What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

I believe I have been Hijacked....

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi there. First time here, and I need some help if possible. Having problems with Google getting rerouted to JNKSearch.net without any direction from me. This is causing a problem with not only my favorite search engine, but my e-mail as well. I've ran Malwarebytes multiple time, but to no avail. I looked over the forums here, and have downloaded Hijack This, and have done a scan. Here is the log.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:36:27 AM, on 9/1/2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\IObit\Game Booster\gbtray.exe
D:\Steam\Steam.exe
C:\Program Files (x86)\Winamp\winampa.exe
C:\Program Files (x86)\Razer\Tarantula\razerhid.exe
C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe
C:\Program Files (x86)\Razer\DeathAdder\razertra.exe
C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe
C:\Program Files (x86)\Razer\Tarantula\razertra.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Winamp\winamp.exe
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe
C:\Windows\SysWOW64\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?pc=Z045&form=ZGAPHP
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: 95.64.61.141 www.google.com
O1 - Hosts: 95.64.61.142 www.bing.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file)
O2 - BHO: (no name) - {175EC2F2-4131-826D-6872-913243685C03} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {26904C4C-E3AF-B5CB-8134-CB242C8CF356} - (no file)
O2 - BHO: (no name) - {30D1F4A2-46E3-83D2-2706-399B3034112D} - (no file)
O2 - BHO: (no name) - {34A121C9-0C8A-5FE8-4A47-02EC4D81D245} - (no file)
O2 - BHO: (no name) - {47DD71B8-7BAD-EA3C-C090-5CB51F6F061B} - (no file)
O2 - BHO: (no name) - {4C6E7CF7-8806-6DE0-7AE8-CAD60E4C3195} - (no file)
O2 - BHO: (no name) - {4C91095E-0753-8740-0CE3-D97751138BDB} - (no file)
O2 - BHO: (no name) - {5B7188B1-14DA-A1F3-E78E-E3FD9397E9C7} - (no file)
O2 - BHO: (no name) - {6AD434AA-34BD-186D-898B-703209DE41A3} - (no file)
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {95A61A30-3FC2-2CE8-3D7B-E1FAC265F780} - (no file)
O2 - BHO: (no name) - {9A635AC4-20F2-E663-6AE5-CDB80238C82D} - (no file)
O2 - BHO: (no name) - {A970FEA0-BDC7-C6D7-B179-78A60DB223E4} - (no file)
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: (no name) - {BC1F92EE-F806-4425-DF55-8CCE445F0AC9} - (no file)
O2 - BHO: Somoto Toolbar - {c3721e85-f0ac-4b7e-ae4c-3e738011dc9d} - C:\Program Files (x86)\somototoolbar\vmntemplateX.dll
O2 - BHO: (no name) - {C4B1D2A3-12A8-4A44-9413-2A19E040B490} - (no file)
O2 - BHO: (no name) - {C740BD6C-5EB2-6A3D-36C8-5D2EBDFAB5A5} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {E35FBC87-F87C-9C9A-4FBD-CFB717595F1C} - (no file)
O2 - BHO: (no name) - {E3FC4B40-7CEE-7FF8-A7EB-15220F310213} - (no file)
O2 - BHO: (no name) - {F3E3345E-9F57-A4DA-C9FF-DE6F1B29390D} - (no file)
O3 - Toolbar: Somoto Toolbar - {c3721e85-f0ac-4b7e-ae4c-3e738011dc9d} - C:\Program Files (x86)\somototoolbar\vmntemplateX.dll
O4 - HKLM\..\Run: [CtaMon] Rundll32 CtaMon.dll,RunMonitor
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Tarantula] C:\Program Files (x86)\Razer\Tarantula\razerhid.exe
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files (x86)\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Steam] "D:\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [Google Update] "C:\Users\Jeremy\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files (x86)\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-2675488554-1281081424-3468828521-1009\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-2675488554-1281081424-3468828521-1009\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O4 - Startup: Zotac FireStorm.lnk = C:\Program Files (x86)\ZOTAC FireStorm\Firestorm.exe
O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files (x86)\Shareaza\RazaWebHook32.dll/3000
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O15 - Trusted Zone: *.clonewarsadventures.com
O15 - Trusted Zone: *.freerealms.com
O15 - Trusted Zone: *.soe.com
O15 - Trusted Zone: *.sony.com
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\Skype4COM.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 12101 bytes

If anyone could lend me a hand with this problem I would be extremely grateful. Thanks in advance.
Post #2
Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post










  • Download aswMBR.exe ( 511KB ) to your desktop.
  • Double click the aswMBR.exe to run it
  • Click the Scan button to start scan
  • On completion of the scan click Save Log, save it to your Desktop and post in your next reply








  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under Custom Scan paste this in

    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • You may need two posts to fit them both in.
Post #3
Here is the aswMBR scan: aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-09-01 16:29:19 —————————– 16:29:19.345 OS Version: Windows x64 6.1.7601 Service Pack 1 16:29:19.345 Number of processors: 4 586 0x502 16:29:19.355 ComputerName: MIDNA UserName: 16:29:19.995 Initialize success 16:29:30.515 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-6 16:29:30.525 Disk 0 Vendor: Hitachi_HDT725025VLA380 V5DOA52A Size: 238475MB BusType: 3 16:29:30.525 Device \Driver\atapi -> MajorFunction fffffa8004d495c0 16:29:32.535 Disk 0 MBR read successfully 16:29:32.535 Disk 0 MBR scan 16:29:32.535 Disk 0 Windows 7 default MBR code found via API 16:29:32.535 Disk 0 unknown MBR code 16:29:32.535 Disk 0 MBR hidden 16:29:32.535 Disk 0 MBR [possible unknown bootkit@MBR] **ROOTKIT** 16:29:32.545 Disk 0 trace - called modules: 16:29:32.545 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa8004d495c0]<< 16:29:32.545 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004ac9060] 16:29:32.545 3 CLASSPNP.SYS[fffff8800196243f] -> nt!IofCallDriver -> [0xfffffa80049309b0] 16:29:32.555 5 ACPI.sys[fffff88000e0b7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T1L0-6[0xfffffa8004a67060] 16:29:32.565 \Driver\atapi[0xfffffa8004d19cf0] -> IRP_MJ_CREATE -> 0xfffffa8004d495c0 16:29:32.575 Scan finished successfully 16:29:49.645 Disk 0 MBR has been saved successfully to "C:\Users\Jeremy\Desktop\MBR.dat" 16:29:49.645 The log file has been saved successfully to "C:\Users\Jeremy\Desktop\aswMBR.txt"
Post #4
Here is the OTL Scan:

OTL logfile created on: 9/1/2011 4:35:12 PM - Run 1
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Users\Jeremy\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.96 Gb Available Physical Memory | 73.92% Memory free
8.00 Gb Paging File | 6.43 Gb Available in Paging File | 80.46% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 113.20 Gb Total Space | 28.04 Gb Free Space | 24.77% Space Free | Partition Type: NTFS
Drive D: | 112.85 Gb Total Space | 3.76 Gb Free Space | 3.33% Space Free | Partition Type: NTFS
Drive E: | 2.68 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive F: | 465.64 Gb Total Space | 127.06 Gb Free Space | 27.29% Space Free | Partition Type: FAT32

Computer Name: MIDNA | User Name: Jeremy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Jeremy\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\PnkBstrB.exe ()
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - D:\Steam\Steam.exe (Valve Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\IObit\Game Booster\gbtray.exe (IObit)
PRC - C:\Program Files (x86)\Winamp\winamp.exe (Nullsoft, Inc.)
PRC - C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
PRC - C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe ()
PRC - C:\Program Files (x86)\Razer\DeathAdder\razertra.exe ()
PRC - C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe (Razer Inc.)
PRC - C:\Program Files (x86)\Razer\Tarantula\razerhid.exe (Razer USA Ltd.)
PRC - C:\Program Files (x86)\Razer\Tarantula\razertra.exe ()


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - D:\Steam\bin\libcef.dll ()
MOD - D:\Steam\bin\avcodec-52.dll ()
MOD - D:\Steam\bin\chromehtml.dll ()
MOD - D:\Steam\bin\avformat-52.dll ()
MOD - D:\Steam\bin\avutil-50.dll ()
MOD - C:\Program Files (x86)\IObit\Game Booster\sqlite3.dll ()
MOD - C:\Program Files (x86)\IObit\Game Booster\madExcept_.bpl ()
MOD - C:\Program Files (x86)\Winamp\System\jnetlib.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\auth.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\jpeg.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\xml.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\png.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\playlist.w5s ()
MOD - C:\Program Files (x86)\Winamp\tataki.dll ()
MOD - C:\Program Files (x86)\Winamp\zlib.dll ()
MOD - C:\Program Files (x86)\Winamp\System\timer.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\tagz.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\gif.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\bmp.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\dlmgr.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\gracenote.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\filereader.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\primo.w5s ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_local.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_pmp.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_disc.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_ipod.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_online.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_p4s.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_playlists.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_plg.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_impex.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_history.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_android.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\out_ds.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_usb.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_rg.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_transcode.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_activesync.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\out_disk.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_njb.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\out_wave.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_wm.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mp3.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_vorbis.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mod.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_midi.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_cdda.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_nsv.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_dshow.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_avi.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_flac.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mp4.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mkv.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_flv.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_autotag.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_bookmarks.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_swf.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_wave.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_linein.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_ff.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\freeform\wacs\freetype\freetype.wac ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_ml.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_jumpex.dll ()
MOD - C:\Program Files (x86)\Winamp\nde.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_orgler.dll ()
MOD - C:\Program Files (x86)\Winamp\nsutil.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_hotkeys.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_tray.dll ()
MOD - C:\Program Files (x86)\Winamp\libsndfile.dll ()
MOD - C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe ()
MOD - C:\Program Files (x86)\Razer\DeathAdder\razertra.exe ()
MOD - C:\Program Files (x86)\IObit\Game Booster\madbasic_.bpl ()
MOD - C:\Program Files (x86)\IObit\Game Booster\maddisAsm_.bpl ()
MOD - C:\Program Files (x86)\Razer\Tarantula\razertra.exe ()


========== Win32 Services (SafeList) ==========

SRV - (PnkBstrB) – C:\Windows\SysWOW64\PnkBstrB.exe ()
SRV - (PnkBstrA) – C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (nvUpdatusService) – C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (Creative Audio Engine Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (Creative ALchemy AL6 Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (IntuitUpdateService) – C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (CTAudSvcService) – C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (WcesComm) – C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (NVHDA) – C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (cpuz135) – C:\Windows\SysNative\drivers\cpuz135_x64.sys (CPUID)
DRV:64bit: - (sptd) – C:\Windows\SysNative\drivers\sptd.sys ()
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (DAdderFltr) – C:\Windows\SysNative\drivers\dadder.sys (Razer (Asia-Pacific) Pte Ltd)
DRV:64bit: - (vhidmini) – C:\Windows\SysNative\drivers\vHidDev.sys (Windows ® Win 7 DDK provider)
DRV:64bit: - (USBPNPA) – C:\Windows\SysNative\drivers\CM10864.sys (C-Media Electronics Inc)
DRV:64bit: - (xusb21) – C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (CYUSB) – C:\Windows\SysNative\drivers\CYUSB.sys (Cypress Semiconductor)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (usb_rndisx) – C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (xnacc) – C:\Windows\SysNative\drivers\xnacc.sys (Microsoft Corporation)
DRV:64bit: - (L1E) NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20) – C:\Windows\SysNative\drivers\L1E62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (netr28x) – C:\Windows\SysNative\drivers\netr28x.sys (Ralink Technology, Corp.)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (VIAHdAudAddService) – C:\Windows\SysNative\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV:64bit: - (AtiPcie) AMD PCI Express (3GIO) – C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (Ctafiltv) – C:\Windows\SysNative\drivers\Ctafiltv.sys (Creative Technology Ltd.)
DRV:64bit: - (TarFltr) – C:\Windows\SysNative\drivers\UsbFltr.sys (Razer USA Ltd.)
DRV:64bit: - (uisp) – C:\Windows\SysNative\drivers\usbicp.sys (Motorola)
DRV:64bit: - (MTsensor) – C:\Windows\SysNative\drivers\ASACPI.sys ()
DRV - (RivaTuner64) – C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys ()
DRV - (speedfan) – C:\Windows\SysWOW64\speedfan.sys (Almico Software)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (uisp) – C:\Windows\SysWOW64\drivers\Usbicp.sys (Motorola)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?pc=Z045&form;=ZGAPHP
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 06 9B BB B0 BC ED CB 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 25 12 46 01 CA 5A 36 4E BE 8C D8 D9 FB 96 BC 61 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "gmail.com"
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:4.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: [removed]:1.0.53.2
FF - prefs.js..keyword.URL: "http://www.bing.com/search?pc=Z045&form;=ZGAADF&q;="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 63030
FF - prefs.js..network.proxy.type: 4


FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@fileplanet.com/fpdlm: C:\Program Files (x86)\Download Manager\npfpdlm.dll (IGN Entertainment)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Jeremy\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Jeremy\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Jeremy\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Jeremy\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/08/31 19:51:16 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/07/17 22:46:43 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\SoMud\scripts\mozilla
FF - HKEY_CURRENT_USER\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files (x86)\SoMud\scripts\mozilla

[2010/08/18 00:05:47 | 000,000,000 | —D | M] (No name found) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Extensions
[2010/08/18 00:05:47 | 000,000,000 | —D | M] (No name found) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Extensions\[removed]
[2011/08/18 21:15:20 | 000,000,000 | —D | M] (No name found) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\extensions
[2011/08/02 00:07:26 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/06/19 01:29:33 | 000,000,000 | —D | M] (XUL Cache) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\extensions\{c33c522d-462a-4e2b-a154-c421e4e002c0}
[2011/06/24 03:48:14 | 000,000,000 | —D | M] (Somoto Toolbar) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\extensions\{c3721e85-f0ac-4b7e-ae4c-3e738011dc9d}
[2011/08/18 21:15:20 | 000,000,000 | —D | M] (Battlefield Play4Free) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\extensions\[removed]
[2011/06/24 03:48:09 | 000,001,919 | —- | M] () – C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\searchplugins\bing-zugo.xml
[2011/05/06 19:41:16 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/03/30 22:54:48 | 000,000,000 | —D | M] (Skype extension) – C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/06/23 08:29:57 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/11/24 01:13:53 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/30 02:49:08 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/05/06 19:41:16 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\distribution\extensions
[2011/05/06 19:41:16 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/08/31 19:51:16 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010/11/12 19:53:06 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010/07/12 12:33:56 | 000,012,800 | —- | M] (Nullsoft, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2011/07/02 01:16:28 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2010/01/01 04:00:00 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml.old
[2011/06/24 03:48:17 | 000,002,280 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\search.xml

