Spyware / Malware / Virus Removal

Infected with searchqu

14 min read

Looking for the outcome? Ask AI

wooconley

Post #16August 6, 2011, 11:24 PM UTC

New - hopefully close to done! ______________________ ComboFix 11-08-06.02 - Rick ASUS 08/06/2011 19:08:36.2.8 - x64 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.9207.7219 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Rick ASUS\Desktop\CFScript.txt AV: ZoneAlarm Antivirus *Disabled/Updated* {DE038A5B-9EDD-18A9-2361-FF7D98D43730} FW: ZoneAlarm Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: ZoneAlarm Anti-Spyware *Disabled/Updated* {65626BBF-B8E7-1727-19D1-C40FE3537D8D} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Rick ASUS\AppData\Local\Temp\IswTmp\WH\0 c:\users\RICKAS~1\AppData\Local\Temp\IswTmp\WH\0 . . ((((((((((((((((((((((((( Files Created from 2011-07-06 to 2011-08-06 ))))))))))))))))))))))))))))))) . . 2011-08-06 23:14 . 2011-08-06 23:14 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-08-06 02:53 . 2011-08-06 02:53 ——– d—–w- C:\_OTL 2011-08-05 23:58 . 2011-08-05 23:58 ——– d—–w- c:\users\Rick ASUS\AppData\Roaming\#ISW.FS# 2011-08-05 20:21 . 2011-07-13 04:53 8578896 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8991C1BD-D5FB-4B46-AC7D-C3E0D4211FE5}\mpengine.dll 2011-07-27 21:50 . 2011-07-27 21:50 ——– d—–w- c:\users\Rick ASUS\AppData\Roaming\AnvSoft 2011-07-27 21:50 . 2011-07-27 21:50 ——– d—–w- c:\program files (x86)\AnvSoft 2011-07-27 20:24 . 2011-07-27 20:30 ——– d—–w- c:\programdata\boost_interprocess 2011-07-27 18:35 . 2011-07-27 18:35 ——– d—–w- c:\users\Rick ASUS\AppData\Roaming\Corel 2011-07-27 18:30 . 2011-07-27 18:30 ——– d—–w- c:\programdata\InterVideo 2011-07-27 18:29 . 2011-07-27 18:35 ——– d—–w- c:\programdata\Corel 2011-07-27 18:29 . 2011-07-27 18:29 ——– d—–w- c:\programdata\Ulead Systems 2011-07-27 18:27 . 2011-07-27 18:27 ——– d—–w- c:\program files (x86)\Common Files\Protexis 2011-07-27 18:27 . 2011-07-27 18:27 ——– d—–w- c:\program files (x86)\Common Files\Corel 2011-07-27 18:26 . 2011-07-27 18:26 ——– d—–w- c:\program files (x86)\Common Files\Ulead Systems 2011-07-27 18:26 . 2011-07-27 18:26 ——– d—–w- c:\program files (x86)\Corel 2011-07-27 16:22 . 2011-07-27 16:22 ——– d—–w- c:\program files\iTunes 2011-07-27 16:22 . 2011-07-27 16:22 ——– d—–w- c:\program files (x86)\iTunes 2011-07-27 16:22 . 2011-07-27 16:22 ——– d—–w- c:\program files\iPod 2011-07-27 16:20 . 2011-07-27 16:20 ——– d—–w- c:\program files\Bonjour 2011-07-25 01:20 . 2011-08-06 00:05 ——– d—–w- c:\program files (x86)\Ask.com 2011-07-25 01:19 . 2011-07-25 01:19 ——– d—–w- c:\programdata\NCH Software 2011-07-25 01:19 . 2011-07-25 01:19 ——– d—–w- c:\program files (x86)\NCH Software 2011-07-25 01:19 . 2011-07-25 01:19 ——– d—–w- c:\users\Rick ASUS\AppData\Roaming\NCH Software 2011-07-22 18:02 . 2011-07-22 18:05 ——– d—–w- c:\programdata\Protexis 2011-07-22 18:02 . 2011-07-27 18:39 ——– d—–w- c:\users\Rick ASUS\AppData\Roaming\Ulead Systems 2011-07-22 18:01 . 2011-07-22 18:01 ——– d—–w- c:\programdata\eSellerate 2011-07-22 18:01 . 2011-07-22 18:01 ——– d—–w- c:\program files (x86)\SmartSound Software 2011-07-22 18:01 . 2011-07-22 18:32 ——– d—–w- c:\programdata\SmartSound Software Inc 2011-07-22 17:59 . 2005-04-13 21:00 212992 —-a-w- c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ILog.dll 2011-07-22 17:41 . 2011-08-06 23:15 ——– d—–w- c:\program files (x86)\Common Files\Akamai 2011-07-16 01:56 . 2011-08-06 03:10 ——– d—–w- c:\windows\Internet Logs 2011-07-16 01:55 . 2011-07-16 01:55 ——– d—–w- c:\program files (x86)\Conduit 2011-07-16 01:55 . 2011-07-16 01:55 ——– d—–w- c:\users\Rick ASUS\AppData\Local\Conduit 2011-07-16 01:55 . 2011-07-16 01:55 ——– d—–w- c:\program files (x86)\ZoneAlarm_Extreme_Security 2011-07-16 00:44 . 2011-07-16 01:54 ——– d—–w- c:\program files (x86)\CheckPoint 2011-07-12 19:10 . 2011-06-11 02:56 3134464 —-a-w- c:\windows\system32\win32k.sys 2011-07-12 15:34 . 2011-07-12 15:34 96104 —-a-w- c:\windows\system32\dns-sd.exe 2011-07-12 15:34 . 2011-07-12 15:34 85864 —-a-w- c:\windows\system32\dnssd.dll 2011-07-12 15:34 . 2011-07-12 15:34 61288 —-a-w- c:\windows\system32\jdns_sd.dll 2011-07-12 15:34 . 2011-07-12 15:34 212840 —-a-w- c:\windows\system32\dnssdX.dll 2011-07-12 15:20 . 2011-07-12 15:20 83816 —-a-w- c:\windows\SysWow64\dns-sd.exe 2011-07-12 15:20 . 2011-07-12 15:20 73064 —-a-w- c:\windows\SysWow64\dnssd.dll 2011-07-12 15:20 . 2011-07-12 15:20 50536 —-a-w- c:\windows\SysWow64\jdns_sd.dll 2011-07-12 15:20 . 2011-07-12 15:20 178536 —-a-w- c:\windows\SysWow64\dnssdX.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-07-15 16:49 . 2009-08-26 14:31 313208 —-a-w- c:\windows\SysWow64\TubeFinder.exe 2011-06-17 21:56 . 2011-06-05 19:28 404640 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2011-06-02 05:56 . 2011-07-12 19:10 44032 —-a-w- c:\windows\apppatch\acwow64.dll 2011-05-24 23:14 . 2009-10-03 20:01 270720 ——w- c:\windows\system32\MpSigStub.exe 2011-05-24 11:21 . 2011-06-29 02:09 404992 —-a-w- c:\windows\system32\umpnpmgr.dll 2011-05-24 10:34 . 2011-06-29 02:09 64512 —-a-w- c:\windows\SysWow64\devobj.dll 2011-05-24 10:34 . 2011-06-29 02:09 44544 —-a-w- c:\windows\SysWow64\devrtl.dll 2011-05-24 10:34 . 2011-06-29 02:09 145920 —-a-w- c:\windows\SysWow64\cfgmgr32.dll 2011-05-24 10:32 . 2011-06-29 02:09 252928 —-a-w- c:\windows\SysWow64\drvinst.exe . . ((((((((((((((((((((((((((((( SnapShot@2011-08-06_17.30.14 ))))))))))))))))))))))))))))))))))))))))) . - 2009-07-14 04:54 . 2011-08-06 17:26 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:54 . 2011-08-06 23:15 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-07-14 04:54 . 2011-08-06 17:26 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2011-08-06 23:15 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2011-08-06 17:26 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:54 . 2011-08-06 23:15 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-11-19 01:07 . 2011-08-06 23:17 48080 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2011-08-06 23:17 41032 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin - 2009-07-14 05:10 . 2011-08-06 17:29 41032 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2009-11-19 00:55 . 2011-08-06 23:17 8108 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1341092738-1858294347-2959768899-1000_UserData.bin + 2011-08-06 23:15 . 2011-08-06 23:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2011-08-06 17:26 . 2011-08-06 17:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2011-08-06 17:26 . 2011-08-06 17:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2011-08-06 23:15 . 2011-08-06 23:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-07-14 05:01 . 2011-08-06 17:25 481456 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 05:01 . 2011-08-06 23:14 481456 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2009-07-14 02:34 . 2011-08-06 15:53 10223616 c:\windows\system32\SMI\Store\Machine\schema.dat + 2009-07-14 02:34 . 2011-08-06 17:42 10223616 c:\windows\system32\SMI\Store\Machine\schema.dat + 2010-11-24 07:04 . 2011-08-06 23:14 14108068 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1341092738-1858294347-2959768899-1000-8192.dat - 2010-11-24 07:04 . 2011-08-06 17:25 14108068 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1341092738-1858294347-2959768899-1000-8192.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312] "{a94e8dc9-07aa-45a7-8af2-a0375473a5cd}"= "c:\program files (x86)\ZoneAlarm_Extreme_Security\prxtbZone.dll" [2011-03-28 176936] . [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}] . [HKEY_CLASSES_ROOT\clsid\{a94e8dc9-07aa-45a7-8af2-a0375473a5cd}] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{a94e8dc9-07aa-45a7-8af2-a0375473a5cd}] 2011-03-28 16:22 176936 —-a-w- c:\program files (x86)\ZoneAlarm_Extreme_Security\prxtbZone.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2011-05-17 17:29 1490312 —-a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{a94e8dc9-07aa-45a7-8af2-a0375473a5cd}"= "c:\program files (x86)\ZoneAlarm_Extreme_Security\prxtbZone.dll" [2011-03-28 176936] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312] . [HKEY_CLASSES_ROOT\clsid\{a94e8dc9-07aa-45a7-8af2-a0375473a5cd}] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadwin PrintScreen"="c:\program files (x86)\Gadwin Systems\PrintScreen\PrintScreen.exe" [2008-12-09 495616] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Arctosa"="c:\program files\Razer\Arctosa\razerhid.exe" [2008-10-06 147456] "IJNetworkScanUtility"="c:\program files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2007-05-21 124512] "JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files (x86)\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232] "SoundMAXPnP"="c:\program files (x86)\Analog Devices\Core\smax4pnp.exe" [2009-06-05 1310720] "CPU Level Up"="c:\program files\ASUS\CPU Level Up\CpuLevelUp.exe" [2009-08-19 1170432] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064] "CarboniteSetupLite"="c:\program files (x86)\Carbonite\CarbonitePreinstaller.exe" [2009-08-04 318096] "MaxMenuMgr"="c:\program files (x86)\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-12-18 197928] "ZoneAlarm"="c:\program files (x86)\CheckPoint\ZoneAlarm\zatray.exe" [2011-07-12 71824] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-07-19 421736] "ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2011-05-17 395144] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ WinZip Quick Pick.lnk.disabled [2009-5-12 1838] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-] "OpwareSE4"="c:\program files (x86)\ScanSoft\OmniPageSE4\OpwareSE4.exe" "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime "RunAIShell"=c:\program files (x86)\ASUS\AI Manager\AsShellApplication.exe "Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" "SSBkgdUpdate"="c:\program files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560] R3 netr28x;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr28x.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 vsdatant7;vsdatant7;c:\windows\system32\drivers\vsdatant.win7.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136] S2 FreeAgentGoNext Service;Seagate Service;c:\program files (x86)\Seagate\SeagateManager\Sync\FreeAgentService.exe [2009-12-18 189736] S2 ISWKL;ZoneAlarm ForceField ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2011-05-30 33672] S2 IswSvc;ZoneAlarm ForceField IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [2011-05-30 825984] S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files (x86)\McAfee\SiteAdvisor\McSACore.exe [2011-02-16 101048] S2 ReflectService;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe [2009-08-25 294880] S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\windows\SysWOW64\nvSCPAPISvr.exe [2009-06-10 232960] S3 Arctosa;Arctosa Keyboard;c:\windows\system32\drivers\Arctosa.sys [x] S3 icsak;icsak;c:\program files\CheckPoint\ZAForceField\AK\icsak.sys [2011-05-30 45448] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] Akamai REG_MULTI_SZ Akamai . Contents of the 'Scheduled Tasks' folder . 2011-08-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1341092738-1858294347-2959768899-1000Core.job - c:\users\Rick ASUS\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-14 00:55] . 2011-08-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1341092738-1858294347-2959768899-1000UA.job - c:\users\Rick ASUS\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-14 00:55] . 2009-07-11 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job - c:\program files (x86)\Spybot - Search & Destroy\SpybotSD.exe [2009-07-11 19:31] . 2009-07-11 c:\windows\Tasks\Spybot - Search & Destroy Updater - Scheduled Task.job - c:\program files (x86)\Spybot - Search & Destroy\SDUpdate.exe [2009-07-11 19:31] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1840720] "WrtMon.exe"="c:\windows\system32\spool\drivers\x64\3\WrtMon.exe" [2006-09-20 20480] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-10 16315424] "ISW"="" [BU] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://uk.search.yahoo.com/search?fr=mcafee&p=%s IE: Append to existing PDF - c:\program files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert link target to Adobe PDF - c:\program files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = [removed] [removed] FF - ProfilePath - c:\users\Rick ASUS\AppData\Roaming\Mozilla\Firefox\Profiles\8o2qytop.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2925418&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Ask.com FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=NCH&o=15483&locale=en_US&apn_uid=9400E7A1-106E-474B-A903-3638CCAD05D1&apn_ptnrs=OW&apn_sauid=4E3CB46B-874E-4146-B96A-F95DB1BF933D&apn_dtid=YYYYYYYYUS&q= FF - user.js: yahoo.homepage.dontask - true . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10a.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10a.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}] @Denied: (A 2) (Everyone) @="IFlashBroker2" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Environment*] "Licence0"="04F0D21-79D8-7A25-D702-433F" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\ASUS\AASP\1.00.82\aaCenter.exe c:\program files (x86)\ASUS\AI Direct Link\AsCmd.exe c:\program files (x86)\Bonjour\mDNSResponder.exe c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe c:\windows\SysWOW64\rundll32.exe c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE c:\program files (x86)\ASUS\AI Direct Link\AsShare.exe c:\windows\System32\spool\drivers\x64\3\WrtProc.exe c:\program files\Razer\Arctosa\razertra.exe . ************************************************************************** . Completion time: 2011-08-06 19:21:57 - machine was rebooted ComboFix-quarantined-files.txt 2011-08-06 23:21 ComboFix2.txt 2011-08-06 20:02 . Pre-Run: 246,018,052,096 bytes free Post-Run: 245,943,611,392 bytes free . - - End Of File - - B7D6723D2699AF30370CBADFA9A57349 ______________________________________ Not doing next step until I hear from you

