 bytes [20:39 13/07/2009] [20:39 13/07/2009] AE24471762A7E0F7509770F99218AAEE
C:\Windows\winsxs\Manifests\amd64_mchgr.inf-languagepack_31bf3856ad364e35_6.1.7600.16385_en-us_396bd6532c538744.manifest –a—- 1113 bytes [05:36 14/07/2009] [05:36 14/07/2009] CCC395E1F35C10D6901D59C081A7A6F5
C:\Windows\winsxs\Manifests\amd64_mchgr.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_fd11d213229f2cdd.manifest –a—- 1777 bytes [05:35 14/07/2009] [02:38 14/07/2009] A2459E76ED71D5105776087BDF186126
C:\Windows\winsxs\Manifests\amd64_mchgr.inf_31bf3856ad364e35_6.1.7600.16385_none_70ef9bc772fd4ddf.manif
est –a—- 14749 bytes [05:28 14/07/2009] [05:28 14/07/2009] ACACB9DD75C03AB13770C865B902ABB3
C:\Windows\winsxs\Manifests\amd64_mchgr.inf_31bf3856ad364e35_6.1.7601.17514_none_7320af8f6febd179.manif
est ——- 14749 bytes [06:46 24/06/2011] [06:46 24/06/2011] 362712304243ACA36A2968DE4CB337B4

-= EOF =-

No problem executing the instructions and no pop ups now, but ie seems to run very slow compared to normal.

Thanks

BlackPegasus

Post #12July 13, 2011, 3:30 AM UTC

Hello h1gg1,

Clear Java cache

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup) If you do not see the icon, look to your left and click 'Switch to Classic View'.

On the General tab, under Temporary Internet Files, click the Settings button.
Next, click on the Delete Files button
There are two options in the window to clear the cache - Leave BOTH Checked
- Applications and Applets
  Trace and Log Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

=================
NEXT

Download and run Puran Disk Defragmenter
=================
Please include in your next reply:
1. Any problem executing the instructions?
2. How is the computer behaving?

h1gg1

Post #13July 13, 2011, 10:31 PM UTC

No problems following your instructions. There are no pop ups now but i.e. still takes an age to start, (at least 30 secs), and pc freezes when typing in website addresses. Basically pc still running slow!!! Something not right!!

BlackPegasus

Post #14July 15, 2011, 12:46 AM UTC

Hello h1gg1,

I don't see any malware that could be causing the issue and that it may be Zone alarm and the only way to check would be to uninstall it, and see if you notice any difference in the speed.If that makes a difference then you will have to find a different Firewall.

h1gg1

Post #15July 15, 2011, 12:35 PM UTC

OK Gail Thanks for all your help, it is appreciated. steve Higgins

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

win 7 antivirus 2012

✨ Ask AI

Ask AI