O1 HOSTS File: ([2011/08/31 15:41:24 | 000,000,882 | RH– | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 95.64.61.141 www.google.com
O1 - Hosts: 95.64.61.142 www.bing.com
O2:64bit: - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - No CLSID value found.
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - No CLSID value found.
O2 - BHO: (no name) - {175EC2F2-4131-826D-6872-913243685C03} - No CLSID value found.
O2 - BHO: (no name) - {26904C4C-E3AF-B5CB-8134-CB242C8CF356} - No CLSID value found.
O2 - BHO: (no name) - {30D1F4A2-46E3-83D2-2706-399B3034112D} - No CLSID value found.
O2 - BHO: (no name) - {34A121C9-0C8A-5FE8-4A47-02EC4D81D245} - No CLSID value found.
O2 - BHO: (no name) - {47DD71B8-7BAD-EA3C-C090-5CB51F6F061B} - No CLSID value found.
O2 - BHO: (no name) - {4C6E7CF7-8806-6DE0-7AE8-CAD60E4C3195} - No CLSID value found.
O2 - BHO: (no name) - {4C91095E-0753-8740-0CE3-D97751138BDB} - No CLSID value found.
O2 - BHO: (no name) - {5B7188B1-14DA-A1F3-E78E-E3FD9397E9C7} - No CLSID value found.
O2 - BHO: (no name) - {6AD434AA-34BD-186D-898B-703209DE41A3} - No CLSID value found.
O2 - BHO: (no name) - {95A61A30-3FC2-2CE8-3D7B-E1FAC265F780} - No CLSID value found.
O2 - BHO: (no name) - {9A635AC4-20F2-E663-6AE5-CDB80238C82D} - No CLSID value found.
O2 - BHO: (no name) - {A970FEA0-BDC7-C6D7-B179-78A60DB223E4} - No CLSID value found.
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (no name) - {BC1F92EE-F806-4425-DF55-8CCE445F0AC9} - No CLSID value found.
O2 - BHO: (Somoto Toolbar) - {c3721e85-f0ac-4b7e-ae4c-3e738011dc9d} - C:\Program Files (x86)\somototoolbar\vmntemplateX.dll ()
O2 - BHO: (no name) - {C4B1D2A3-12A8-4A44-9413-2A19E040B490} - No CLSID value found.
O2 - BHO: (no name) - {C740BD6C-5EB2-6A3D-36C8-5D2EBDFAB5A5} - No CLSID value found.
O2 - BHO: (no name) - {E35FBC87-F87C-9C9A-4FBD-CFB717595F1C} - No CLSID value found.
O2 - BHO: (no name) - {E3FC4B40-7CEE-7FF8-A7EB-15220F310213} - No CLSID value found.
O2 - BHO: (no name) - {F3E3345E-9F57-A4DA-C9FF-DE6F1B29390D} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Somoto Toolbar) - {c3721e85-f0ac-4b7e-ae4c-3e738011dc9d} - C:\Program Files (x86)\somototoolbar\vmntemplateX.dll ()
O4:64bit: - HKLM..\Run: [Cm108Sound] C:\Windows\Syswow64\cm108.dll (C-Media Corporation)
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [CtaMon] C:\Windows\SysWow64\CtaMon.dll (Creative Technology Ltd.)
O4 - HKLM..\Run: [DeathAdder] C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe ()
O4 - HKLM..\Run: [googletalk] C:\Program Files (x86)\Google\Google Talk\googletalk.exe (Google)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Tarantula] C:\Program Files (x86)\Razer\Tarantula\razerhid.exe (Razer USA Ltd.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKCU..\Run: [igndlm.exe] C:\Program Files (x86)\Download Manager\DLM.exe (IGN Entertainment)
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [Steam] D:\Steam\steam.exe (Valve Corporation)
O4 - Startup: C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zotac FireStorm.lnk = C:\Program Files (x86)\ZOTAC FireStorm\Firestorm.exe (ZOTAC Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {140E4DF8-9E14-4A34-9577-C77561ED7883} http://content.systemrequirementslab.com.s…ri_4.1.72.0.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.0.0)
O16 - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{67087C97-1605-497A-9AC3-F0168C5B764E}: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2009/10/26 12:45:39 | 000,779,496 | R— | M] (BioWare) - E:\autorun.exe – [ UDF ]
O32 - AutoRun File - [2009/10/26 17:21:41 | 000,000,054 | R— | M] () - E:\autorun.inf – [ UDF ]
O33 - MountPoints2\{7d40b73e-7f29-11df-b218-90e6ba88c177}\Shell - "" = AutoRun
O33 - MountPoints2\{7d40b73e-7f29-11df-b218-90e6ba88c177}\Shell\AutoRun\command - "" = G:\setup.exe
O33 - MountPoints2\{9c42d9a7-7e9d-11df-b12e-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{9c42d9a7-7e9d-11df-b12e-806e6f6e6963}\Shell\AutoRun\command - "" = E:\autorun.exe – [2009/10/26 12:45:39 | 000,779,496 | R— | M] (BioWare)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – "%1" %*


Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: VIDC.FPS1 - frapsv64.dll (Beepa P/L)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\SysWow64\frapsvid.dll (Beepa P/L)
Drivers32: VIDC.RTV1 - rtvcvfw32.dll File not found
Drivers32: vidc.VP60 - C:\Windows\SysWOW64\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\SysWOW64\vp6vfw.dll (On2.com)
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/09/01 16:30:17 | 000,581,120 | —- | C] (OldTimer Tools) – C:\Users\Jeremy\Desktop\OTL.exe
[2011/09/01 16:29:08 | 001,916,416 | —- | C] (AVAST Software) – C:\Users\Jeremy\Desktop\aswMBR.exe
[2011/09/01 01:29:29 | 000,000,000 | —D | C] – C:\Program Files (x86)\Trend Micro
[2011/09/01 01:29:29 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011/09/01 00:17:46 | 000,041,272 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011/09/01 00:17:46 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/08/31 21:36:41 | 000,000,000 | -HSD | C] – C:\Windows\SysWow64\%APPDATA%
[2011/08/31 21:35:45 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\Windows\svchost.exe
[2011/08/29 23:04:30 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Sony Creative Software Inc
[2011/08/29 22:48:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\SoulseekNS
[2011/08/29 22:48:13 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Soulseek NS
[2011/08/29 19:22:54 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\dvdcss
[2011/08/29 00:09:50 | 000,000,000 | —D | C] – C:\Users\Jeremy\Desktop\N7
[2011/08/25 13:26:49 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Local\THQ
[2011/08/24 17:45:54 | 000,000,000 | —D | C] – C:\Users\Jeremy\Documents\FOMM
[2011/08/24 02:15:26 | 000,000,000 | —D | C] – C:\Users\Jeremy\Desktop\G.E.C.K
[2011/08/23 23:23:01 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Local\FOMM
[2011/08/23 23:22:57 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fallout Mod Manager
[2011/08/23 23:22:56 | 000,000,000 | —D | C] – C:\Program Files (x86)\GeMM
[2011/08/21 20:49:01 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Origin
[2011/08/21 20:48:30 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Local\Origin
[2011/08/21 20:48:26 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
[2011/08/21 20:48:20 | 000,000,000 | —D | C] – C:\ProgramData\Origin
[2011/08/21 20:48:19 | 000,000,000 | —D | C] – C:\Program Files (x86)\Origin Games
[2011/08/21 20:48:19 | 000,000,000 | —D | C] – C:\ProgramData\Electronic Arts
[2011/08/21 20:48:14 | 000,000,000 | —D | C] – C:\Program Files (x86)\Origin
[2011/08/20 01:32:57 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Publish Providers
[2011/08/20 01:28:10 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
[2011/08/20 01:27:42 | 000,000,000 | —D | C] – C:\ProgramData\Sony
[2011/08/20 01:00:48 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Local\Sony
[2011/08/20 00:52:06 | 000,000,000 | —D | C] – C:\Program Files\Sony
[2011/08/20 00:52:06 | 000,000,000 | —D | C] – C:\Program Files (x86)\Sony
[2011/08/20 00:51:17 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Sony
[2011/08/19 20:24:07 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fraps
[2011/08/18 21:50:52 | 000,000,000 | —D | C] – C:\Users\Jeremy\Documents\Battlefield Play4Free
[2011/08/18 21:15:34 | 000,000,000 | —D | C] – C:\Program Files (x86)\EA Games
[2011/08/18 19:27:17 | 000,021,992 | —- | C] (CPUID) – C:\Windows\SysNative\drivers\cpuz135_x64.sys
[2011/08/18 19:27:17 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID
[2011/08/18 19:27:17 | 000,000,000 | —D | C] – C:\Program Files\CPUID
[2011/08/18 18:35:28 | 024,692,840 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcompiler.dll
[2011/08/18 18:35:28 | 022,470,248 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvoglv64.dll
[2011/08/18 18:35:28 | 017,193,576 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcompiler.dll
[2011/08/18 18:35:28 | 016,595,560 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvoglv32.dll
[2011/08/18 18:35:28 | 015,064,168 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvd3dumx.dll
[2011/08/18 18:35:28 | 012,636,776 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvd3dum.dll
[2011/08/18 18:35:28 | 008,355,944 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvwgf2umx.dll
[2011/08/18 18:35:28 | 007,254,632 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuda.dll
[2011/08/18 18:35:28 | 006,613,096 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvwgf2um.dll
[2011/08/18 18:35:28 | 005,404,776 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuda.dll
[2011/08/18 18:35:28 | 002,532,456 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvid.dll
[2011/08/18 18:35:28 | 002,391,656 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvid.dll
[2011/08/18 18:35:28 | 002,222,184 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvenc.dll
[2011/08/18 18:35:28 | 002,090,088 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvenc.dll
[2011/08/18 18:35:28 | 000,067,176 | —- | C] (Khronos Group) – C:\Windows\SysNative\OpenCL.dll
[2011/08/18 18:35:28 | 000,057,960 | —- | C] (Khronos Group) – C:\Windows\SysWow64\OpenCL.dll
[2011/08/18 18:00:12 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2011/08/18 18:00:12 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2011/08/14 07:43:47 | 000,000,000 | —D | C] – C:\Users\Jeremy\Desktop\New folder
[2011/08/09 23:42:38 | 000,199,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xmllite.dll
[2011/08/09 23:42:38 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\odbccu32.dll
[2011/08/09 23:42:38 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\odbccr32.dll
[2011/08/09 23:42:37 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\odbccu32.dll
[2011/08/09 23:42:37 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\odbccr32.dll
[2011/08/09 23:42:34 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2011/08/09 23:42:34 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2011/08/09 23:42:34 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2011/08/09 23:42:33 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2011/08/09 23:42:33 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2011/08/09 23:42:33 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2011/08/09 23:42:33 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2011/08/09 23:42:33 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2011/08/09 23:42:32 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2011/08/09 23:42:32 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2011/08/09 23:42:32 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2011/08/09 23:42:32 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2011/08/09 23:42:32 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2011/08/09 23:42:32 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2011/08/09 23:42:32 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2011/08/09 23:42:31 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2011/08/09 23:42:31 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2011/08/09 23:42:31 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2011/08/09 23:42:31 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2011/08/09 23:42:31 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2011/08/09 23:42:31 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2011/08/09 23:42:31 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2011/08/09 23:42:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2011/08/09 23:42:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2011/08/09 23:42:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2011/08/09 23:42:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2011/08/09 23:42:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2011/08/09 23:42:30 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2011/08/09 23:42:12 | 000,134,144 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2011/08/09 23:42:12 | 000,132,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2011/08/07 17:59:00 | 000,000,000 | —D | C] – C:\Users\Jeremy\Documents\Eidos
[2011/08/07 17:26:46 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Local\GRAW2
[2011/08/07 17:26:46 | 000,000,000 | —D | C] – C:\ProgramData\GRAW2
[2011/08/03 18:37:11 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MSI Afterburner
[2011/08/03 18:36:54 | 000,000,000 | —D | C] – C:\Program Files (x86)\MSI Afterburner
[2011/08/03 18:36:31 | 001,519,720 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvdispco64.dll
[2011/08/03 18:36:31 | 001,453,160 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvgenco64.dll
[2011/08/03 18:36:31 | 000,174,184 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\drivers\nvhda64v.sys
[2011/08/03 18:36:31 | 000,029,288 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvhdap64.dll
[2011/08/03 18:30:10 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition
[2011/08/03 18:30:09 | 000,000,000 | —D | C] – C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition
[2011/08/03 18:24:08 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZOTAC FireStorm
[2011/08/03 18:24:07 | 000,000,000 | —D | C] – C:\Program Files (x86)\ZOTAC FireStorm
[2011/08/03 17:46:48 | 002,412,136 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvapi.dll
[2011/08/03 17:46:48 | 000,011,240 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\drivers\nvBridge.kmd
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Jeremy\Desktop\*.tmp files -> C:\Users\Jeremy\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/09/01 16:30:34 | 000,000,860 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2675488554-1281081424-3468828521-1000Core.job
[2011/09/01 16:30:18 | 000,581,120 | —- | M] (OldTimer Tools) – C:\Users\Jeremy\Desktop\OTL.exe
[2011/09/01 16:29:49 | 000,000,512 | —- | M] () – C:\Users\Jeremy\Desktop\MBR.dat
[2011/09/01 16:29:11 | 001,916,416 | —- | M] (AVAST Software) – C:\Users\Jeremy\Desktop\aswMBR.exe
[2011/09/01 16:24:26 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2675488554-1281081424-3468828521-1000UA.job
[2011/09/01 16:24:15 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/09/01 01:29:29 | 000,003,013 | —- | M] () – C:\Users\Jeremy\Desktop\HiJackThis.lnk
[2011/09/01 01:25:25 | 000,000,315 | —- | M] () – C:\Users\Jeremy\clear.reg
[2011/09/01 01:23:35 | 000,013,440 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/09/01 01:23:35 | 000,013,440 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/09/01 01:14:39 | 3220,578,304 | -HS- | M] () – C:\hiberfil.sys
[2011/09/01 00:21:13 | 000,001,159 | —- | M] () – C:\Users\Jeremy\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/09/01 00:21:13 | 000,001,135 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/09/01 00:03:22 | 000,215,128 | —- | M] () – C:\Windows\SysWow64\PnkBstrB.xtr
[2011/09/01 00:03:22 | 000,215,128 | —- | M] () – C:\Windows\SysWow64\PnkBstrB.exe
[2011/08/31 23:59:09 | 000,092,398 | —- | M] () – C:\Users\Jeremy\Documents\cc_20110831_235904.reg
[2011/08/31 23:57:45 | 000,000,828 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2011/08/31 19:51:23 | 000,002,060 | —- | M] () – C:\Users\Jeremy\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/08/31 04:05:44 | 000,215,128 | —- | M] () – C:\Windows\SysWow64\PnkBstrB.ex0
[2011/08/29 20:13:06 | 000,015,440 | —- | M] () – C:\Users\Jeremy\Documents\FONV.veg
[2011/08/25 14:04:43 | 000,000,987 | —- | M] () – C:\Users\Public\Desktop\Origin.lnk
[2011/08/24 03:01:36 | 000,806,428 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2011/08/24 03:01:36 | 000,669,048 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2011/08/24 03:01:36 | 000,125,234 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2011/08/24 02:28:53 | 090,762,938 | —- | M] () – C:\Users\Jeremy\Desktop\NVWillow.rar
[2011/08/23 23:22:57 | 000,000,959 | —- | M] () – C:\Users\Jeremy\Desktop\Fallout Mod Manager.lnk
[2011/08/20 03:35:16 | 000,037,280 | —- | M] () – C:\Users\Jeremy\Documents\CHOPPER.veg
[2011/08/20 03:14:41 | 000,037,280 | —- | M] () – C:\Users\Jeremy\Documents\CHOPPER.veg.bak
[2011/08/20 01:28:13 | 000,001,046 | —- | M] () – C:\Users\Public\Desktop\Vegas Pro 10.0 (64-bit).lnk
[2011/08/19 20:24:07 | 000,000,566 | —- | M] () – C:\Users\Jeremy\Desktop\Fraps.lnk
[2011/08/18 22:05:53 | 000,075,136 | —- | M] () – C:\Windows\SysWow64\PnkBstrA.exe
[2011/08/18 19:27:17 | 000,000,934 | —- | M] () – C:\Users\Public\Desktop\CPUID HWMonitor.lnk
[2011/08/18 18:00:11 | 000,000,045 | —- | M] () – C:\Windows\SysWow64\initdebug.nfo
[2011/08/15 16:08:05 | 000,960,457 | —- | M] () – C:\Users\Jeremy\Desktop\mcpatcher-2.1.0_02.exe
[2011/08/14 06:40:22 | 002,337,865 | —- | M] () – C:\Windows\SysWow64\pbsvc.exe
[2011/08/14 05:35:12 | 000,000,881 | —- | M] () – C:\Users\Public\Desktop\Ventrilo.lnk
[2011/08/10 03:03:50 | 000,786,274 | —- | M] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/08/03 18:37:11 | 000,001,106 | —- | M] () – C:\Users\Jeremy\Desktop\MSI Afterburner.lnk
[2011/08/03 18:24:23 | 000,001,117 | —- | M] () – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zotac FireStorm.lnk
[2011/08/03 18:16:02 | 000,804,067 | —- | M] () – C:\Users\Jeremy\Desktop\NVWillow.esp
[2011/08/03 07:50:00 | 024,692,840 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcompiler.dll
[2011/08/03 07:50:00 | 022,470,248 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvoglv64.dll
[2011/08/03 07:50:00 | 017,193,576 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcompiler.dll
[2011/08/03 07:50:00 | 016,595,560 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvoglv32.dll
[2011/08/03 07:50:00 | 015,064,168 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvd3dumx.dll
[2011/08/03 07:50:00 | 012,636,776 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvd3dum.dll
[2011/08/03 07:50:00 | 008,355,944 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvwgf2umx.dll
[2011/08/03 07:50:00 | 007,254,632 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuda.dll
[2011/08/03 07:50:00 | 006,613,096 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvwgf2um.dll
[2011/08/03 07:50:00 | 006,136,936 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcpl.dll
[2011/08/03 07:50:00 | 005,404,776 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuda.dll
[2011/08/03 07:50:00 | 003,021,416 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvsvc64.dll
[2011/08/03 07:50:00 | 002,758,760 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvapi64.dll
[2011/08/03 07:50:00 | 002,532,456 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvid.dll
[2011/08/03 07:50:00 | 002,412,136 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvapi.dll
[2011/08/03 07:50:00 | 002,391,656 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvid.dll
[2011/08/03 07:50:00 | 002,222,184 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvenc.dll
[2011/08/03 07:50:00 | 002,090,088 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvenc.dll
[2011/08/03 07:50:00 | 001,519,720 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvdispco64.dll
[2011/08/03 07:50:00 | 000,836,200 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\easyUpdatusAPIU64.dll
[2011/08/03 07:50:00 | 000,117,864 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvmctray.dll
[2011/08/03 07:50:00 | 000,067,176 | —- | M] (Khronos Group) – C:\Windows\SysNative\OpenCL.dll
[2011/08/03 07:50:00 | 000,061,544 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvshext.dll
[2011/08/03 07:50:00 | 000,057,960 | —- | M] (Khronos Group) – C:\Windows\SysWow64\OpenCL.dll
[2011/08/03 07:50:00 | 000,007,383 | —- | M] () – C:\Windows\SysNative\nvinfo.pb
[2011/08/03 03:31:54 | 000,311,912 | —- | M] () – C:\Windows\SysWow64\nvStreaming.exe
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Jeremy\Desktop\*.tmp files -> C:\Users\Jeremy\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/09/01 16:29:49 | 000,000,512 | —- | C] () – C:\Users\Jeremy\Desktop\MBR.dat
[2011/09/01 01:29:29 | 000,003,013 | —- | C] () – C:\Users\Jeremy\Desktop\HiJackThis.lnk
[2011/09/01 01:25:25 | 000,000,315 | —- | C] () – C:\Users\Jeremy\clear.reg
[2011/09/01 00:17:47 | 000,001,159 | —- | C] () – C:\Users\Jeremy\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/09/01 00:17:47 | 000,001,135 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/31 23:59:05 | 000,092,398 | —- | C] () – C:\Users\Jeremy\Documents\cc_20110831_235904.reg
[2011/08/29 20:13:06 | 000,015,440 | —- | C] () – C:\Users\Jeremy\Documents\FONV.veg
[2011/08/24 02:26:03 | 090,762,938 | —- | C] () – C:\Users\Jeremy\Desktop\NVWillow.rar
[2011/08/24 02:25:41 | 000,804,067 | —- | C] () – C:\Users\Jeremy\Desktop\NVWillow.esp
[2011/08/23 23:22:57 | 000,000,959 | —- | C] () – C:\Users\Jeremy\Desktop\Fallout Mod Manager.lnk
[2011/08/21 20:48:26 | 000,000,987 | —- | C] () – C:\Users\Public\Desktop\Origin.lnk
[2011/08/20 03:14:41 | 000,037,280 | —- | C] () – C:\Users\Jeremy\Documents\CHOPPER.veg.bak
[2011/08/20 03:14:41 | 000,037,280 | —- | C] () – C:\Users\Jeremy\Documents\CHOPPER.veg
[2011/08/20 01:28:13 | 000,001,046 | —- | C] () – C:\Users\Public\Desktop\Vegas Pro 10.0 (64-bit).lnk
[2011/08/19 20:24:07 | 000,000,566 | —- | C] () – C:\Users\Jeremy\Desktop\Fraps.lnk
[2011/08/18 19:27:17 | 000,000,934 | —- | C] () – C:\Users\Public\Desktop\CPUID HWMonitor.lnk
[2011/08/18 18:00:11 | 000,000,045 | —- | C] () – C:\Windows\SysWow64\initdebug.nfo
[2011/08/15 16:08:02 | 000,960,457 | —- | C] () – C:\Users\Jeremy\Desktop\mcpatcher-2.1.0_02.exe
[2011/08/14 06:40:22 | 002,337,865 | —- | C] () – C:\Windows\SysWow64\pbsvc.exe
[2011/08/03 18:37:11 | 000,110,592 | —- | C] () – C:\Windows\SysNative\rtvcvfw32.dll
[2011/08/03 18:37:11 | 000,001,106 | —- | C] () – C:\Users\Jeremy\Desktop\MSI Afterburner.lnk
[2011/08/03 16:50:58 | 000,001,117 | —- | C] () – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zotac FireStorm.lnk
[2011/08/03 03:31:54 | 000,311,912 | —- | C] () – C:\Windows\SysWow64\nvStreaming.exe
[2011/07/31 18:21:03 | 000,114,776 | -H– | C] () – C:\Windows\SysWow64\mlfcache.dat
[2011/07/13 18:27:09 | 000,000,015 | —- | C] () – C:\Windows\Firestorm.INI
[2011/07/09 11:29:35 | 000,000,000 | —- | C] () – C:\Users\Jeremy\AppData\Roaming\701653.exe
[2011/07/09 11:29:34 | 000,013,306 | -HS- | C] () – C:\Users\Jeremy\AppData\Local\4r34a7k15lb5f78sd0xfa2i1k55010hy5h32i0524
[2011/07/09 11:29:34 | 000,013,306 | -HS- | C] () – C:\ProgramData\4r34a7k15lb5f78sd0xfa2i1k55010hy5h32i0524
[2011/07/09 11:29:33 | 000,000,000 | —- | C] () – C:\Users\Jeremy\AppData\Roaming\2712068.exe
[2011/07/09 11:29:32 | 000,000,000 | —- | C] () – C:\Users\Jeremy\AppData\Roaming\9651538.exe
[2011/07/09 11:29:31 | 000,000,000 | —- | C] () – C:\Users\Jeremy\AppData\Roaming\7419860.exe
[2011/07/05 23:21:39 | 000,009,466 | —- | C] () – C:\Users\Jeremy\AppData\Roaming\254A.1A0
[2011/07/04 15:13:34 | 000,007,597 | —- | C] () – C:\Users\Jeremy\AppData\Local\Resmon.ResmonCfg
[2011/07/02 01:32:50 | 000,000,268 | —- | C] () – C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2011/06/19 23:26:08 | 000,000,060 | —- | C] () – C:\ProgramData\489cb03
[2011/04/09 18:55:28 | 000,179,261 | —- | C] () – C:\Windows\SysWow64\xlive.dll.cat
[2011/02/16 18:39:19 | 000,143,360 | —- | C] () – C:\Windows\Vmix108.dll
[2011/02/16 18:39:15 | 000,000,522 | —- | C] () – C:\Windows\Cm108.ini.cfl
[2011/02/16 18:38:41 | 000,001,159 | —- | C] () – C:\Windows\Cm108.ini.imi
[2011/02/16 18:38:40 | 000,002,029 | —- | C] () – C:\Windows\Cm108.ini.cfg
[2011/01/12 21:15:45 | 000,003,584 | —- | C] () – C:\Users\Jeremy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/02 14:56:56 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2010/09/09 04:29:19 | 000,000,056 | -H– | C] () – C:\Windows\SysWow64\ezsidmv.dat
[2010/09/08 13:13:32 | 000,000,094 | —- | C] () – C:\Users\Jeremy\AppData\Local\fusioncache.dat
[2010/09/08 13:08:10 | 000,786,274 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2010/08/05 17:46:27 | 000,215,128 | —- | C] () – C:\Windows\SysWow64\PnkBstrB.exe
[2010/06/26 03:47:37 | 002,444,656 | —- | C] () – C:\Windows\SysWow64\pbsvc_apb.exe
[2010/06/24 03:56:44 | 002,434,856 | —- | C] () – C:\Windows\SysWow64\pbsvc_bc2.exe
[2010/06/24 03:56:44 | 000,075,136 | —- | C] () – C:\Windows\SysWow64\PnkBstrA.exe
[2010/06/23 23:13:24 | 000,015,872 | —- | C] () – C:\Windows\AsTaskSched.dll
[2010/06/23 23:11:11 | 000,001,769 | —- | C] () – C:\Windows\Language_trs.ini
[2010/06/23 05:26:20 | 000,000,262 | —- | C] () – C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
[2010/06/23 05:25:10 | 000,001,515 | —- | C] () – C:\Windows\Ctacfg.ini
[2010/06/23 05:25:10 | 000,000,504 | —- | C] () – C:\Windows\CtaMCcfg.ini
[2010/06/23 05:23:24 | 000,148,480 | —- | C] () – C:\Windows\SysWow64\APOMngr.DLL
[2010/06/23 05:23:24 | 000,073,728 | —- | C] () – C:\Windows\SysWow64\CmdRtr.DLL
[2010/06/23 04:43:38 | 000,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2009/11/11 06:41:10 | 000,001,318 | —- | C] () – C:\Windows\cm108.ini
[2009/07/14 01:38:36 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | —- | C] () – C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | —- | C] () – C:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 19:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 17:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | —- | C] () – C:\Windows\SysWow64\mlang.dat

========== LOP Check ==========

[2011/08/15 16:15:59 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\.minecraft
[2011/07/18 00:59:51 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\DAEMON Tools Lite
[2011/06/24 03:44:48 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\FrostWire
[2011/07/13 21:13:45 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\GetRightToGo
[2010/10/26 22:39:05 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\Hi-Rez Studios
[2011/06/30 18:43:31 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\Lionhead Studios
[2011/07/31 04:30:11 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\LolClient
[2011/03/09 21:26:49 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\MusicBrainz
[2011/08/21 20:49:01 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\Origin
[2011/08/30 00:01:30 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\Publish Providers
[2011/07/13 21:06:20 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\PunkBuster
[2010/06/23 07:20:57 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\Razer
[2011/02/25 21:47:36 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\Rift
[2011/01/25 05:20:34 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\SecondLife
[2011/06/24 20:40:27 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\Shareaza
[2011/06/24 03:48:12 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\SoMud
[2011/08/20 01:32:56 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\Sony
[2011/08/29 23:04:30 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\Sony Creative Software Inc
[2011/07/23 16:35:42 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\SystemRequirementsLab
[2010/06/23 05:32:03 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\TS3Client
[2011/09/01 01:01:29 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\uTorrent
[2010/12/19 22:14:41 | 000,000,000 | —D | M] – C:\Users\Jeremy\AppData\Roaming\ZombieDriver
[2009/07/14 01:08:49 | 000,031,364 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/06/10 17:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/07/13 21:38:58 | 000,383,562 | RHS- | M] () – C:\bootmgr
[2010/06/23 05:00:47 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2009/02/11 14:15:00 | 000,040,303 | —- | M] () – C:\buddy_jesus.jpg
[2011/07/02 20:35:21 | 000,000,210 | —- | M] () – C:\cmdlog.txt
[2009/06/10 17:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2009/06/05 12:12:32 | 000,133,699 | —- | M] () – C:\Darksig.jpg
[2010/02/23 16:59:30 | 000,000,496 | —- | M] () – C:\DVDCLog.log
[2011/09/01 01:14:39 | 3220,578,304 | -HS- | M] () – C:\hiberfil.sys
[2009/10/26 15:10:50 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/09/26 20:24:49 | 000,000,708 | -H– | M] () – C:\IPH.PH
[2009/10/26 15:10:50 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2010/06/23 00:04:46 | 003,338,644 | —- | M] () – C:\ntservicelogOutlook.txt
[2011/09/01 01:14:48 | 4294,107,136 | -HS- | M] () – C:\pagefile.sys
[2010/03/02 22:44:00 | 000,007,168 | —- | M] () – C:\palm.grf
[2006/01/07 00:23:02 | 000,000,351 | —- | M] () – C:\RHDSetup.log
[2010/04/29 16:49:20 | 000,140,904 | —- | M] () – C:\RussiaTed2final.jpg
[2006/01/07 00:41:31 | 000,000,178 | —- | M] () – C:\setup.log
[2009/12/27 15:40:49 | 000,000,057 | -H– | M] () – C:\splash.idx
[2006/01/07 00:45:21 | 000,000,000 | —- | M] () – C:\Trace.log
[2009/02/11 22:12:08 | 000,009,232 | -H– | M] () – C:\version