wooconley

Post #17August 6, 2011, 11:28 PM UTC

oops! forgot to ask - should ZA and spybot etc be disabled before running malwarebytes?

CatByte

Post #18August 6, 2011, 11:40 PM UTC

yes, disable them looking good so far

wooconley

Post #19August 6, 2011, 11:41 PM UTC

close browser first?

CatByte

Post #20August 6, 2011, 11:43 PM UTC

yes, close the browser and all other windows while running MalwareBytes and just have the browser open for the online scan with ESET, no other programs open and all your security programs disables. Zone Alarm is notorious for interfering with other virus scanners.

wooconley

Post #21August 6, 2011, 11:59 PM UTC

Here's the log from Rick's computer ___________________________ Malwarebytes' Anti-Malware 1.51.1.1800 www.malwarebytes.org Database version: 7397 Windows 6.1.7600 Internet Explorer 9.0.8112.16421 8/6/2011 7:47:06 PM mbam-log-2011-08-06 (19-47-06).txt Scan type: Quick scan Objects scanned: 174657 Time elapsed: 1 minute(s), 26 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

wooconley

Post #22August 7, 2011, 12:07 AM UTC

Here's the Malwarebytes from my laptop. Found something. I did the remove selected. ______________________ Malwarebytes' Anti-Malware 1.51.1.1800 www.malwarebytes.org Database version: 7397 Windows 6.1.7601 Service Pack 1 Internet Explorer 9.0.8112.16421 8/6/2011 8:02:52 PM mbam-log-2011-08-06 (20-02-52).txt Scan type: Quick scan Objects scanned: 174155 Time elapsed: 4 minute(s), 14 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 1 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

wooconley

Post #23August 7, 2011, 2:55 AM UTC

Here is the ESETSCAN log from Rick's computer. It found 4 threats - 2 in files we backed up from an even older computer. Don't know what to do next. The ESET scan is still running on my laptop. Its at 99% and has not found anything. I don't run Zone Alarm on my laptop. I use Microsoft Sec Essentials. Perhaps he should dump ZA? ___________________________ C:\Users\Rick ASUS\Downloads\avc-free.exe Win32/OpenCandy application C:\Users\Rick ASUS\Downloads\Setup_FreeFlvConverterN.exe Win32/Adware.Toolbar.Dealio application D:\Ricks old Dell\Rick\Downloads\Setup_FreeFlvConverter.exe Win32/Adware.Toolbar.Dealio application D:\Ricks old Dell\Rick\Downloads\Setup_FreeFlvConverterN.exe Win32/Adware.Toolbar.Dealio application

CatByte

Post #24August 7, 2011, 3:02 AM UTC

I use Microsoft Security Essentials myself, it's an excellent AntiVirus product.

Please do the following on your husbands computer:

Navigate to these files > right click and delete them

C:\Users\Rick ASUS\Downloads\Setup_FreeFlvConverterN.exe
D:\Ricks old Dell\Rick\Downloads\Setup_FreeFlvConverter.exe
D:\Ricks old Dell\Rick\Downloads\Setup_FreeFlvConverterN.exe

NEXT

Visit ADOBE and download the latest version of Acrobat Reader (version X)
Having the latest updates ensures there are no security vulnerabilities in your system.

NEXT

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 26 and save it to your desktop.
Scroll down to where it says JDK 6 Update 26 (JDK or JRE)
Click the Download JRE button to the right
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u26 with JavaFX 1 License Agreement". Click on Continue. The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u26-windows-i586.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
  Trace and Log Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

NEXT

Please run a quick scan with OTL (no need for the custom entries this time) and post the resulting log, and advise how his computer is running now and if there are any outstanding issues.

wooconley

Post #25August 7, 2011, 4:27 PM UTC

Hi again, I got the Adobe reader but when I went to get the Java JRE there was a version 7 now. Should I get that one? Also, My ESET SCAN is still running - all night! - it's going through all my histories on my Seagate external hard drive. It's found 7 threats so far some of which look like copies from multiple back ups. I didn't have Rick''s Seagate hooked up when I've done his scans. Should I just go in and delete everything on the ext drive? I could then do a fresh back up of his documents etc. Sorry I'm so helpless

CatByte

Post #26August 7, 2011, 5:31 PM UTC

no need to apologize sometimes ESET alerts on items not because they are threats, but because of the type of file that it is, or it will find items already in quarantine or old system restore points, which shouldn't be removed individually, the whole restore point should be emptied, so don't be too alarmed till we see what is there. Java 7 is brand new, the site is still recommending version 6 update 26, but you can update to version 7 if you wish.

wooconley

Post #27August 7, 2011, 7:52 PM UTC

Here's the log from my laptop - ran 18+ hours! I've still got to do the java download on Rick's then the scan. I;ll post that log later __________________________________________ C:\Users\Owner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\68b74c9f-4c1d9509 probably a variant of Java/Agent.BR trojan D:\Downloads\Setup_FreeFlvConverter.exe Win32/Adware.Toolbar.Dealio application D:\Pictures\Web or Animation graphics\Kitty cat.exe Win32/Joke.ScreenMate application F:\Seagate Backup\PAMLAPTOP\C\Users\Owner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\68b74c9f-4c1d9509 probably a variant of Java/Agent.BR trojan F:\Seagate Backup\PAMLAPTOP\D\Downloads\Setup_FreeFlvConverter.exe Win32/Adware.Toolbar.Dealio application F:\Seagate Backup\PAMLAPTOP\D\Pictures\Web or Animation graphics\Kitty cat.exe Win32/Joke.ScreenMate application F:\Seagate Backup\PAMLAPTOP\History\Level2\C\Users\Owner\AppData\Local\Mozilla\Firefox\Profiles\k8yw8rfh.default\Cache\D1283E09d01 JS/Fraud.NAH trojan F:\Seagate Sync\VOL\VOL00\Downloads\Setup_FreeFlvConverter.exe Win32/Adware.Toolbar.Dealio application F:\Seagate Sync\VOL\VOL00\Pictures\Web or Animation graphics\Kitty cat.exe Win32/Joke.ScreenMate application

wooconley

Post #28August 7, 2011, 9:35 PM UTC

Here's the OTL log from the last scan on Rick's computer.

___________________________

OTL logfile created on: 8/7/2011 4:39:54 PM - Run 2
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\Rick ASUS\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

8.99 Gb Total Physical Memory | 6.99 Gb Available Physical Memory | 77.77% Memory free
17.98 Gb Paging File | 15.89 Gb Available in Paging File | 88.38% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 372.61 Gb Total Space | 224.00 Gb Free Space | 60.12% Space Free | Partition Type: NTFS
Drive D: | 548.90 Gb Total Space | 523.28 Gb Free Space | 95.33% Space Free | Partition Type: NTFS

Computer Name: RICK-ASUS-PC | User Name: Rick ASUS | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - File not found –
PRC - [2011/08/05 19:58:06 | 000,579,584 | —- | M] (OldTimer Tools) – C:\Users\Rick ASUS\Desktop\OTL.exe
PRC - [2011/07/12 09:35:14 | 002,413,936 | —- | M] (Check Point Software Technologies LTD) – C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
PRC - [2011/07/12 09:33:34 | 000,071,824 | —- | M] (Check Point Software Technologies LTD) – C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
PRC - [2011/07/06 19:52:38 | 000,449,584 | —- | M] (Malwarebytes Corporation) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011/07/06 19:52:38 | 000,366,640 | —- | M] (Malwarebytes Corporation) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011/06/06 12:55:28 | 000,064,952 | —- | M] (Adobe Systems Incorporated) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011/02/25 11:46:22 | 000,249,648 | —- | M] (Microsoft Corporation) – C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2010/03/10 14:26:48 | 000,189,728 | —- | M] (Protexis Inc.) – C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
PRC - [2009/12/18 11:25:16 | 000,189,736 | —- | M] (Seagate Technology LLC) – C:\Program Files (x86)\Seagate\SeagateManager\Sync\FreeAgentService.exe
PRC - [2009/12/18 11:24:24 | 000,197,928 | —- | M] (Seagate LLC) – C:\Program Files (x86)\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe
PRC - [2009/08/19 15:18:40 | 001,170,432 | —- | M] (ASUSTeK Computer Inc.) – C:\Program Files\ASUS\CPU Level Up\CpuLevelUp.exe
PRC - [2009/06/10 07:33:00 | 000,232,960 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWOW64\nvSCPAPISvr.exe
PRC - [2009/01/26 15:31:10 | 001,153,368 | —- | M] (Safer Networking Ltd.) – C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008/12/17 02:35:36 | 000,621,568 | R— | M] () – C:\Program Files (x86)\ASUS\AASP\1.00.82\aaCenter.exe
PRC - [2008/12/09 13:54:22 | 001,212,416 | —- | M] (ASUS) – C:\Program Files (x86)\ASUS\AI Direct Link\AsShare.exe
PRC - [2008/12/09 07:08:38 | 000,495,616 | —- | M] (Gadwin Systems, Inc) – C:\Program Files (x86)\Gadwin Systems\PrintScreen\PrintScreen.exe
PRC - [2008/10/06 10:03:04 | 000,147,456 | —- | M] (Razer USA Ltd.) – C:\Program Files\Razer\Arctosa\razerhid.exe
PRC - [2008/09/25 11:10:12 | 000,143,360 | —- | M] () – C:\Program Files\Razer\Arctosa\razertra.exe
PRC - [2008/06/17 06:09:02 | 000,376,832 | —- | M] () – C:\Program Files (x86)\ASUS\AI Direct Link\AsCmd.exe
PRC - [2007/05/21 09:37:00 | 000,124,512 | —- | M] (CANON INC.) – C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE
PRC - [2005/07/15 17:48:33 | 000,479,232 | —- | M] (Google Inc.) – C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe

========== Modules (SafeList) ==========

MOD - [2011/08/05 19:58:06 | 000,579,584 | —- | M] (OldTimer Tools) – C:\Users\Rick ASUS\Desktop\OTL.exe
MOD - [2011/06/17 03:01:29 | 000,632,656 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9
a\msvcr80.dll
MOD - [2011/06/17 03:01:29 | 000,554,832 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9
a\msvcp80.dll
MOD - [2011/05/30 07:39:06 | 000,644,736 | —- | M] (Check Point Software Technologies) – C:\Program Files\CheckPoint\ZAForceField\WOW64\Plugins\ISWSHEX.dll
MOD - [2011/05/30 07:38:58 | 000,566,912 | —- | M] (Check Point Software Technologies) – C:\Program Files\CheckPoint\ZAForceField\WOW64\AK\icsak.dll
MOD - [2011/04/08 16:56:28 | 000,018,176 | —- | M] (McAfee, Inc.) – c:\Program Files (x86)\McAfee\SiteAdvisor\sahook.dll
MOD - [2010/08/21 01:21:32 | 001,680,896 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
MOD - [2009/12/29 02:55:34 | 000,172,032 | —- | M] (Microsoft Corporation) – C:\Windows\SysWOW64\wintrust.dll

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011/05/30 07:39:16 | 000,825,984 | —- | M] (Check Point Software Technologies) [Auto | Running] – C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe – (IswSvc)
SRV:64bit: - [2010/09/22 19:10:10 | 000,057,184 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe – (wlcrasvc)
SRV:64bit: - [2009/08/25 13:17:18 | 000,294,880 | —- | M] () [Auto | Running] – C:\Program Files\Macrium\Reflect\ReflectService.exe – (ReflectService)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV:64bit: - [2009/06/05 05:42:04 | 000,111,616 | —- | M] (Andrea Electronics Corporation) [Auto | Running] – C:\Windows\SysNative\AEADISRV.EXE – (AEADIFilters)
SRV - [2011/08/02 21:08:11 | 003,542,616 | —- | M] () [Auto | Running] – c:\Program Files (x86)\Common Files\Akamai\netsession_win_2da1ebd.dll – (Akamai)
SRV - [2011/07/12 09:35:14 | 002,413,936 | —- | M] (Check Point Software Technologies LTD) [Auto | Running] – C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe – (vsmon)
SRV - [2011/07/06 19:52:38 | 000,366,640 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe – (MBAMService)
SRV - [2011/06/06 12:55:28 | 000,064,952 | —- | M] (Adobe Systems Incorporated) [Auto | Running] – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe – (AdobeARMservice)
SRV - [2011/02/28 19:44:14 | 000,183,560 | —- | M] (Microsoft Corporation.) [On_Demand | Stopped] – C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE – (BBSvc)
SRV - [2011/02/25 11:46:22 | 000,249,648 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE – (SeaPort)
SRV - [2011/02/16 15:49:08 | 000,101,048 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe – (McAfee SiteAdvisor Service)
SRV - [2010/03/18 14:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2010/03/10 14:26:48 | 000,189,728 | —- | M] (Protexis Inc.) [Auto | Running] – C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe – (PSI_SVC_2)
SRV - [2009/12/18 11:25:16 | 000,189,736 | —- | M] (Seagate Technology LLC) [Auto | Running] – C:\Program Files (x86)\Seagate\SeagateManager\Sync\FreeAgentService.exe – (FreeAgentGoNext Service)
SRV - [2009/11/06 10:20:16 | 000,051,168 | —- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] – C:\Program Files (x86)\NOS\bin\getPlus_Helper.dll – (getPlusHelper) getPlus®
SRV - [2009/07/11 01:54:32 | 000,654,848 | —- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe – (FLEXnet Licensing Service)
SRV - [2009/06/10 17:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)
SRV - [2009/06/10 07:33:00 | 000,232,960 | —- | M] (NVIDIA Corporation) [Auto | Running] – C:\Windows\SysWOW64\nvSCPAPISvr.exe – (Stereo Service)
SRV - [2009/01/26 15:31:10 | 001,153,368 | —- | M] (Safer Networking Ltd.) [Auto | Running] – C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe – (SBSDWSCService)
SRV - [2007/03/20 16:41:24 | 000,153,792 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe – (Adobe Version Cue CS3)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2011/07/06 19:52:42 | 000,025,912 | —- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] – C:\Windows\SysNative\drivers\mbam.sys – (MBAMProtector)
DRV:64bit: - [2011/05/30 07:38:56 | 000,045,448 | —- | M] (Check Point Software Technologies) [Kernel | On_Demand | Running] – C:\Program Files\CheckPoint\ZAForceField\AK\icsak.sys – (icsak)
DRV:64bit: - [2011/05/30 07:38:56 | 000,033,672 | —- | M] (Check Point Software Technologies) [Kernel | Auto | Running] – C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys – (ISWKL)
DRV:64bit: - [2011/05/07 17:51:32 | 000,454,232 | —- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] – C:\Windows\SysNative\drivers\vsdatant.sys – (Vsdatant)
DRV:64bit: - [2011/03/11 02:22:41 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/03/11 02:22:40 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2011/02/18 17:36:58 | 000,051,712 | —- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\usbaapl64.sys – (USBAAPL64)
DRV:64bit: - [2010/10/14 17:08:38 | 000,011,864 | —- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] – C:\Windows\SysNative\drivers\kl2.sys – (kl2)
DRV:64bit: - [2010/10/14 17:08:36 | 000,460,888 | —- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\kl1.sys – (KL1)
DRV:64bit: - [2010/09/23 01:36:48 | 000,048,488 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\fssfltr.sys – (fssfltr)
DRV:64bit: - [2010/09/21 16:51:56 | 000,362,072 | —- | M] (Kaspersky Lab) [File_System | System | Running] – C:\Windows\SysNative\drivers\klif.sys – (KLIF)
DRV:64bit: - [2009/07/15 23:38:40 | 000,015,416 | —- | M] () [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\ASACPI.sys – (MTsensor)
DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/13 21:47:48 | 000,077,888 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/07/13 20:35:32 | 000,012,288 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\serscan.sys – (StillCam)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | —- | M] () [File_System | On_Demand | Running] – C:\Windows\SysNative\wbem\ntfs.mof – (Ntfs)
DRV:64bit: - [2009/06/10 16:37:05 | 006,108,416 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\igdkmd64.sys – (igfx)
DRV:64bit: - [2009/06/10 16:35:35 | 000,620,544 | —- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\netr28x.sys – (netr28x)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2009/06/05 05:42:04 | 000,475,136 | —- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\ADIHdAud.sys – (ADIHdAudAddService)
DRV:64bit: - [2009/05/27 01:39:46 | 000,104,408 | —- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\jraid.sys – (JRAID)
DRV:64bit: - [2009/05/22 10:52:30 | 000,215,040 | —- | M] (Realtek ) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Rt64win7.sys – (RTL8167)
DRV:64bit: - [2009/05/18 14:17:08 | 000,034,152 | —- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\GEARAspiWDM.sys – (GEARAspiWDM)
DRV:64bit: - [2008/10/03 13:17:30 | 000,184,320 | —- | M] (Realtek Corporation ) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\Rtlh64.sys – (RTL8169)
DRV:64bit: - [2008/09/12 10:47:58 | 000,020,480 | —- | M] (Razer USA Ltd.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Arctosa.sys – (Arctosa)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {a94e8dc9-07aa-45a7-8af2-a0375473a5cd} - C:\Program Files (x86)\ZoneAlarm_Extreme_Security\prxtbZone.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.asus.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 1F A1 75 E2 98 54 CC 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\..\URLSearchHook: {a94e8dc9-07aa-45a7-8af2-a0375473a5cd} - C:\Program Files (x86)\ZoneAlarm_Extreme_Security\prxtbZone.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [removed]:0.1.2008d
FF - prefs.js..extensions.enabledItems: [removed]:2.0.0