< %systemroot%\Fonts\*.com >
[2009/07/14 01:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 01:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 01:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 01:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 16:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2011/06/25 01:40:15 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/06/23 04:20:03 | 000,000,221 | -HS- | M] () – C:\Users\Jeremy\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/09/01 16:29:11 | 001,916,416 | —- | M] (AVAST Software) – C:\Users\Jeremy\Desktop\aswMBR.exe
[2011/08/15 16:08:05 | 000,960,457 | —- | M] () – C:\Users\Jeremy\Desktop\mcpatcher-2.1.0_02.exe
[2011/02/22 17:13:01 | 000,269,421 | —- | M] () – C:\Users\Jeremy\Desktop\Minecraft.exe
[2011/09/01 16:30:18 | 000,581,120 | —- | M] (OldTimer Tools) – C:\Users\Jeremy\Desktop\OTL.exe
[1 C:\Users\Jeremy\Desktop\*.tmp files -> C:\Users\Jeremy\Desktop\*.tmp -> ]

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2009/06/10 17:20:04 | 000,000,802 | —- | M] () – C:\Windows\ADDINS\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >
[2011/08/18 18:36:33 | 000,008,192 | —- | M] () – C:\Windows\SECURITY\Database\edb.chk
[2011/08/18 18:36:33 | 001,048,576 | —- | M] () – C:\Windows\SECURITY\Database\edb.log
[2011/07/03 05:37:16 | 001,048,576 | —- | M] () – C:\Windows\SECURITY\Database\edbres00001.jrs
[2011/07/03 05:37:16 | 001,048,576 | —- | M] () – C:\Windows\SECURITY\Database\edbres00002.jrs
[2011/08/18 18:36:33 | 001,056,768 | —- | M] () – C:\Windows\SECURITY\Database\tmp.edb

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2011/07/02 18:37:25 | 000,000,402 | -HS- | M] () – C:\Users\Jeremy\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2011/06/25 01:41:05 | 000,000,060 | —- | M] () – C:\ProgramData\489cb03
[2011/07/09 11:45:19 | 000,013,306 | -HS- | M] () – C:\ProgramData\4r34a7k15lb5f78sd0xfa2i1k55010hy5h32i0524
[2011/06/15 03:10:26 | 000,000,258 | RHS- | M] () – C:\ProgramData\ntuser.pol

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >
Post #5
And the OTL Extras:

OTL Extras logfile created on: 9/1/2011 4:35:12 PM - Run 1
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Users\Jeremy\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.96 Gb Available Physical Memory | 73.92% Memory free
8.00 Gb Paging File | 6.43 Gb Available in Paging File | 80.46% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 113.20 Gb Total Space | 28.04 Gb Free Space | 24.77% Space Free | Partition Type: NTFS
Drive D: | 112.85 Gb Total Space | 3.76 Gb Free Space | 3.33% Space Free | Partition Type: NTFS
Drive E: | 2.68 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive F: | 465.64 Gb Total Space | 127.06 Gb Free Space | 27.29% Space Free | Partition Type: FAT32

Computer Name: MIDNA | User Name: Jeremy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Reg Error: Key error.] – Reg Error: Key error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] – Reg Error: Key error.
https [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] – "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] – "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] – "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] – Reg Error: Key error.
https [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] – "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] – "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] – "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Users\Jeremy\Downloads\ups-894414.com" = C:\Users\Jeremy\Downloads\ups-894414.com:*:Enabled:ldrsoft
"C:\Users\Jeremy\Downloads\ups-894414.com" = C:\Users\Jeremy\Downloads\ups-894414.com:*:Enabled:ldrsoft


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{015C5B35-B678-451C-9AEE-821E8D69621C}_is1" = PeerBlock 1.1 (r518)
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{26A24AE4-039D-4CA4-87B4-2F86417000FF}" = Java™ 7 (64-bit)
"{328CC232-CFDC-468B-A214-2E21300E4CB5}" = Apple Mobile Device Support
"{3428D45E-785A-147C-9BB6-018C1D9EAF43}" = ATI Catalyst Install Manager
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{53529DAD-F7C9-476E-87CC-1547C4E3E821}" = iTunes
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}" = Windows Mobile Device Center
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 280.26
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 280.26
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.10.0514
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.4.28
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD Audio Driver [removed]
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{B91110FB-33B4-468B-90C2-4D5E8AE3FAE1}" = Bonjour
"{C616FD4F-11F5-11E0-A38F-0013D3D69929}" = Vegas Pro 10.0 (64-bit)
"{C9608300-11F5-11E0-A64B-0013D3D69929}" = MSVCRT Redists
"{D9C50188-12D5-4D3E-8F00-682346C2AA5F}" = Microsoft Xbox 360 Accessories 1.2
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}" = Ventrilo Client for Windows x64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"C-Media CM108 Like Sound Driver" = PulseWave 2 Audio Software
"CPUID HWMonitor_is1" = CPUID HWMonitor 1.18
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{117B6BF6-82C3-420C-B284-9247C8568E53}" = The Sims™ 3 Outdoor Living Stuff
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F77C418-2C90-459C-BD33-B56A4182B9FA}" = System Requirements Lab CYRI
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
"{24E34264-D483-477C-A9A0-4E53F69834CF}" = Façade
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 23
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{3881DB80-EAA2-012B-ADAE-000000000000}" = TurboTax 2009 WinPerFedFormset
"{38975F50-EAA2-012B-ADB4-000000000000}" = TurboTax 2009 WinPerReleaseEngine
"{38A34630-EAA2-012B-ADB6-000000000000}" = TurboTax 2009 WinPerTaxSupport
"{3C5A81D0-EAA2-012B-AE9F-000000000000}" = TurboTax 2009 wrapper
"{3D9795B0-EAA2-012B-AEEE-000000000000}" = TurboTax 2009 wwviper
"{3D9892BB-A751-4E48-ADC8-E4289956CE1D}" = QuickTime
"{45057FCE-5784-48BE-8176-D9D00AF56C3C}" = The Sims™ 3 Late Night
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6033673D-2530-4587-8AD0-EB059FC263F9}" = Crysis® 2
"{655B9514-3963-490B-9EE1-431E80444889}" = Razer Tarantula
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71828142-5A24-4BD0-97E7-976DA08CE6CF}" = The Sims™ 3 High-End Loft Stuff
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}" = Mass Effect 2
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{87686C21-8A15-4b4d-A3F1-11141D9BE094}" = Battlefield Play4Free
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{910F4A29-1134-49E0-AD8B-56E4A3152BD1}" = The Sims™ 3 Ambitions
"{92482FB3-C05B-41C6-89E7-75D985602A6E}" = System Requirements Lab
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9FD6F1A8-5550-46AF-8509-271DF0E768B5}" = Dual-Core Optimizer
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A89DEBCA-F743-3412-97F6-B2E489194551}" = Google Talk Plugin
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.2
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{B3491D28-DCF7-0D3E-1B3F-28E6FCDE659F}" = HydraVision
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{BE4BA698-8533-4F77-9559-C7F3F78C0B05}" = Assassin's Creed Brotherhood
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = The Sims™ 3
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC}" = The Sims™ 3 Generations
"{EB1B8449-CD8F-485B-ADB6-02FBCFE180D3}" = Razer DeathAdder™ Mouse
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Afterburner" = MSI Afterburner 2.1.0
"ALchemy" = Creative ALchemy
"Audacity_is1" = Audacity 1.2.6
"AudioCS" = Creative Audio Control Panel
"Cisco Connect" = Cisco Connect
"Comical_is1" = Comical 0.8
"Creative Sound Blaster Properties x64 Edition" = Creative Sound Blaster Properties x64 Edition
"DivX Setup.divx.com" = DivX Setup
"Download Manager" = Download Manager 2.3.10
"Fraps" = Fraps (remove only)
"Game Booster_is1" = Game Booster
"Generic Mod Manager_is1" = Fallout Mod Manager 0.13.21
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox 6.0.1 (x86 en-US)" = Mozilla Firefox 6.0.1 (x86 en-US)
"OpenAL" = OpenAL
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"RivaTuner" = RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition
"Soulseek2" = SoulSeek 157 NS 13e
"Star Wars - The Old Republic" = Star Wars - The Old Republic
"StarCraft II" = StarCraft II
"Steam App 105600" = Terraria
"Steam App 12900" = Audiosurf
"Steam App 20920" = The Witcher 2
"Steam App 22380" = Fallout: New Vegas
"Steam App 32370" = Star Wars: Knights of the Old Republic
"Steam App 35010" = Batman: Arkham Asylum
"Steam App 39120" = RIFT™
"Steam App 40800" = Super Meat Boy
"Steam App 550" = Left 4 Dead 2
"Steam App 55410" = Warhammer 40,000: Space Marine Demo
"Steam App 8190" = Just Cause 2
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.1.4
"Winamp" = Winamp
"WinRAR archiver" = WinRAR archiver
"ZOTAC FireStorm" = ZOTAC FireStorm

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Winamp Detect" = Winamp Detector Plug-in

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 9/1/2011 1:41:17 AM | Computer Name = Midna | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 9/1/2011 2:19:39 AM | Computer Name = Midna | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 9/1/2011 3:02:46 AM | Computer Name = Midna | Source = Application Error | ID = 1000
Description = Faulting application name: svchost.exe, version: 6.1.7600.16385, time
stamp: 0x4a5bc3c5 Faulting module name: Flash10h.ocx, version: 10.1.53.64, time
stamp: 0x4bfd7406 Exception code: 0xc0000005 Fault offset: 0x00321538 Faulting process
id: 0x310 Faulting application start time: 0x01cc686614f012d3 Faulting application
path: \\.\globalroot\systemroot\svchost.exe Faulting module path: C:\Windows\SysWOW64\Macromed\Flash\Flash10h.ocx
Report
Id: 6519e42e-d468-11e0-8a4c-90e6ba88c177

Error - 9/1/2011 3:49:18 AM | Computer Name = Midna | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 9/1/2011 3:49:18 AM | Computer Name = Midna | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 10000

Error - 9/1/2011 3:49:18 AM | Computer Name = Midna | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 10000

Error - 9/1/2011 4:24:14 PM | Computer Name = Midna | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 9/1/2011 4:24:15 PM | Computer Name = Midna | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 45305452

Error - 9/1/2011 4:24:15 PM | Computer Name = Midna | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 45305452

Error - 9/1/2011 4:33:43 PM | Computer Name = Midna | Source = Application Hang | ID = 1002
Description = The program OTL.exe version 3.2.27.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Action Center control panel. Process ID: 17ec Start Time:
01cc68e63223923a Termination Time: 10 Application Path: C:\Users\Jeremy\Desktop\OTL.exe

Report
Id:

[ Media Center Events ]
Error - 1/13/2011 10:15:24 AM | Computer Name = Midna | Source = Microsoft-Windows-Media Center Extender | ID = 536
Description =

Error - 6/15/2011 3:09:12 AM | Computer Name = Midna | Source = Microsoft-Windows-Media Center Extender | ID = 544
Description =

[ System Events ]
Error - 8/31/2011 11:52:18 PM | Computer Name = Midna | Source = NetBT | ID = 4321
Description = The name "MIDNA :0" could not be registered on the interface
with IP address 192.168.1.124. The computer with the IP address 192.168.1.1 did
not allow the name to be claimed by this computer.

Error - 8/31/2011 11:52:19 PM | Computer Name = Midna | Source = NetBT | ID = 4321
Description = The name "MIDNA :20" could not be registered on the interface
with IP address 192.168.1.124. The computer with the IP address 192.168.1.1 did
not allow the name to be claimed by this computer.

Error - 9/1/2011 12:15:17 AM | Computer Name = Midna | Source = NetBT | ID = 4321
Description = The name "MIDNA :0" could not be registered on the interface
with IP address 192.168.1.124. The computer with the IP address 192.168.1.1 did
not allow the name to be claimed by this computer.

Error - 9/1/2011 12:15:26 AM | Computer Name = Midna | Source = Server | ID = 2505
Description = The server could not bind to the transport \Device\NetBT_Tcpip_{67087C97-1605-497A-9AC3-F0168C5B764E}
because another computer on the network has the same name. The server could not
start.

Error - 9/1/2011 12:15:26 AM | Computer Name = Midna | Source = NetBT | ID = 4321
Description = The name "MIDNA :20" could not be registered on the interface
with IP address 192.168.1.124. The computer with the IP address 192.168.1.1 did
not allow the name to be claimed by this computer.

Error - 9/1/2011 12:20:23 AM | Computer Name = Midna | Source = Server | ID = 2505
Description = The server could not bind to the transport \Device\NetBT_Tcpip_{67087C97-1605-497A-9AC3-F0168C5B764E}
because another computer on the network has the same name. The server could not
start.

Error - 9/1/2011 12:20:23 AM | Computer Name = Midna | Source = NetBT | ID = 4321
Description = The name "MIDNA :0" could not be registered on the interface
with IP address 192.168.1.124. The computer with the IP address 192.168.1.1 did
not allow the name to be claimed by this computer.

Error - 9/1/2011 12:20:23 AM | Computer Name = Midna | Source = NetBT | ID = 4321
Description = The name "MIDNA :20" could not be registered on the interface
with IP address 192.168.1.124. The computer with the IP address 192.168.1.1 did
not allow the name to be claimed by this computer.

Error - 9/1/2011 12:22:40 AM | Computer Name = Midna | Source = Server | ID = 2505
Description = The server could not bind to the transport \Device\NetBT_Tcpip_{67087C97-1605-497A-9AC3-F0168C5B764E}
because another computer on the network has the same name. The server could not
start.

Error - 9/1/2011 12:22:39 AM | Computer Name = Midna | Source = NetBT | ID = 4321
Description = The name "MIDNA :0" could not be registered on the interface
with IP address 192.168.1.124. The computer with the IP address 192.168.1.1 did
not allow the name to be claimed by this computer.


< End of report >
Post #6
Please download TDSSKiller.zip
  • Extract it to your desktop
  • Double click TDSSKiller.exe
  • Press Start Scan
    • Only if Malicious objects are found then ensure Cure is selected
      If suspicious objects are found select skip
    • Then click Continue > Reboot now
  • Copy and paste the log in your next reply
    • A copy of the log will be saved automatically to the root of the drive (typically C:\)










Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:Otl
O2:64bit: - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - No CLSID value found.
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - No CLSID value found.
O2 - BHO: (no name) - {175EC2F2-4131-826D-6872-913243685C03} - No CLSID value found.
O2 - BHO: (no name) - {26904C4C-E3AF-B5CB-8134-CB242C8CF356} - No CLSID value found.
O2 - BHO: (no name) - {30D1F4A2-46E3-83D2-2706-399B3034112D} - No CLSID value found.
O2 - BHO: (no name) - {34A121C9-0C8A-5FE8-4A47-02EC4D81D245} - No CLSID value found.
O2 - BHO: (no name) - {47DD71B8-7BAD-EA3C-C090-5CB51F6F061B} - No CLSID value found.
O2 - BHO: (no name) - {4C6E7CF7-8806-6DE0-7AE8-CAD60E4C3195} - No CLSID value found.
O2 - BHO: (no name) - {4C91095E-0753-8740-0CE3-D97751138BDB} - No CLSID value found.
O2 - BHO: (no name) - {5B7188B1-14DA-A1F3-E78E-E3FD9397E9C7} - No CLSID value found.
O2 - BHO: (no name) - {6AD434AA-34BD-186D-898B-703209DE41A3} - No CLSID value found.
O2 - BHO: (no name) - {95A61A30-3FC2-2CE8-3D7B-E1FAC265F780} - No CLSID value found.
O2 - BHO: (no name) - {9A635AC4-20F2-E663-6AE5-CDB80238C82D} - No CLSID value found.
O2 - BHO: (no name) - {A970FEA0-BDC7-C6D7-B179-78A60DB223E4} - No CLSID value found.
O2 - BHO: (no name) - {BC1F92EE-F806-4425-DF55-8CCE445F0AC9} - No CLSID value found.
O2 - BHO: (no name) - {C4B1D2A3-12A8-4A44-9413-2A19E040B490} - No CLSID value found.
O2 - BHO: (no name) - {C740BD6C-5EB2-6A3D-36C8-5D2EBDFAB5A5} - No CLSID value found.
O2 - BHO: (no name) - {E35FBC87-F87C-9C9A-4FBD-CFB717595F1C} - No CLSID value found.
O2 - BHO: (no name) - {E3FC4B40-7CEE-7FF8-A7EB-15220F310213} - No CLSID value found.
O2 - BHO: (no name) - {F3E3345E-9F57-A4DA-C9FF-DE6F1B29390D} - No CLSID value found.
[2011/07/09 11:29:35 | 000,000,000 | —- | C] () – C:\Users\Jeremy\AppData\Roaming\701653.exe
[2011/07/09 11:29:34 | 000,013,306 | -HS- | C] () – C:\Users\Jeremy\AppData\Local\4r34a7k15lb5f78sd0xfa2i1k55010hy5h32i0524
[2011/07/09 11:29:34 | 000,013,306 | -HS- | C] () – C:\ProgramData\4r34a7k15lb5f78sd0xfa2i1k55010hy5h32i0524
[2011/07/09 11:29:33 | 000,000,000 | —- | C] () – C:\Users\Jeremy\AppData\Roaming\2712068.exe
[2011/07/09 11:29:32 | 000,000,000 | —- | C] () – C:\Users\Jeremy\AppData\Roaming\9651538.exe
[2011/07/09 11:29:31 | 000,000,000 | —- | C] () – C:\Users\Jeremy\AppData\Roaming\7419860.exe

:Commands
[emptytemp]
[resethosts]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
Post #7
TDSSKILLER Log: 2011/09/01 20:03:16.0380 4796 TDSS rootkit removing tool 2.5.17.0 Aug 22 2011 15:46:57 2011/09/01 20:03:18.0381 4796 ================================================================================ 2011/09/01 20:03:18.0381 4796 SystemInfo: 2011/09/01 20:03:18.0381 4796 2011/09/01 20:03:18.0381 4796 OS Version: 6.1.7601 ServicePack: 1.0 2011/09/01 20:03:18.0381 4796 Product type: Workstation 2011/09/01 20:03:18.0381 4796 ComputerName: MIDNA 2011/09/01 20:03:18.0381 4796 UserName: Jeremy 2011/09/01 20:03:18.0381 4796 Windows directory: C:\Windows 2011/09/01 20:03:18.0381 4796 System windows directory: C:\Windows 2011/09/01 20:03:18.0381 4796 Running under WOW64 2011/09/01 20:03:18.0381 4796 Processor architecture: Intel x64 2011/09/01 20:03:18.0381 4796 Number of processors: 4 2011/09/01 20:03:18.0381 4796 Page size: 0x1000 2011/09/01 20:03:18.0381 4796 Boot type: Normal boot 2011/09/01 20:03:18.0381 4796 ================================================================================ 2011/09/01 20:03:26.0405 4796 Initialize success 2011/09/01 20:03:37.0542 4392 ================================================================================ 2011/09/01 20:03:37.0542 4392 Scan started 2011/09/01 20:03:37.0542 4392 Mode: Manual; 2011/09/01 20:03:37.0542 4392 ================================================================================ 2011/09/01 20:03:38.0418 4392 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys 2011/09/01 20:03:38.0470 4392 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys 2011/09/01 20:03:38.0570 4392 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys 2011/09/01 20:03:38.0671 4392 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys 2011/09/01 20:03:38.0780 4392 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys 2011/09/01 20:03:38.0849 4392 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys 2011/09/01 20:03:38.0963 4392 AFD (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys 2011/09/01 20:03:39.0009 4392 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys 2011/09/01 20:03:39.0086 4392 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys 2011/09/01 20:03:39.0097 4392 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys 2011/09/01 20:03:39.0135 4392 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys 2011/09/01 20:03:39.0226 4392 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 2011/09/01 20:03:39.0264 4392 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys 2011/09/01 20:03:39.0298 4392 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys 2011/09/01 20:03:39.0316 4392 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys 2011/09/01 20:03:39.0419 4392 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys 2011/09/01 20:03:39.0467 4392 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys 2011/09/01 20:03:39.0489 4392 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys 2011/09/01 20:03:39.0573 4392 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 2011/09/01 20:03:39.0618 4392 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys 2011/09/01 20:03:39.0685 4392 AtiPcie (7c5d273e29dcc5505469b299c6f29163) C:\Windows\system32\DRIVERS\AtiPcie.sys 2011/09/01 20:03:39.0791 4392 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys 2011/09/01 20:03:39.0889 4392 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 2011/09/01 20:03:39.0988 4392 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 2011/09/01 20:03:40.0041 4392 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 2011/09/01 20:03:40.0093 4392 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys 2011/09/01 20:03:40.0179 4392 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys 2011/09/01 20:03:40.0192 4392 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys 2011/09/01 20:03:40.0229 4392 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 2011/09/01 20:03:40.0253 4392 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 2011/09/01 20:03:40.0326 4392 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 2011/09/01 20:03:40.0358 4392 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 2011/09/01 20:03:40.0381 4392 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys 2011/09/01 20:03:40.0431 4392 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 2011/09/01 20:03:40.0547 4392 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys 2011/09/01 20:03:40.0635 4392 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys 2011/09/01 20:03:40.0678 4392 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 2011/09/01 20:03:40.0809 4392 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 2011/09/01 20:03:40.0846 4392 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys 2011/09/01 20:03:40.0911 4392 CNG (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys 2011/09/01 20:03:41.0012 4392 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 2011/09/01 20:03:41.0056 4392 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys 2011/09/01 20:03:41.0171 4392 cpuz135 (262969a3fab32b9e17e63e2d17a57744) C:\Windows\system32\drivers\cpuz135_x64.sys 2011/09/01 20:03:41.0221 4392 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys 2011/09/01 20:03:41.0325 4392 Ctafiltv (01acb9228c303de1fff82b807d28b2b0) C:\Windows\system32\drivers\Ctafiltv.sys 2011/09/01 20:03:41.0380 4392 CYUSB (8ec96b753727b380089d66d4ab5869df) C:\Windows\system32\Drivers\CYUSB.sys 2011/09/01 20:03:41.0465 4392 DAdderFltr (fbcb29a76e8105d682b02c69ba9b5c22) C:\Windows\system32\drivers\dadder.sys 2011/09/01 20:03:41.0529 4392 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys 2011/09/01 20:03:41.0564 4392 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 2011/09/01 20:03:41.0650 4392 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys 2011/09/01 20:03:41.0708 4392 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 2011/09/01 20:03:41.0759 4392 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys 2011/09/01 20:03:41.0921 4392 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys 2011/09/01 20:03:42.0047 4392 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys 2011/09/01 20:03:42.0085 4392 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys 2011/09/01 20:03:42.0653 4392 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 2011/09/01 20:03:42.0884 4392 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 2011/09/01 20:03:42.0915 4392 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys 2011/09/01 20:03:42.0953 4392 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 2011/09/01 20:03:43.0013 4392 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 2011/09/01 20:03:43.0059 4392 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys 2011/09/01 20:03:43.0136 4392 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys 2011/09/01 20:03:43.0166 4392 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 2011/09/01 20:03:43.0185 4392 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys 2011/09/01 20:03:43.0245 4392 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys 2011/09/01 20:03:43.0309 4392 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys 2011/09/01 20:03:43.0326 4392 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 2011/09/01 20:03:43.0350 4392 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 2011/09/01 20:03:43.0409 4392 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys 2011/09/01 20:03:43.0472 4392 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\DRIVERS\HDAudBus.sys 2011/09/01 20:03:43.0503 4392 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys 2011/09/01 20:03:43.0524 4392 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys 2011/09/01 20:03:43.0543 4392 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys 2011/09/01 20:03:43.0656 4392 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys 2011/09/01 20:03:43.0727 4392 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys 2011/09/01 20:03:43.0779 4392 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys 2011/09/01 20:03:43.0859 4392 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys 2011/09/01 20:03:43.0914 4392 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys 2011/09/01 20:03:43.0960 4392 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys 2011/09/01 20:03:44.0031 4392 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys 2011/09/01 20:03:44.0056 4392 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys 2011/09/01 20:03:44.0094 4392 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys 2011/09/01 20:03:44.0204 4392 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys 2011/09/01 20:03:44.0242 4392 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys 2011/09/01 20:03:44.0280 4392 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 2011/09/01 20:03:44.0345 4392 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 2011/09/01 20:03:44.0380 4392 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys 2011/09/01 20:03:44.0418 4392 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys 2011/09/01 20:03:44.0464 4392 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys 2011/09/01 20:03:44.0536 4392 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys 2011/09/01 20:03:44.0590 4392 KSecDD (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys 2011/09/01 20:03:44.0644 4392 KSecPkg (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys 2011/09/01 20:03:44.0726 4392 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 2011/09/01 20:03:44.0771 4392 L1E (2ac603c3188c704cfce353659aa7ad71) C:\Windows\system32\DRIVERS\L1E62x64.sys 2011/09/01 20:03:44.0876 4392 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 2011/09/01 20:03:44.0966 4392 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys 2011/09/01 20:03:45.0093 4392 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys 2011/09/01 20:03:45.0246 4392 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys 2011/09/01 20:03:45.0295 4392 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys 2011/09/01 20:03:45.0332 4392 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 2011/09/01 20:03:45.0450 4392 MBAMProtector (9c4fb231b6e02f84580de2f00f3c5293) C:\Windows\system32\drivers\mbam.sys 2011/09/01 20:03:45.0510 4392 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys 2011/09/01 20:03:45.0531 4392 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys 2011/09/01 20:03:45.0592 4392 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 2011/09/01 20:03:45.0645 4392 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 2011/09/01 20:03:45.0691 4392 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys 2011/09/01 20:03:45.0737 4392 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 2011/09/01 20:03:45.0792 4392 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys 2011/09/01 20:03:45.0826 4392 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys 2011/09/01 20:03:45.0888 4392 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 2011/09/01 20:03:45.0951 4392 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys 2011/09/01 20:03:45.0981 4392 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys 2011/09/01 20:03:46.0037 4392 mrxsmb10 (2086d463bd371d8a37d153897430916d) C:\Windows\system32\DRIVERS\mrxsmb10.sys 2011/09/01 20:03:46.0074 4392 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys 2011/09/01 20:03:46.0105 4392 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys 2011/09/01 20:03:46.0170 4392 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys 2011/09/01 20:03:46.0225 4392 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 2011/09/01 20:03:46.0254 4392 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 2011/09/01 20:03:46.0276 4392 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys 2011/09/01 20:03:46.0338 4392 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 2011/09/01 20:03:46.0392 4392 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 2011/09/01 20:03:46.0408 4392 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 2011/09/01 20:03:46.0449 4392 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys 2011/09/01 20:03:46.0576 4392 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys 2011/09/01 20:03:46.0641 4392 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 2011/09/01 20:03:46.0671 4392 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys 2011/09/01 20:03:46.0727 4392 MTsensor (03b7145c889603537e9ffeabb1ad1089) C:\Windows\system32\DRIVERS\ASACPI.sys 2011/09/01 20:03:46.0813 4392 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 2011/09/01 20:03:46.0892 4392 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 2011/09/01 20:03:47.0067 4392 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys 2011/09/01 20:03:47.0370 4392 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 2011/09/01 20:03:47.0399 4392 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 2011/09/01 20:03:47.0474 4392 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys 2011/09/01 20:03:47.0545 4392 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys 2011/09/01 20:03:47.0588 4392 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys 2011/09/01 20:03:47.0932 4392 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 2011/09/01 20:03:48.0001 4392 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys 2011/09/01 20:03:48.0134 4392 netr28x (b72bb9496a126fcfc7fc5945ded9b411) C:\Windows\system32\DRIVERS\netr28x.sys 2011/09/01 20:03:48.0175 4392 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys 2011/09/01 20:03:48.0254 4392 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 2011/09/01 20:03:48.0276 4392 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 2011/09/01 20:03:48.0341 4392 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys 2011/09/01 20:03:48.0429 4392 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 2011/09/01 20:03:48.0470 4392 NVHDA (960e39a54e525df58cb29193147dffa1) C:\Windows\system32\drivers\nvhda64v.sys 2011/09/01 20:03:48.0876 4392 nvlddmkm (cc1efea1f0ab17e59bd4b5baff3e5cb0) C:\Windows\system32\DRIVERS\nvlddmkm.sys 2011/09/01 20:03:49.0229 4392 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys 2011/09/01 20:03:49.0261 4392 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys 2011/09/01 20:03:49.0372 4392 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys 2011/09/01 20:03:49.0411 4392 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys 2011/09/01 20:03:49.0447 4392 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys 2011/09/01 20:03:49.0481 4392 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys 2011/09/01 20:03:49.0574 4392 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys 2011/09/01 20:03:49.0595 4392 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys 2011/09/01 20:03:49.0642 4392 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys 2011/09/01 20:03:49.0709 4392 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 2011/09/01 20:03:49.0739 4392 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 2011/09/01 20:03:49.0930 4392 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys 2011/09/01 20:03:49.0952 4392 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys 2011/09/01 20:03:50.0003 4392 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys 2011/09/01 20:03:50.0153 4392 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys 2011/09/01 20:03:50.0274 4392 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys 2011/09/01 20:03:50.0309 4392 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 2011/09/01 20:03:50.0357 4392 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 2011/09/01 20:03:50.0423 4392 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 2011/09/01 20:03:50.0468 4392 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys 2011/09/01 20:03:50.0514 4392 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 2011/09/01 20:03:50.0604 4392 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 2011/09/01 20:03:50.0681 4392 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys 2011/09/01 20:03:50.0767 4392 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys 2011/09/01 20:03:50.0787 4392 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 2011/09/01 20:03:50.0818 4392 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 2011/09/01 20:03:50.0834 4392 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 2011/09/01 20:03:50.0867 4392 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys 2011/09/01 20:03:50.0943 4392 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys 2011/09/01 20:03:51.0006 4392 RivaTuner64 (a10b40cf9eb57d24e44717a2d38a00f4) C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys 2011/09/01 20:03:51.0110 4392 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 2011/09/01 20:03:51.0148 4392 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys 2011/09/01 20:03:51.0210 4392 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys 2011/09/01 20:03:51.0305 4392 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 2011/09/01 20:03:51.0332 4392 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys 2011/09/01 20:03:51.0374 4392 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys 2011/09/01 20:03:51.0437 4392 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys 2011/09/01 20:03:51.0478 4392 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys 2011/09/01 20:03:51.0492 4392 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys 2011/09/01 20:03:51.0537 4392 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys 2011/09/01 20:03:51.0583 4392 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys 2011/09/01 20:03:51.0642 4392 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys 2011/09/01 20:03:51.0664 4392 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys 2011/09/01 20:03:51.0731 4392 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 2011/09/01 20:03:51.0822 4392 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 2011/09/01 20:03:51.0912 4392 sptd (602884696850c86434530790b110e8eb) C:\Windows\system32\Drivers\sptd.sys 2011/09/01 20:03:51.0912 4392 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: 602884696850c86434530790b110e8eb 2011/09/01 20:03:51.0916 4392 sptd - detected LockedFile.Multi.Generic (1) 2011/09/01 20:03:51.0954 4392 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys 2011/09/01 20:03:52.0036 4392 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys 2011/09/01 20:03:52.0058 4392 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys 2011/09/01 20:03:52.0162 4392 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys 2011/09/01 20:03:52.0223 4392 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys 2011/09/01 20:03:52.0333 4392 TarFltr (827f682e9d2d9b2a49691c3a9697a3bb) C:\Windows\system32\drivers\UsbFltr.sys 2011/09/01 20:03:52.0402 4392 Tcpip (92ce29d95ac9dd2d0ee9061d551ba250) C:\Windows\system32\drivers\tcpip.sys 2011/09/01 20:03:52.0560 4392 TCPIP6 (92ce29d95ac9dd2d0ee9061d551ba250) C:\Windows\system32\DRIVERS\tcpip.sys 2011/09/01 20:03:52.0659 4392 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys 2011/09/01 20:03:52.0689 4392 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 2011/09/01 20:03:52.0712 4392 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys 2011/09/01 20:03:52.0752 4392 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys 2011/09/01 20:03:52.0842 4392 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys 2011/09/01 20:03:52.0897 4392 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys 2011/09/01 20:03:52.0997 4392 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys 2011/09/01 20:03:53.0046 4392 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys 2011/09/01 20:03:53.0072 4392 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys 2011/09/01 20:03:53.0195 4392 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys 2011/09/01 20:03:53.0249 4392 uisp (75894b827b8ca53fc2bb991c91b6728c) C:\Windows\system32\Drivers\usbicp.sys 2011/09/01 20:03:53.0279 4392 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys 2011/09/01 20:03:53.0371 4392 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys 2011/09/01 20:03:53.0407 4392 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys 2011/09/01 20:03:53.0445 4392 USBAAPL64 (cd03479f2da26500b203ed075c146a7a) C:\Windows\system32\Drivers\usbaapl64.sys 2011/09/01 20:03:53.0512 4392 usbaudio (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys 2011/09/01 20:03:53.0549 4392 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys 2011/09/01 20:03:53.0638 4392 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys 2011/09/01 20:03:53.0668 4392 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys 2011/09/01 20:03:53.0730 4392 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys 2011/09/01 20:03:54.0067 4392 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys 2011/09/01 20:03:54.0486 4392 USBPNPA (813bfe2de062a28cfe42c4eb8572a7f9) C:\Windows\system32\drivers\CM10864.sys 2011/09/01 20:03:54.0574 4392 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 2011/09/01 20:03:54.0640 4392 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\drivers\USBSTOR.SYS 2011/09/01 20:03:54.0660 4392 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys 2011/09/01 20:03:54.0808 4392 usb_rndisx (70d05ee263568a742d14e1876df80532) C:\Windows\system32\DRIVERS\usb8023x.sys 2011/09/01 20:03:54.0854 4392 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys 2011/09/01 20:03:54.0934 4392 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 2011/09/01 20:03:54.0956 4392 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 2011/09/01 20:03:54.0995 4392 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys 2011/09/01 20:03:55.0097 4392 vhidmini (1161acff728d97f75d74d2f1465f8a46) C:\Windows\system32\DRIVERS\vHidDev.sys 2011/09/01 20:03:55.0174 4392 VIAHdAudAddService (28bcdfe57119b97eef05361906ce74be) C:\Windows\system32\drivers\viahduaa.sys 2011/09/01 20:03:55.0396 4392 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys 2011/09/01 20:03:55.0544 4392 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys 2011/09/01 20:03:55.0585 4392 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys 2011/09/01 20:03:55.0672 4392 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys 2011/09/01 20:03:55.0741 4392 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys 2011/09/01 20:03:55.0805 4392 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys 2011/09/01 20:03:55.0828 4392 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys 2011/09/01 20:03:55.0878 4392 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys 2011/09/01 20:03:55.0960 4392 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 2011/09/01 20:03:55.0971 4392 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 2011/09/01 20:03:56.0012 4392 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys 2011/09/01 20:03:56.0062 4392 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 2011/09/01 20:03:56.0148 4392 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 2011/09/01 20:03:56.0159 4392 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 2011/09/01 20:03:56.0267 4392 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys 2011/09/01 20:03:56.0362 4392 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys 2011/09/01 20:03:56.0411 4392 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 2011/09/01 20:03:56.0457 4392 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys 2011/09/01 20:03:56.0551 4392 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys 2011/09/01 20:03:56.0676 4392 xnacc (4a5ce13408945e525503b5f73d29b9c5) C:\Windows\system32\DRIVERS\xnacc.sys 2011/09/01 20:03:56.0777 4392 xusb21 (2c6bc21b2d5b58d8b1d638c1704cb494) C:\Windows\system32\DRIVERS\xusb21.sys 2011/09/01 20:03:56.0806 4392 MBR (0x1B8) (d8f98fa929a3ce2707b66f8b212f5858) \Device\Harddisk0\DR0 2011/09/01 20:03:56.0809 4392 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.a (0) 2011/09/01 20:03:57.0293 4392 MBR (0x1B8) (988d3c46cbd13ec7f482b833c55264c8) \Device\Harddisk1\DR1 2011/09/01 20:03:57.0310 4392 Boot (0x1200) (1a0891472162a9ddd250093b352c29cf) \Device\Harddisk0\DR0\Partition0 2011/09/01 20:03:57.0331 4392 Boot (0x1200) (d91472f520897ec9e9d2df86477908b8) \Device\Harddisk0\DR0\Partition1 2011/09/01 20:03:57.0339 4392 Boot (0x1200) (de47c0f5d2ae8cdc06060e98022cecd6) \Device\Harddisk1\DR1\Partition0 2011/09/01 20:03:57.0344 4392 ================================================================================ 2011/09/01 20:03:57.0345 4392 Scan finished 2011/09/01 20:03:57.0345 4392 ================================================================================ 2011/09/01 20:03:57.0353 6068 Detected object count: 2 2011/09/01 20:03:57.0353 6068 Actual detected object count: 2 2011/09/01 20:04:22.0884 6068 LockedFile.Multi.Generic(sptd) - User select action: Skip 2011/09/01 20:04:22.0890 6068 \Device\Harddisk0\DR0 (Rootkit.Boot.Pihar.a) - will be cured after reboot 2011/09/01 20:04:22.0891 6068 \Device\Harddisk0\DR0 - ok 2011/09/01 20:04:22.0891 6068 Rootkit.Boot.Pihar.a(\Device\Harddisk0\DR0) - User select action: Cure 2011/09/01 20:04:30.0127 2480 Deinitialize success
Post #8
OTL Log:

OTL logfile created on: 9/1/2011 8:21:14 PM - Run 2
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Users\Jeremy\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.74 Gb Available Physical Memory | 68.43% Memory free
8.00 Gb Paging File | 6.67 Gb Available in Paging File | 83.42% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 113.20 Gb Total Space | 22.79 Gb Free Space | 20.13% Space Free | Partition Type: NTFS
Drive D: | 112.85 Gb Total Space | 0.95 Gb Free Space | 0.84% Space Free | Partition Type: NTFS
Drive E: | 2.68 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive F: | 465.64 Gb Total Space | 127.06 Gb Free Space | 27.29% Space Free | Partition Type: FAT32

Computer Name: MIDNA | User Name: Jeremy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Jeremy\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\PnkBstrB.exe ()
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - D:\Steam\Steam.exe (Valve Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\IObit\Game Booster\GameBooster.exe (IObit)
PRC - C:\Program Files (x86)\IObit\Game Booster\gbtray.exe (IObit)
PRC - C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe ()
PRC - C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
PRC - C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe ()
PRC - C:\Program Files (x86)\Razer\DeathAdder\razertra.exe ()
PRC - C:\Program Files (x86)\ZOTAC FireStorm\Firestorm.exe (ZOTAC Ltd.)
PRC - C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
PRC - C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe (Razer Inc.)
PRC - C:\Program Files (x86)\Razer\Tarantula\razerhid.exe (Razer USA Ltd.)
PRC - C:\Program Files (x86)\Razer\Tarantula\razertra.exe ()


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - D:\Steam\bin\libcef.dll ()
MOD - D:\Steam\bin\avcodec-52.dll ()
MOD - D:\Steam\bin\chromehtml.dll ()
MOD - D:\Steam\bin\avformat-52.dll ()
MOD - D:\Steam\bin\avutil-50.dll ()
MOD - C:\Program Files (x86)\IObit\Game Booster\sqlite3.dll ()
MOD - C:\Program Files (x86)\IObit\Game Booster\PowerConfig.dll ()
MOD - C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe ()
MOD - C:\Program Files (x86)\MSI Afterburner\RTMUI.dll ()
MOD - C:\Program Files (x86)\MSI Afterburner\RTHAL.dll ()
MOD - C:\Program Files (x86)\MSI Afterburner\RTCore.dll ()
MOD - C:\Program Files (x86)\MSI Afterburner\RTUI.dll ()
MOD - C:\Program Files (x86)\MSI Afterburner\RTFC.dll ()
MOD - C:\Program Files (x86)\IObit\Game Booster\madExcept_.bpl ()
MOD - C:\Program Files (x86)\MSI Afterburner\RTTSH.dll ()
MOD - C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe ()
MOD - C:\Program Files (x86)\Razer\DeathAdder\razertra.exe ()
MOD - C:\Program Files (x86)\IObit\Game Booster\madbasic_.bpl ()
MOD - C:\Program Files (x86)\IObit\Game Booster\maddisAsm_.bpl ()
MOD - C:\Program Files (x86)\Razer\Tarantula\razertra.exe ()


========== Win32 Services (SafeList) ==========

SRV - (PnkBstrB) – C:\Windows\SysWOW64\PnkBstrB.exe ()
SRV - (PnkBstrA) – C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (nvUpdatusService) – C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (Creative Audio Engine Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (Creative ALchemy AL6 Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (IntuitUpdateService) – C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (CTAudSvcService) – C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (WcesComm) – C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (NVHDA) – C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (cpuz135) – C:\Windows\SysNative\drivers\cpuz135_x64.sys (CPUID)
DRV:64bit: - (sptd) – C:\Windows\SysNative\drivers\sptd.sys ()
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (DAdderFltr) – C:\Windows\SysNative\drivers\dadder.sys (Razer (Asia-Pacific) Pte Ltd)
DRV:64bit: - (vhidmini) – C:\Windows\SysNative\drivers\vHidDev.sys (Windows ® Win 7 DDK provider)
DRV:64bit: - (USBPNPA) – C:\Windows\SysNative\drivers\CM10864.sys (C-Media Electronics Inc)
DRV:64bit: - (xusb21) – C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (CYUSB) – C:\Windows\SysNative\drivers\CYUSB.sys (Cypress Semiconductor)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (usb_rndisx) – C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (xnacc) – C:\Windows\SysNative\drivers\xnacc.sys (Microsoft Corporation)
DRV:64bit: - (L1E) NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20) – C:\Windows\SysNative\drivers\L1E62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (netr28x) – C:\Windows\SysNative\drivers\netr28x.sys (Ralink Technology, Corp.)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (VIAHdAudAddService) – C:\Windows\SysNative\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV:64bit: - (AtiPcie) AMD PCI Express (3GIO) – C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (Ctafiltv) – C:\Windows\SysNative\drivers\Ctafiltv.sys (Creative Technology Ltd.)
DRV:64bit: - (TarFltr) – C:\Windows\SysNative\drivers\UsbFltr.sys (Razer USA Ltd.)
DRV:64bit: - (uisp) – C:\Windows\SysNative\drivers\usbicp.sys (Motorola)
DRV:64bit: - (MTsensor) – C:\Windows\SysNative\drivers\ASACPI.sys ()
DRV - (RivaTuner64) – C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys ()
DRV - (speedfan) – C:\Windows\SysWOW64\speedfan.sys (Almico Software)
DRV - (RTCore64) – C:\Program Files (x86)\MSI Afterburner\RTCore64.sys ()
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (uisp) – C:\Windows\SysWOW64\drivers\Usbicp.sys (Motorola)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?pc=Z045&form;=ZGAPHP
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 06 9B BB B0 BC ED CB 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 25 12 46 01 CA 5A 36 4E BE 8C D8 D9 FB 96 BC 61 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "gmail.com"
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:4.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: [removed]:1.0.53.2
FF - prefs.js..keyword.URL: "http://www.bing.com/search?pc=Z045&form;=ZGAADF&q;="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 63030
FF - prefs.js..network.proxy.type: 4


FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@fileplanet.com/fpdlm: C:\Program Files (x86)\Download Manager\npfpdlm.dll (IGN Entertainment)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Jeremy\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Jeremy\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Jeremy\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Jeremy\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/08/31 19:51:16 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/07/17 22:46:43 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\SoMud\scripts\mozilla
FF - HKEY_CURRENT_USER\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files (x86)\SoMud\scripts\mozilla

[2010/08/18 00:05:47 | 000,000,000 | —D | M] (No name found) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Extensions
[2010/08/18 00:05:47 | 000,000,000 | —D | M] (No name found) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Extensions\[removed]
[2011/08/18 21:15:20 | 000,000,000 | —D | M] (No name found) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\extensions
[2011/08/02 00:07:26 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/06/19 01:29:33 | 000,000,000 | —D | M] (XUL Cache) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\extensions\{c33c522d-462a-4e2b-a154-c421e4e002c0}
[2011/06/24 03:48:14 | 000,000,000 | —D | M] (Somoto Toolbar) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\extensions\{c3721e85-f0ac-4b7e-ae4c-3e738011dc9d}
[2011/08/18 21:15:20 | 000,000,000 | —D | M] (Battlefield Play4Free) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\extensions\[removed]
[2011/06/24 03:48:09 | 000,001,919 | —- | M] () – C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\searchplugins\bing-zugo.xml
[2011/05/06 19:41:16 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/03/30 22:54:48 | 000,000,000 | —D | M] (Skype extension) – C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/06/23 08:29:57 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/11/24 01:13:53 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/30 02:49:08 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/05/06 19:41:16 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\distribution\extensions
[2011/05/06 19:41:16 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/08/31 19:51:16 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010/11/12 19:53:06 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010/07/12 12:33:56 | 000,012,800 | —- | M] (Nullsoft, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2011/07/02 01:16:28 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2010/01/01 04:00:00 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml.old
[2011/06/24 03:48:17 | 000,002,280 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\search.xml

O1 HOSTS File: ([2011/09/01 20:16:56 | 000,000,098 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Somoto Toolbar) - {c3721e85-f0ac-4b7e-ae4c-3e738011dc9d} - C:\Program Files (x86)\somototoolbar\vmntemplateX.dll ()
O3 - HKLM\..\Toolbar: (Somoto Toolbar) - {c3721e85-f0ac-4b7e-ae4c-3e738011dc9d} - C:\Program Files (x86)\somototoolbar\vmntemplateX.dll ()
O4:64bit: - HKLM..\Run: [Cm108Sound] C:\Windows\Syswow64\cm108.dll (C-Media Corporation)
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [CtaMon] C:\Windows\SysWow64\CtaMon.dll (Creative Technology Ltd.)
O4 - HKLM..\Run: [DeathAdder] C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe ()
O4 - HKLM..\Run: [googletalk] C:\Program Files (x86)\Google\Google Talk\googletalk.exe (Google)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Tarantula] C:\Program Files (x86)\Razer\Tarantula\razerhid.exe (Razer USA Ltd.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKCU..\Run: [igndlm.exe] C:\Program Files (x86)\Download Manager\DLM.exe (IGN Entertainment)
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [Steam] D:\Steam\steam.exe (Valve Corporation)
O4 - Startup: C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zotac FireStorm.lnk = C:\Program Files (x86)\ZOTAC FireStorm\Firestorm.exe (ZOTAC Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {140E4DF8-9E14-4A34-9577-C77561ED7883} http://content.systemrequirementslab.com.s…ri_4.1.72.0.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.0.0)
O16 - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{67087C97-1605-497A-9AC3-F0168C5B764E}: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2009/10/26 12:45:39 | 000,779,496 | R— | M] (BioWare) - E:\autorun.exe – [ UDF ]
O32 - AutoRun File - [2009/10/26 17:21:41 | 000,000,054 | R— | M] () - E:\autorun.inf – [ UDF ]
O33 - MountPoints2\{7d40b73e-7f29-11df-b218-90e6ba88c177}\Shell - "" = AutoRun
O33 - MountPoints2\{7d40b73e-7f29-11df-b218-90e6ba88c177}\Shell\AutoRun\command - "" = G:\setup.exe
O33 - MountPoints2\{9c42d9a7-7e9d-11df-b12e-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{9c42d9a7-7e9d-11df-b12e-806e6f6e6963}\Shell\AutoRun\command - "" = E:\autorun.exe – [2009/10/26 12:45:39 | 000,779,496 | R— | M] (BioWare)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/09/01 20:16:05 | 000,000,000 | —D | C] – C:\_OTL
[2011/09/01 20:03:13 | 001,406,768 | —- | C] (Kaspersky Lab ZAO) – C:\Users\Jeremy\Desktop\TDSSKiller.exe
[2011/09/01 16:30:17 | 000,581,120 | —- | C] (OldTimer Tools) – C:\Users\Jeremy\Desktop\OTL.exe
[2011/09/01 16:29:08 | 001,916,416 | —- | C] (AVAST Software) – C:\Users\Jeremy\Desktop\aswMBR.exe
[2011/09/01 01:29:29 | 000,000,000 | —D | C] – C:\Program Files (x86)\Trend Micro
[2011/09/01 01:29:29 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011/09/01 00:17:46 | 000,041,272 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011/09/01 00:17:46 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/08/31 21:36:41 | 000,000,000 | -HSD | C] – C:\Windows\SysWow64\%APPDATA%
[2011/08/29 23:04:30 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Sony Creative Software Inc
[2011/08/29 22:48:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\SoulseekNS
[2011/08/29 22:48:13 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Soulseek NS
[2011/08/29 19:22:54 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\dvdcss
[2011/08/29 00:09:50 | 000,000,000 | —D | C] – C:\Users\Jeremy\Desktop\N7
[2011/08/25 13:26:49 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Local\THQ
[2011/08/24 17:45:54 | 000,000,000 | —D | C] – C:\Users\Jeremy\Documents\FOMM
[2011/08/24 02:15:26 | 000,000,000 | —D | C] – C:\Users\Jeremy\Desktop\G.E.C.K
[2011/08/23 23:23:01 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Local\FOMM
[2011/08/23 23:22:57 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fallout Mod Manager
[2011/08/23 23:22:56 | 000,000,000 | —D | C] – C:\Program Files (x86)\GeMM
[2011/08/21 20:49:01 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Origin
[2011/08/21 20:48:30 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Local\Origin
[2011/08/21 20:48:26 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
[2011/08/21 20:48:20 | 000,000,000 | —D | C] – C:\ProgramData\Origin
[2011/08/21 20:48:19 | 000,000,000 | —D | C] – C:\Program Files (x86)\Origin Games
[2011/08/21 20:48:19 | 000,000,000 | —D | C] – C:\ProgramData\Electronic Arts
[2011/08/21 20:48:14 | 000,000,000 | —D | C] – C:\Program Files (x86)\Origin
[2011/08/20 01:32:57 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Publish Providers
[2011/08/20 01:28:10 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
[2011/08/20 01:27:42 | 000,000,000 | —D | C] – C:\ProgramData\Sony
[2011/08/20 01:00:48 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Local\Sony
[2011/08/20 00:52:06 | 000,000,000 | —D | C] – C:\Program Files\Sony
[2011/08/20 00:52:06 | 000,000,000 | —D | C] – C:\Program Files (x86)\Sony
[2011/08/20 00:51:17 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Sony
[2011/08/19 20:24:07 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fraps
[2011/08/18 21:50:52 | 000,000,000 | —D | C] – C:\Users\Jeremy\Documents\Battlefield Play4Free
[2011/08/18 21:15:34 | 000,000,000 | —D | C] – C:\Program Files (x86)\EA Games
[2011/08/18 19:27:17 | 000,021,992 | —- | C] (CPUID) – C:\Windows\SysNative\drivers\cpuz135_x64.sys
[2011/08/18 19:27:17 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID
[2011/08/18 19:27:17 | 000,000,000 | —D | C] – C:\Program Files\CPUID
[2011/08/18 18:35:28 | 024,692,840 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcompiler.dll
[2011/08/18 18:35:28 | 022,470,248 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvoglv64.dll
[2011/08/18 18:35:28 | 017,193,576 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcompiler.dll
[2011/08/18 18:35:28 | 016,595,560 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvoglv32.dll
[2011/08/18 18:35:28 | 015,064,168 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvd3dumx.dll
[2011/08/18 18:35:28 | 012,636,776 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvd3dum.dll
[2011/08/18 18:35:28 | 008,355,944 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvwgf2umx.dll
[2011/08/18 18:35:28 | 007,254,632 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuda.dll
[2011/08/18 18:35:28 | 006,613,096 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvwgf2um.dll
[2011/08/18 18:35:28 | 005,404,776 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuda.dll
[2011/08/18 18:35:28 | 002,532,456 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvid.dll
[2011/08/18 18:35:28 | 002,391,656 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvid.dll
[2011/08/18 18:35:28 | 002,222,184 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvenc.dll
[2011/08/18 18:35:28 | 002,090,088 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvenc.dll
[2011/08/18 18:35:28 | 000,067,176 | —- | C] (Khronos Group) – C:\Windows\SysNative\OpenCL.dll
[2011/08/18 18:35:28 | 000,057,960 | —- | C] (Khronos Group) – C:\Windows\SysWow64\OpenCL.dll
[2011/08/18 18:00:12 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2011/08/18 18:00:12 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2011/08/14 07:43:47 | 000,000,000 | —D | C] – C:\Users\Jeremy\Desktop\New folder
[2011/08/09 23:42:38 | 000,199,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xmllite.dll
[2011/08/09 23:42:38 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\odbccu32.dll
[2011/08/09 23:42:38 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\odbccr32.dll
[2011/08/09 23:42:37 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\odbccu32.dll
[2011/08/09 23:42:37 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\odbccr32.dll
[2011/08/09 23:42:34 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2011/08/09 23:42:34 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2011/08/09 23:42:34 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2011/08/09 23:42:33 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2011/08/09 23:42:33 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2011/08/09 23:42:33 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2011/08/09 23:42:33 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2011/08/09 23:42:33 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2011/08/09 23:42:32 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2011/08/09 23:42:32 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2011/08/09 23:42:32 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2011/08/09 23:42:32 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2011/08/09 23:42:32 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2011/08/09 23:42:32 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2011/08/09 23:42:32 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2011/08/09 23:42:31 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2011/08/09 23:42:31 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2011/08/09 23:42:31 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2011/08/09 23:42:31 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2011/08/09 23:42:31 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2011/08/09 23:42:31 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2011/08/09 23:42:31 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2011/08/09 23:42:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2011/08/09 23:42:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2011/08/09 23:42:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2011/08/09 23:42:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2011/08/09 23:42:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2011/08/09 23:42:30 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2011/08/09 23:42:12 | 000,134,144 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2011/08/09 23:42:12 | 000,132,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2011/08/07 17:59:00 | 000,000,000 | —D | C] – C:\Users\Jeremy\Documents\Eidos
[2011/08/07 17:26:46 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Local\GRAW2
[2011/08/07 17:26:46 | 000,000,000 | —D | C] – C:\ProgramData\GRAW2
[2011/08/03 18:37:11 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MSI Afterburner
[2011/08/03 18:36:54 | 000,000,000 | —D | C] – C:\Program Files (x86)\MSI Afterburner
[2011/08/03 18:36:31 | 001,519,720 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvdispco64.dll
[2011/08/03 18:36:31 | 001,453,160 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvgenco64.dll
[2011/08/03 18:36:31 | 000,174,184 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\drivers\nvhda64v.sys
[2011/08/03 18:36:31 | 000,029,288 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvhdap64.dll
[2011/08/03 18:30:10 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition
[2011/08/03 18:30:09 | 000,000,000 | —D | C] – C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition
[2011/08/03 18:24:08 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZOTAC FireStorm
[2011/08/03 18:24:07 | 000,000,000 | —D | C] – C:\Program Files (x86)\ZOTAC FireStorm
[2011/08/03 17:46:48 | 002,412,136 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvapi.dll
[2011/08/03 17:46:48 | 000,011,240 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\drivers\nvBridge.kmd
[1 C:\Users\Jeremy\Desktop\*.tmp files -> C:\Users\Jeremy\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/09/01 20:18:07 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/09/01 20:17:55 | 3220,578,304 | -HS- | M] () – C:\hiberfil.sys
[2011/09/01 20:16:56 | 000,000,098 | —- | M] () – C:\Windows\SysNative\drivers\etc\Hosts
[2011/09/01 20:15:15 | 000,013,440 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/09/01 20:15:15 | 000,013,440 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/09/01 19:59:00 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2675488554-1281081424-3468828521-1000UA.job
[2011/09/01 16:30:34 | 000,000,860 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2675488554-1281081424-3468828521-1000Core.job
[2011/09/01 16:30:18 | 000,581,120 | —- | M] (OldTimer Tools) – C:\Users\Jeremy\Desktop\OTL.exe
[2011/09/01 16:29:49 | 000,000,512 | —- | M] () – C:\Users\Jeremy\Desktop\MBR.dat
[2011/09/01 16:29:11 | 001,916,416 | —- | M] (AVAST Software) – C:\Users\Jeremy\Desktop\aswMBR.exe
[2011/09/01 01:29:29 | 000,003,013 | —- | M] () – C:\Users\Jeremy\Desktop\HiJackThis.lnk
[2011/09/01 01:25:25 | 000,000,315 | —- | M] () – C:\Users\Jeremy\clear.reg
[2011/09/01 00:21:13 | 000,001,159 | —- | M] () – C:\Users\Jeremy\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/09/01 00:21:13 | 000,001,135 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/09/01 00:03:22 | 000,215,128 | —- | M] () – C:\Windows\SysWow64\PnkBstrB.xtr
[2011/09/01 00:03:22 | 000,215,128 | —- | M] () – C:\Windows\SysWow64\PnkBstrB.exe
[2011/08/31 23:59:09 | 000,092,398 | —- | M] () – C:\Users\Jeremy\Documents\cc_20110831_235904.reg
[2011/08/31 23:57:45 | 000,000,828 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2011/08/31 19:51:23 | 000,002,060 | —- | M] () – C:\Users\Jeremy\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/08/31 04:05:44 | 000,215,128 | —- | M] () – C:\Windows\SysWow64\PnkBstrB.ex0
[2011/08/29 20:13:06 | 000,015,440 | —- | M] () – C:\Users\Jeremy\Documents\FONV.veg
[2011/08/25 14:04:43 | 000,000,987 | —- | M] () – C:\Users\Public\Desktop\Origin.lnk
[2011/08/24 03:01:36 | 000,806,428 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2011/08/24 03:01:36 | 000,669,048 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2011/08/24 03:01:36 | 000,125,234 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2011/08/24 02:28:53 | 090,762,938 | —- | M] () – C:\Users\Jeremy\Desktop\NVWillow.rar
[2011/08/23 23:22:57 | 000,000,959 | —- | M] () – C:\Users\Jeremy\Desktop\Fallout Mod Manager.lnk
[2011/08/22 15:48:36 | 001,406,768 | —- | M] (Kaspersky Lab ZAO) – C:\Users\Jeremy\Desktop\TDSSKiller.exe
[2011/08/20 03:35:16 | 000,037,280 | —- | M] () – C:\Users\Jeremy\Documents\CHOPPER.veg
[2011/08/20 03:14:41 | 000,037,280 | —- | M] () – C:\Users\Jeremy\Documents\CHOPPER.veg.bak
[2011/08/20 01:28:13 | 000,001,046 | —- | M] () – C:\Users\Public\Desktop\Vegas Pro 10.0 (64-bit).lnk
[2011/08/19 20:24:07 | 000,000,566 | —- | M] () – C:\Users\Jeremy\Desktop\Fraps.lnk
[2011/08/18 22:05:53 | 000,075,136 | —- | M] () – C:\Windows\SysWow64\PnkBstrA.exe
[2011/08/18 19:27:17 | 000,000,934 | —- | M] () – C:\Users\Public\Desktop\CPUID HWMonitor.lnk
[2011/08/18 18:00:11 | 000,000,045 | —- | M] () – C:\Windows\SysWow64\initdebug.nfo
[2011/08/15 16:08:05 | 000,960,457 | —- | M] () – C:\Users\Jeremy\Desktop\mcpatcher-2.1.0_02.exe
[2011/08/14 06:40:22 | 002,337,865 | —- | M] () – C:\Windows\SysWow64\pbsvc.exe
[2011/08/14 05:35:12 | 000,000,881 | —- | M] () – C:\Users\Public\Desktop\Ventrilo.lnk
[2011/08/10 03:03:50 | 000,786,274 | —- | M] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/08/03 18:37:11 | 000,001,106 | —- | M] () – C:\Users\Jeremy\Desktop\MSI Afterburner.lnk
[2011/08/03 18:24:23 | 000,001,117 | —- | M] () – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zotac FireStorm.lnk
[2011/08/03 18:16:02 | 000,804,067 | —- | M] () – C:\Users\Jeremy\Desktop\NVWillow.esp
[2011/08/03 07:50:00 | 024,692,840 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcompiler.dll
[2011/08/03 07:50:00 | 022,470,248 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvoglv64.dll
[2011/08/03 07:50:00 | 017,193,576 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcompiler.dll
[2011/08/03 07:50:00 | 016,595,560 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvoglv32.dll
[2011/08/03 07:50:00 | 015,064,168 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvd3dumx.dll
[2011/08/03 07:50:00 | 012,636,776 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvd3dum.dll
[2011/08/03 07:50:00 | 008,355,944 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvwgf2umx.dll
[2011/08/03 07:50:00 | 007,254,632 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuda.dll
[2011/08/03 07:50:00 | 006,613,096 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvwgf2um.dll
[2011/08/03 07:50:00 | 006,136,936 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcpl.dll
[2011/08/03 07:50:00 | 005,404,776 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuda.dll
[2011/08/03 07:50:00 | 003,021,416 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvsvc64.dll
[2011/08/03 07:50:00 | 002,758,760 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvapi64.dll
[2011/08/03 07:50:00 | 002,532,456 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvid.dll
[2011/08/03 07:50:00 | 002,412,136 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvapi.dll
[2011/08/03 07:50:00 | 002,391,656 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvid.dll
[2011/08/03 07:50:00 | 002,222,184 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvenc.dll
[2011/08/03 07:50:00 | 002,090,088 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvenc.dll
[2011/08/03 07:50:00 | 001,519,720 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvdispco64.dll
[2011/08/03 07:50:00 | 000,836,200 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\easyUpdatusAPIU64.dll
[2011/08/03 07:50:00 | 000,117,864 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvmctray.dll
[2011/08/03 07:50:00 | 000,067,176 | —- | M] (Khronos Group) – C:\Windows\SysNative\OpenCL.dll
[2011/08/03 07:50:00 | 000,061,544 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvshext.dll
[2011/08/03 07:50:00 | 000,057,960 | —- | M] (Khronos Group) – C:\Windows\SysWow64\OpenCL.dll
[2011/08/03 07:50:00 | 000,007,383 | —- | M] () – C:\Windows\SysNative\nvinfo.pb
[2011/08/03 03:31:54 | 000,311,912 | —- | M] () – C:\Windows\SysWow64\nvStreaming.exe
[1 C:\Users\Jeremy\Desktop\*.tmp files -> C:\Users\Jeremy\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/09/01 16:29:49 | 000,000,512 | —- | C] () – C:\Users\Jeremy\Desktop\MBR.dat
[2011/09/01 01:29:29 | 000,003,013 | —- | C] () – C:\Users\Jeremy\Desktop\HiJackThis.lnk
[2011/09/01 01:25:25 | 000,000,315 | —- | C] () – C:\Users\Jeremy\clear.reg
[2011/09/01 00:17:47 | 000,001,159 | —- | C] () – C:\Users\Jeremy\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/09/01 00:17:47 | 000,001,135 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/31 23:59:05 | 000,092,398 | —- | C] () – C:\Users\Jeremy\Documents\cc_20110831_235904.reg
[2011/08/29 20:13:06 | 000,015,440 | —- | C] () – C:\Users\Jeremy\Documents\FONV.veg
[2011/08/24 02:26:03 | 090,762,938 | —- | C] () – C:\Users\Jeremy\Desktop\NVWillow.rar
[2011/08/24 02:25:41 | 000,804,067 | —- | C] () – C:\Users\Jeremy\Desktop\NVWillow.esp
[2011/08/23 23:22:57 | 000,000,959 | —- | C] () – C:\Users\Jeremy\Desktop\Fallout Mod Manager.lnk
[2011/08/21 20:48:26 | 000,000,987 | —- | C] () – C:\Users\Public\Desktop\Origin.lnk
[2011/08/20 03:14:41 | 000,037,280 | —- | C] () – C:\Users\Jeremy\Documents\CHOPPER.veg.bak
[2011/08/20 03:14:41 | 000,037,280 | —- | C] () – C:\Users\Jeremy\Documents\CHOPPER.veg
[2011/08/20 01:28:13 | 000,001,046 | —- | C] () – C:\Users\Public\Desktop\Vegas Pro 10.0 (64-bit).lnk
[2011/08/19 20:24:07 | 000,000,566 | —- | C] () – C:\Users\Jeremy\Desktop\Fraps.lnk
[2011/08/18 19:27:17 | 000,000,934 | —- | C] () – C:\Users\Public\Desktop\CPUID HWMonitor.lnk
[2011/08/18 18:00:11 | 000,000,045 | —- | C] () – C:\Windows\SysWow64\initdebug.nfo
[2011/08/15 16:08:02 | 000,960,457 | —- | C] () – C:\Users\Jeremy\Desktop\mcpatcher-2.1.0_02.exe
[2011/08/14 06:40:22 | 002,337,865 | —- | C] () – C:\Windows\SysWow64\pbsvc.exe
[2011/08/03 18:37:11 | 000,110,592 | —- | C] () – C:\Windows\SysNative\rtvcvfw32.dll
[2011/08/03 18:37:11 | 000,001,106 | —- | C] () – C:\Users\Jeremy\Desktop\MSI Afterburner.lnk
[2011/08/03 16:50:58 | 000,001,117 | —- | C] () – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zotac FireStorm.lnk
[2011/08/03 03:31:54 | 000,311,912 | —- | C] () – C:\Windows\SysWow64\nvStreaming.exe
[2011/07/31 18:21:03 | 000,114,776 | -H– | C] () – C:\Windows\SysWow64\mlfcache.dat
[2011/07/13 18:27:09 | 000,000,015 | —- | C] () – C:\Windows\Firestorm.INI
[2011/07/05 23:21:39 | 000,009,466 | —- | C] () – C:\Users\Jeremy\AppData\Roaming\254A.1A0
[2011/07/04 15:13:34 | 000,007,597 | —- | C] () – C:\Users\Jeremy\AppData\Local\Resmon.ResmonCfg
[2011/07/02 01:32:50 | 000,000,268 | —- | C] () – C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2011/06/19 23:26:08 | 000,000,060 | —- | C] () – C:\ProgramData\489cb03
[2011/04/09 18:55:28 | 000,179,261 | —- | C] () – C:\Windows\SysWow64\xlive.dll.cat
[2011/02/16 18:39:19 | 000,143,360 | —- | C] () – C:\Windows\Vmix108.dll
[2011/02/16 18:39:15 | 000,000,522 | —- | C] () – C:\Windows\Cm108.ini.cfl
[2011/02/16 18:38:41 | 000,001,159 | —- | C] () – C:\Windows\Cm108.ini.imi
[2011/02/16 18:38:40 | 000,002,029 | —- | C] () – C:\Windows\Cm108.ini.cfg
[2011/01/12 21:15:45 | 000,003,584 | —- | C] () – C:\Users\Jeremy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/02 14:56:56 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2010/09/09 04:29:19 | 000,000,056 | -H– | C] () – C:\Windows\SysWow64\ezsidmv.dat
[2010/09/08 13:13:32 | 000,000,094 | —- | C] () – C:\Users\Jeremy\AppData\Local\fusioncache.dat
[2010/09/08 13:08:10 | 000,786,274 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2010/08/05 17:46:27 | 000,215,128 | —- | C] () – C:\Windows\SysWow64\PnkBstrB.exe
[2010/06/26 03:47:37 | 002,444,656 | —- | C] () – C:\Windows\SysWow64\pbsvc_apb.exe
[2010/06/24 03:56:44 | 002,434,856 | —- | C] () – C:\Windows\SysWow64\pbsvc_bc2.exe
[2010/06/24 03:56:44 | 000,075,136 | —- | C] () – C:\Windows\SysWow64\PnkBstrA.exe
[2010/06/23 23:13:24 | 000,015,872 | —- | C] () – C:\Windows\AsTaskSched.dll
[2010/06/23 23:11:11 | 000,001,769 | —- | C] () – C:\Windows\Language_trs.ini
[2010/06/23 05:26:20 | 000,000,262 | —- | C] () – C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
[2010/06/23 05:25:10 | 000,001,515 | —- | C] () – C:\Windows\Ctacfg.ini
[2010/06/23 05:25:10 | 000,000,504 | —- | C] () – C:\Windows\CtaMCcfg.ini
[2010/06/23 05:23:24 | 000,148,480 | —- | C] () – C:\Windows\SysWow64\APOMngr.DLL
[2010/06/23 05:23:24 | 000,073,728 | —- | C] () – C:\Windows\SysWow64\CmdRtr.DLL
[2010/06/23 04:43:38 | 000,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2009/11/11 06:41:10 | 000,001,318 | —- | C] () – C:\Windows\cm108.ini
[2009/07/14 01:38:36 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | —- | C] () – C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | —- | C] () – C:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 19:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 17:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | —- | C] () – C:\Windows\SysWow64\mlang.dat