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Rick ASUS\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Rick ASUS\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\PROGRAM FILES\CHECKPOINT\ZAFORCEFIELD\TRUSTCHECKER [2011/07/15 22:14:21 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker [2011/07/15 22:14:10 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files (x86)\McAfee\SiteAdvisor [2011/05/24 13:50:52 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/06/24 13:29:34 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/08/07 12:14:24 | 000,000,000 | —D | M]

[2011/08/05 22:51:38 | 000,000,000 | —D | M] (No name found) – C:\Users\Rick ASUS\AppData\Roaming\Mozilla\Extensions
[2009/09/14 13:38:11 | 000,000,000 | —D | M] (No name found) – C:\Users\Rick ASUS\AppData\Roaming\Mozilla\Extensions\[removed]
[2011/08/06 20:48:59 | 000,000,000 | —D | M] (No name found) – C:\Users\Rick ASUS\AppData\Roaming\Mozilla\Firefox\Profiles\8o2qytop.default\extensions
[2010/06/09 09:27:17 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Rick ASUS\AppData\Roaming\Mozilla\Firefox\Profiles\8o2qytop.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/06/29 22:33:22 | 000,000,000 | —D | M] (WebMail Notifier) – C:\Users\Rick ASUS\AppData\Roaming\Mozilla\Firefox\Profiles\8o2qytop.default\extensions\{37fa1426-b82d-11db-8314-0800200c9a66}
[2011/07/12 14:49:11 | 000,000,000 | —D | M] (WOT) – C:\Users\Rick ASUS\AppData\Roaming\Mozilla\Firefox\Profiles\8o2qytop.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2011/07/17 01:53:28 | 000,000,000 | —D | M] (ZoneAlarm Extreme Security Community Toolbar) – C:\Users\Rick ASUS\AppData\Roaming\Mozilla\Firefox\Profiles\8o2qytop.default\extensions\{a94e8dc9-07aa-45a7-8af2-a0375473a5cd}
[2009/11/18 20:18:54 | 000,000,000 | —D | M] (Move Media Player) – C:\Users\Rick ASUS\AppData\Roaming\Mozilla\Firefox\Profiles\8o2qytop.default\extensions\[removed]
[2011/08/07 16:34:10 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/05/29 02:16:28 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/09/13 19:29:54 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/10/24 19:55:16 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/12 14:57:07 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/08/07 16:34:10 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA}
[2009/11/18 20:05:21 | 000,000,000 | —D | M] (Timezone Definitions for Mozilla Calendar) – C:\PROGRAM FILES (X86)\CELTX\EXTENSIONS\[removed]
[2009/11/18 20:05:21 | 000,000,000 | —D | M] (DOM Inspector) – C:\PROGRAM FILES (X86)\CELTX\EXTENSIONS\[removed]
[2011/06/24 13:29:33 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/08/07 16:33:27 | 000,611,224 | —- | M] (Oracle Corporation) – C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010/01/01 04:00:00 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011/07/27 16:24:44 | 000,002,497 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\SearchResults.xml

O1 HOSTS File: ([2011/08/06 19:16:38 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (ZoneAlarm Extreme Security Toolbar) - {a94e8dc9-07aa-45a7-8af2-a0375473a5cd} - C:\Program Files (x86)\ZoneAlarm_Extreme_Security\prxtbZone.dll (Conduit Ltd.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O3:64bit: - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (ZoneAlarm Extreme Security Toolbar) - {a94e8dc9-07aa-45a7-8af2-a0375473a5cd} - C:\Program Files (x86)\ZoneAlarm_Extreme_Security\prxtbZone.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [WrtMon.exe] C:\Windows\SysNative\spool\drivers\x64\3\WrtMon.exe ()
O4 - HKLM..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe (Google Inc.)
O4 - HKLM..\Run: [Adobe_ID0EYTHM] C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3Tray.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Arctosa] C:\Program Files\Razer\Arctosa\razerhid.exe (Razer USA Ltd.)
O4 - HKLM..\Run: [CarboniteSetupLite] C:\Program Files (x86)\Carbonite\CarbonitePreinstaller.exe (Carbonite, Inc.)
O4 - HKLM..\Run: [CPU Level Up] C:\Program Files\ASUS\CPU Level Up\CpuLevelUp.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [IJNetworkScanUtility] C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE (CANON INC.)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MaxMenuMgr] C:\Program Files (x86)\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe (Seagate LLC)
O4 - HKLM..\Run: [ZoneAlarm] C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [Gadwin PrintScreen] C:\Program Files (x86)\Gadwin Systems\PrintScreen\PrintScreen.exe (Gadwin Systems, Inc)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Append to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert link target to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selected links to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selection to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.0.0)
O16 - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O24 - Desktop WallPaper: C:\Users\Rick ASUS\Pictures\Conan.jpg
O24 - Desktop BackupWallPaper: C:\Users\Rick ASUS\Pictures\Conan.jpg
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/08/07 16:34:53 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2011/08/07 16:34:08 | 000,214,408 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2011/08/07 16:34:08 | 000,173,960 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2011/08/07 16:34:08 | 000,173,960 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2011/08/07 12:12:12 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Adobe AIR
[2011/08/06 22:58:07 | 000,000,000 | —D | C] – C:\Users\Rick ASUS\Desktop\Stuff Pam used to clean searchqu infection
[2011/08/06 20:50:44 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2011/08/06 19:43:53 | 000,000,000 | —D | C] – C:\Users\Rick ASUS\AppData\Roaming\Malwarebytes
[2011/08/06 19:43:46 | 000,041,272 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011/08/06 19:43:46 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/08/06 19:43:46 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/08/06 19:43:43 | 000,025,912 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2011/08/06 19:43:43 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011/08/06 19:16:44 | 000,000,000 | —D | C] – C:\$RECYCLE.BIN
[2011/08/06 13:18:59 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/08/06 13:18:59 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/08/06 13:18:59 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/08/06 13:18:49 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2011/08/06 13:18:43 | 000,000,000 | —D | C] – C:\Qoobox
[2011/08/05 22:53:37 | 000,000,000 | —D | C] – C:\_OTL
[2011/08/05 19:58:19 | 000,000,000 | —D | C] – C:\Users\Rick ASUS\AppData\Roaming\#ISW.FS#
[2011/08/05 19:58:06 | 000,579,584 | —- | C] (OldTimer Tools) – C:\Users\Rick ASUS\Desktop\OTL.exe
[2011/07/27 17:51:00 | 000,000,000 | —D | C] – C:\Users\Rick ASUS\Documents\Any Video Converter
[2011/07/27 17:50:52 | 000,000,000 | —D | C] – C:\Users\Rick ASUS\AppData\Roaming\AnvSoft
[2011/07/27 17:50:50 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AnvSoft
[2011/07/27 17:50:46 | 000,000,000 | —D | C] – C:\Program Files (x86)\AnvSoft
[2011/07/27 16:24:44 | 000,000,000 | —D | C] – C:\ProgramData\boost_interprocess
[2011/07/27 14:35:28 | 000,000,000 | —D | C] – C:\Users\Rick ASUS\AppData\Roaming\Corel
[2011/07/27 14:30:40 | 000,000,000 | —D | C] – C:\ProgramData\InterVideo
[2011/07/27 14:29:44 | 000,000,000 | —D | C] – C:\ProgramData\Corel
[2011/07/27 14:29:21 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Corel VideoStudio Pro X4
[2011/07/27 14:29:14 | 000,000,000 | —D | C] – C:\ProgramData\Ulead Systems
[2011/07/27 14:27:31 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Protexis
[2011/07/27 14:27:27 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Corel
[2011/07/27 14:26:53 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Ulead Systems
[2011/07/27 14:26:20 | 000,000,000 | —D | C] – C:\Program Files (x86)\Corel
[2011/07/27 12:22:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/07/27 12:22:23 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/07/27 12:22:23 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2011/07/27 12:22:23 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/07/27 12:20:32 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2011/07/24 21:19:48 | 000,000,000 | —D | C] – C:\ProgramData\NCH Software
[2011/07/24 21:19:47 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Video Related Programs
[2011/07/24 21:19:47 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite
[2011/07/24 21:19:40 | 000,000,000 | —D | C] – C:\Program Files (x86)\NCH Software
[2011/07/24 21:19:38 | 000,000,000 | —D | C] – C:\Users\Rick ASUS\AppData\Roaming\NCH Software
[2011/07/22 14:05:34 | 000,000,000 | —D | C] – C:\Users\Rick ASUS\Documents\Corel VideoStudio Pro
[2011/07/22 14:02:33 | 000,000,000 | —D | C] – C:\ProgramData\Protexis
[2011/07/22 14:02:30 | 000,000,000 | —D | C] – C:\Users\Rick ASUS\AppData\Roaming\Ulead Systems
[2011/07/22 14:01:40 | 000,000,000 | —D | C] – C:\ProgramData\eSellerate
[2011/07/22 14:01:04 | 000,000,000 | —D | C] – C:\Program Files (x86)\SmartSound Software
[2011/07/22 14:01:03 | 000,000,000 | —D | C] – C:\ProgramData\SmartSound Software Inc
[2011/07/22 14:00:10 | 000,000,000 | —D | C] – C:\Windows\RegisteredPackages
[2011/07/22 14:00:09 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media
[2011/07/22 13:57:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\Windows Media Components
[2011/07/22 13:57:18 | 000,411,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_10.dll
[2011/07/22 13:57:18 | 000,267,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_10.dll
[2011/07/22 13:57:17 | 002,006,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_36.dll
[2011/07/22 13:57:17 | 001,374,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_36.dll
[2011/07/22 13:57:17 | 000,508,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_36.dll
[2011/07/22 13:57:17 | 000,444,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_36.dll
[2011/07/22 13:57:16 | 005,081,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_36.dll
[2011/07/22 13:57:16 | 003,734,536 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_36.dll
[2011/07/22 13:57:15 | 001,985,904 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_35.dll
[2011/07/22 13:57:15 | 001,358,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_35.dll
[2011/07/22 13:57:15 | 000,508,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_35.dll
[2011/07/22 13:57:15 | 000,444,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_35.dll
[2011/07/22 13:57:15 | 000,411,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_9.dll
[2011/07/22 13:57:15 | 000,267,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_9.dll
[2011/07/22 13:57:14 | 005,073,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_35.dll
[2011/07/22 13:57:14 | 003,727,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_35.dll
[2011/07/22 13:57:14 | 001,401,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_34.dll
[2011/07/22 13:57:14 | 001,124,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_34.dll
[2011/07/22 13:57:14 | 000,506,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_34.dll
[2011/07/22 13:57:14 | 000,443,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_34.dll
[2011/07/22 13:57:14 | 000,409,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_8.dll
[2011/07/22 13:57:14 | 000,266,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_8.dll
[2011/07/22 13:57:14 | 000,021,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\X3DAudio1_2.dll
[2011/07/22 13:57:14 | 000,017,928 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\X3DAudio1_2.dll
[2011/07/22 13:57:13 | 004,496,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_34.dll
[2011/07/22 13:57:13 | 003,497,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_34.dll
[2011/07/22 13:57:13 | 001,400,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_33.dll
[2011/07/22 13:57:13 | 001,123,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_33.dll
[2011/07/22 13:57:13 | 000,506,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_33.dll
[2011/07/22 13:57:13 | 000,443,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_33.dll
[2011/07/22 13:57:13 | 000,403,304 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_7.dll
[2011/07/22 13:57:13 | 000,261,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_7.dll
[2011/07/22 13:57:13 | 000,107,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xinput1_3.dll
[2011/07/22 13:57:13 | 000,081,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xinput1_3.dll
[2011/07/22 13:57:12 | 004,494,184 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_33.dll
[2011/07/22 13:57:12 | 003,495,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_33.dll
[2011/07/22 13:57:11 | 000,393,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_6.dll
[2011/07/22 13:57:11 | 000,255,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_6.dll
[2011/07/22 13:57:10 | 000,469,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10.dll
[2011/07/22 13:57:10 | 000,440,080 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10.dll
[2011/07/22 13:57:10 | 000,390,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_5.dll
[2011/07/22 13:57:10 | 000,251,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_5.dll
[2011/07/22 13:57:09 | 000,364,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_4.dll
[2011/07/22 13:57:09 | 000,237,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_4.dll
[2011/07/22 13:57:09 | 000,017,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\x3daudio1_1.dll
[2011/07/22 13:57:09 | 000,015,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\x3daudio1_1.dll
[2011/07/22 13:57:08 | 003,977,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_31.dll
[2011/07/22 13:57:08 | 002,414,360 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_31.dll
[2011/07/22 13:57:08 | 000,363,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_3.dll
[2011/07/22 13:57:08 | 000,236,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_3.dll
[2011/07/22 13:57:07 | 000,354,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_2.dll
[2011/07/22 13:57:07 | 000,230,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_2.dll
[2011/07/22 13:57:07 | 000,083,736 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xinput1_2.dll
[2011/07/22 13:57:07 | 000,062,744 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xinput1_2.dll
[2011/07/22 13:57:06 | 000,352,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_1.dll
[2011/07/22 13:57:06 | 000,229,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_1.dll
[2011/07/22 13:57:06 | 000,083,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xinput1_1.dll
[2011/07/22 13:57:06 | 000,062,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xinput1_1.dll
[2011/07/22 13:57:02 | 003,927,248 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_30.dll
[2011/07/22 13:57:02 | 002,388,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_30.dll
[2011/07/22 13:57:01 | 003,830,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_29.dll
[2011/07/22 13:57:01 | 002,332,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_29.dll
[2011/07/22 13:57:01 | 000,355,536 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_0.dll
[2011/07/22 13:57:01 | 000,230,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_0.dll
[2011/07/22 13:57:01 | 000,016,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\x3daudio1_0.dll
[2011/07/22 13:57:01 | 000,014,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\x3daudio1_0.dll
[2011/07/22 13:57:00 | 003,815,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_28.dll
[2011/07/22 13:57:00 | 003,807,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_27.dll
[2011/07/22 13:57:00 | 003,767,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_26.dll
[2011/07/22 13:57:00 | 002,323,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_28.dll
[2011/07/22 13:57:00 | 002,319,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_27.dll
[2011/07/22 13:57:00 | 002,297,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_26.dll
[2011/07/22 13:56:58 | 003,823,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_25.dll
[2011/07/22 13:56:58 | 002,337,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_25.dll
[2011/07/22 13:56:57 | 003,544,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_24.dll
[2011/07/22 13:56:57 | 002,222,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_24.dll
[2011/07/22 13:41:18 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Akamai
[2011/07/15 21:56:26 | 000,000,000 | —D | C] – C:\Windows\Internet Logs
[2011/07/15 21:55:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\ConduitEngine
[2011/07/15 21:55:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\Conduit
[2011/07/15 21:55:54 | 000,000,000 | —D | C] – C:\Users\Rick ASUS\AppData\Local\Conduit
[2011/07/15 21:55:53 | 000,000,000 | —D | C] – C:\Program Files (x86)\ZoneAlarm_Extreme_Security
[2011/07/15 21:54:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Check Point
[2011/07/15 20:44:01 | 000,000,000 | —D | C] – C:\Program Files (x86)\CheckPoint
[2011/07/12 15:11:11 | 000,422,400 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\KernelBase.dll
[2011/07/12 15:11:11 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2011/07/12 15:11:11 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2011/07/12 15:11:10 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2011/07/12 15:11:10 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2011/07/12 15:11:10 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2011/07/12 15:11:10 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2011/07/12 15:11:10 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2011/07/12 15:11:10 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2011/07/12 15:11:10 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2011/07/12 15:11:10 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2011/07/12 15:11:10 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2011/07/12 15:11:10 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2011/07/12 15:11:10 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2011/07/12 15:11:10 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2011/07/12 15:11:10 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2011/07/12 15:11:10 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2011/07/12 15:11:10 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2011/07/12 15:11:10 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2011/07/12 15:11:10 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2011/07/12 15:11:10 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2011/07/12 15:10:57 | 001,162,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll
[2011/07/12 15:10:57 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64win.dll
[2011/07/12 15:10:57 | 000,338,944 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\conhost.exe
[2011/07/12 15:10:57 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64.dll
[2011/07/12 15:10:57 | 000,214,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2011/07/12 15:10:57 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2011/07/12 15:10:57 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntvdm64.dll
[2011/07/12 15:10:57 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2011/07/12 15:10:57 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64cpu.dll
[2011/07/12 15:10:57 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2011/07/12 15:10:57 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2011/07/12 15:10:56 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2011/07/12 11:34:00 | 000,212,840 | —- | C] (Apple Inc.) – C:\Windows\SysNative\dnssdX.dll
[2011/07/12 11:34:00 | 000,096,104 | —- | C] (Apple Inc.) – C:\Windows\SysNative\dns-sd.exe
[2011/07/12 11:34:00 | 000,085,864 | —- | C] (Apple Inc.) – C:\Windows\SysNative\dnssd.dll
[2011/07/12 11:34:00 | 000,061,288 | —- | C] (Apple Inc.) – C:\Windows\SysNative\jdns_sd.dll
[2011/07/12 11:20:54 | 000,178,536 | —- | C] (Apple Inc.) – C:\Windows\SysWow64\dnssdX.dll
[2011/07/12 11:20:54 | 000,083,816 | —- | C] (Apple Inc.) – C:\Windows\SysWow64\dns-sd.exe
[2011/07/12 11:20:54 | 000,073,064 | —- | C] (Apple Inc.) – C:\Windows\SysWow64\dnssd.dll
[2011/07/12 11:20:54 | 000,050,536 | —- | C] (Apple Inc.) – C:\Windows\SysWow64\jdns_sd.dll
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/08/07 16:38:04 | 000,011,104 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/08/07 16:38:04 | 000,011,104 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/08/07 16:33:27 | 000,544,656 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\deployJava1.dll
[2011/08/07 16:33:27 | 000,214,408 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2011/08/07 16:33:27 | 000,173,960 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2011/08/07 16:33:27 | 000,173,960 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2011/08/07 16:30:03 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/08/07 16:29:53 | 2945,802,239 | -HS- | M] () – C:\hiberfil.sys
[2011/08/07 15:45:00 | 000,000,924 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1341092738-1858294347-2959768899-1000UA.job
[2011/08/07 12:14:24 | 000,002,027 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011/08/07 01:45:00 | 000,000,872 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1341092738-1858294347-2959768899-1000Core.job
[2011/08/06 19:43:46 | 000,001,121 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/06 19:16:38 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2011/08/05 19:58:06 | 000,579,584 | —- | M] (OldTimer Tools) – C:\Users\Rick ASUS\Desktop\OTL.exe
[2011/08/05 13:45:54 | 000,002,433 | —- | M] () – C:\Users\Rick ASUS\Desktop\Google Chrome.lnk
[2011/07/27 17:50:50 | 000,001,248 | —- | M] () – C:\Users\Rick ASUS\Desktop\Any Video Converter.lnk
[2011/07/27 16:30:18 | 002,374,136 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2011/07/27 16:25:57 | 000,001,129 | —- | M] () – C:\Users\Rick ASUS\Desktop\Free FLV Converter.lnk
[2011/07/27 14:29:22 | 000,001,046 | —- | M] () – C:\Users\Public\Desktop\Corel VideoStudio Pro X4.lnk
[2011/07/27 12:22:38 | 000,001,791 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/07/24 21:19:40 | 000,001,146 | —- | M] () – C:\Users\Public\Desktop\VideoPad Video Editor.lnk
[2011/07/15 21:56:36 | 000,416,454 | —- | M] () – C:\Windows\SysNative\drivers\vsconfig.xml
[2011/07/15 21:55:34 | 000,000,144 | —- | M] () – C:\Windows\SysWow64\pdfl.dat
[2011/07/15 12:49:08 | 000,313,208 | —- | M] (FLV.com) – C:\Windows\SysWow64\TubeFinder.exe
[2011/07/12 18:57:27 | 000,063,540 | —- | M] () – C:\Users\Rick ASUS\Desktop\plaza.pdf
[2011/07/12 18:56:04 | 000,229,146 | —- | M] () – C:\Users\Rick ASUS\Desktop\pigskin.pdf
[2011/07/12 11:34:00 | 000,212,840 | —- | M] (Apple Inc.) – C:\Windows\SysNative\dnssdX.dll
[2011/07/12 11:34:00 | 000,096,104 | —- | M] (Apple Inc.) – C:\Windows\SysNative\dns-sd.exe
[2011/07/12 11:34:00 | 000,085,864 | —- | M] (Apple Inc.) – C:\Windows\SysNative\dnssd.dll
[2011/07/12 11:34:00 | 000,061,288 | —- | M] (Apple Inc.) – C:\Windows\SysNative\jdns_sd.dll
[2011/07/12 11:20:54 | 000,178,536 | —- | M] (Apple Inc.) – C:\Windows\SysWow64\dnssdX.dll
[2011/07/12 11:20:54 | 000,083,816 | —- | M] (Apple Inc.) – C:\Windows\SysWow64\dns-sd.exe
[2011/07/12 11:20:54 | 000,073,064 | —- | M] (Apple Inc.) – C:\Windows\SysWow64\dnssd.dll
[2011/07/12 11:20:54 | 000,050,536 | —- | M] (Apple Inc.) – C:\Windows\SysWow64\jdns_sd.dll
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/08/07 12:14:24 | 000,002,441 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2011/08/07 12:14:24 | 000,002,027 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011/08/06 19:43:46 | 000,001,121 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/06 13:18:59 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2011/08/06 13:18:59 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2011/08/06 13:18:59 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/08/06 13:18:59 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/08/06 13:18:59 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/07/27 17:50:50 | 000,001,248 | —- | C] () – C:\Users\Rick ASUS\Desktop\Any Video Converter.lnk
[2011/07/27 14:29:22 | 000,001,046 | —- | C] () – C:\Users\Public\Desktop\Corel VideoStudio Pro X4.lnk
[2011/07/27 12:22:38 | 000,001,791 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/07/24 21:19:40 | 000,001,158 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoPad Video Editor.lnk
[2011/07/24 21:19:40 | 000,001,146 | —- | C] () – C:\Users\Public\Desktop\VideoPad Video Editor.lnk
[2011/07/15 21:56:16 | 000,416,454 | —- | C] () – C:\Windows\SysNative\drivers\vsconfig.xml
[2011/07/12 18:57:27 | 000,063,540 | —- | C] () – C:\Users\Rick ASUS\Desktop\plaza.pdf
[2011/07/12 18:56:04 | 000,229,146 | —- | C] () – C:\Users\Rick ASUS\Desktop\pigskin.pdf
[2010/10/18 19:55:38 | 000,598,016 | —- | C] () – C:\Windows\SysWow64\brgrt.dll
[2010/09/19 16:42:11 | 000,005,632 | —- | C] () – C:\Users\Rick ASUS\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/23 14:53:18 | 000,001,150 | —- | C] () – C:\Users\Rick ASUS\AppData\Roaming\evmanage.prf
[2010/07/23 14:50:29 | 000,000,074 | —- | C] () – C:\Users\Rick ASUS\AppData\Roaming\evplay.prf
[2010/06/03 15:47:00 | 000,003,707 | —- | C] () – C:\Users\Rick ASUS\AppData\Roaming\evpro32.prf
[2010/02/14 14:43:59 | 000,004,624 | —- | C] () – C:\Users\Rick ASUS\AppData\Roaming\wklnhst.dat
[2009/11/18 20:50:45 | 000,011,832 | —- | C] () – C:\Windows\SysWow64\drivers\AsInsHelp64.sys
[2009/11/18 20:50:45 | 000,010,216 | —- | C] () – C:\Windows\SysWow64\drivers\AsInsHelp32.sys
[2009/11/18 20:49:31 | 000,001,769 | —- | C] () – C:\Windows\Language_trs.ini
[2009/09/17 14:30:02 | 000,000,144 | —- | C] () – C:\Windows\SysWow64\pdfl.dat
[2009/09/17 14:30:02 | 000,000,144 | —- | C] () – C:\Windows\SysWow64\lkfl.dat
[2009/09/17 14:30:02 | 000,000,080 | —- | C] () – C:\Windows\SysWow64\ibfl.dat
[2009/09/11 01:57:16 | 000,117,248 | —- | C] () – C:\Windows\SysWow64\EhStorAuthn.dll
[2009/07/14 01:38:36 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | —- | C] () – C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | —- | C] () – C:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 19:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 17:59:36 | 000,982,196 | —- | C] () – C:\Windows\SysWow64\igkrng500.bin
[2009/07/13 17:59:36 | 000,139,824 | —- | C] () – C:\Windows\SysWow64\igfcg500.bin
[2009/07/13 17:59:36 | 000,097,448 | —- | C] () – C:\Windows\SysWow64\igfcg500m.bin
[2009/07/13 17:59:35 | 000,417,344 | —- | C] () – C:\Windows\SysWow64\igcompkrng500.bin
[2009/07/13 17:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/07/11 04:39:47 | 000,011,776 | —- | C] () – C:\Windows\SysWow64\pmsbfn32.dll
[2009/07/11 04:38:55 | 000,000,424 | —- | C] () – C:\Windows\MAXLINK.INI
[2009/07/11 01:58:25 | 002,463,976 | —- | C] () – C:\Windows\SysWow64\NPSWF32.dll
[2009/06/10 17:26:10 | 000,673,088 | —- | C] () – C:\Windows\SysWow64\mlang.dat
[2009/06/10 07:31:04 | 000,089,088 | —- | C] () – C:\Windows\SysWow64\nvimage.dll
[2009/05/12 06:47:21 | 000,221,184 | —- | C] () – C:\Windows\SysWow64\drivers\ServiceHelp.dll
[2009/05/12 06:46:33 | 000,024,576 | —- | C] () – C:\Windows\SysWow64\AsIO.dll
[2009/05/12 06:46:33 | 000,013,440 | R— | C] () – C:\Windows\SysWow64\drivers\AsIO.sys
[2009/05/12 06:29:44 | 000,024,379 | —- | C] () – C:\Windows\Ascd_log.ini
[2009/05/12 06:29:33 | 000,015,338 | —- | C] () – C:\Windows\Ascd_tmp.ini
[2008/10/07 04:13:30 | 000,197,912 | —- | C] () – C:\Windows\SysWow64\physxcudart_20.dll
[2008/10/07 04:13:22 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2008/10/07 04:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSwedish.dll
[2008/10/07 04:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSpanish.dll
[2008/10/07 04:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2008/10/07 04:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelPortugese.dll
[2008/10/07 04:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelKorean.dll
[2008/10/07 04:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelJapanese.dll
[2008/10/07 04:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelGerman.dll
[2008/10/07 04:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelFrench.dll
[2007/12/28 03:22:02 | 000,010,296 | —- | C] () – C:\Windows\SysWow64\drivers\ASUSHWIO.SYS

< End of report >

CatByte

Post #29August 7, 2011, 10:34 PM UTC

That log looks good now,

so how are the computers running?

On your computer, clear the java cache (update Java as well if it needs it)

Click Start > Control Panel.
Double-click the Java icon in the control panel.
The Java Control Panel appears.
Click Settings under Temporary Internet Files.
The Temporary Files Settings dialog box appears.

There are three options on this window to clear the cache.

Delete Files
View Applications
View Applets

Click OK on Delete Temporary Files window.
Note: This deletes all the Downloaded Applications and Applets from the cache.
Click OK on Temporary Files Settings window.

Navigate to and delete the following files:

D:\Downloads\Setup_FreeFlvConverter.exe
D:\Pictures\Web or Animation graphics\Kitty cat.exe

Delete the backups that contain these files, or delete the backups completely and make a fresh set of backups

F:\Seagate Backup\PAMLAPTOP\C\Users\Owner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\68b74c9f-4c1d9509
F:\Seagate Backup\PAMLAPTOP\D\Downloads\Setup_FreeFlvConverter.exe
F:\Seagate Backup\PAMLAPTOP\D\Pictures\Web or Animation graphics\Kitty cat.exe
F:\Seagate Backup\PAMLAPTOP\History\Level2\C\Users\Owner\AppData\Local\Mozilla\Firefox\Profiles\k8yw8rfh.default\Cache\D1283E09d01

These need to be deleted as well:
F:\Seagate Sync\VOL\VOL00\Downloads\Setup_FreeFlvConverter.exe
F:\Seagate Sync\VOL\VOL00\Pictures\Web or Animation graphics\Kitty cat.exe

Now run TFC (Temp File Cleaner on both computers)

Download TFC to your desktop
Mirror

Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean

It's normal after running TFC cleaner that the PC will be slower to boot the first time.

Clean up all the tools we have used > keep MalwareBytes and Temp File Cleaner as they are good to have.

Once the tools are cleaned up, then make a new set of backups

You can delete the aswMBR log and program from your desktop.

NEXT

Follow these steps to uninstall Combofix

Make sure your security programs are totally disabled.
Click START then RUN
Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

NEXT

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

If there are any logs/tools remaining on your desktop > right click and delete them.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe. KeePass is a small utility that allows you to manage all your passwords.
Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an addon available for both Firefox and IE
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at this well written article:
PC Safety and Security–What Do I Need?.

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

wooconley

Post #30August 8, 2011, 6:18 AM UTC

I think everything is ok now - no problems that I can detect. Not to say that nothing will crop up. Again, Thank you very much. Never knew that groups like this existed but boy I'm glad they do and glad I found you. I will be recommending whatthetech.com to anyone I know with malware problems.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Infected with searchqu

✨ Ask AI

Ask AI