< End of report >
Post #9
  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.









Next

Run the following scan: Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.
Post #10
MBYTES Log: Malwarebytes' Anti-Malware 1.51.1.1800 www.malwarebytes.org Database version: 7625 Windows 6.1.7601 Service Pack 1 Internet Explorer 8.0.7601.17514 9/1/2011 1:13:37 AM mbam-log-2011-09-01 (01-13-37).txt Scan type: Quick scan Objects scanned: 205820 Time elapsed: 1 minute(s), 8 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\Windows\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
Post #11
ESET Log: ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=bb196d2152e05646b7123d9ea08cc983 # end=finished # remove_checked=true # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-09-02 02:25:28 # local_time=2011-09-01 10:25:28 (-0500, Eastern Daylight Time) # country="United States" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=5893 16776574 66 94 3889442 66468854 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=309635 # found=3 # cleaned=3 # scan_time=4924 C:\Users\Jeremy\AppData\Local\Google\Chrome\User Data\Default\Default\cdbdceiaicbjjgnofaenodhjnpjkpdkb\contentscript.js Win32/TrojanDownloader.Tracur.F trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\extensions\{c33c522d-462a-4e2b-a154-c421e4e002c0}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\extensions\{c33c522d-462a-4e2b-a154-c421e4e002c0}\chrome\xulcache.jar JS/Agent.NDB trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
Post #13
Seems to be running fine from what I gather. THe searches are no longer misdirected, and I can log into my e-mail account now.
OTL Log:
OTL logfile created on: 9/2/2011 4:39:08 PM - Run 3
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Users\Jeremy\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 74.99% Memory free
8.00 Gb Paging File | 6.53 Gb Available in Paging File | 81.62% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 113.20 Gb Total Space | 32.43 Gb Free Space | 28.65% Space Free | Partition Type: NTFS
Drive D: | 112.85 Gb Total Space | 0.95 Gb Free Space | 0.84% Space Free | Partition Type: NTFS
Drive E: | 2.68 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive F: | 465.64 Gb Total Space | 127.06 Gb Free Space | 27.29% Space Free | Partition Type: FAT32

Computer Name: MIDNA | User Name: Jeremy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Jeremy\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\PnkBstrB.exe ()
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - D:\Steam\Steam.exe (Valve Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\IObit\Game Booster\GameBooster.exe (IObit)
PRC - C:\Program Files (x86)\IObit\Game Booster\gbtray.exe (IObit)
PRC - C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe ()
PRC - C:\Program Files (x86)\Winamp\winamp.exe (Nullsoft, Inc.)
PRC - C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
PRC - C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe ()
PRC - C:\Program Files (x86)\Razer\DeathAdder\razertra.exe ()
PRC - C:\Program Files (x86)\ZOTAC FireStorm\Firestorm.exe (ZOTAC Ltd.)
PRC - C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
PRC - C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe (Razer Inc.)
PRC - C:\Program Files (x86)\Razer\Tarantula\razerhid.exe (Razer USA Ltd.)
PRC - C:\Program Files (x86)\Razer\Tarantula\razertra.exe ()


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - D:\Steam\bin\libcef.dll ()
MOD - D:\Steam\bin\avcodec-52.dll ()
MOD - D:\Steam\bin\chromehtml.dll ()
MOD - D:\Steam\bin\avformat-52.dll ()
MOD - D:\Steam\bin\avutil-50.dll ()
MOD - C:\Program Files (x86)\IObit\Game Booster\sqlite3.dll ()
MOD - C:\Program Files (x86)\IObit\Game Booster\PowerConfig.dll ()
MOD - C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe ()
MOD - C:\Program Files (x86)\MSI Afterburner\RTMUI.dll ()
MOD - C:\Program Files (x86)\MSI Afterburner\RTHAL.dll ()
MOD - C:\Program Files (x86)\MSI Afterburner\RTCore.dll ()
MOD - C:\Program Files (x86)\MSI Afterburner\RTUI.dll ()
MOD - C:\Program Files (x86)\MSI Afterburner\RTFC.dll ()
MOD - C:\Program Files (x86)\IObit\Game Booster\madExcept_.bpl ()
MOD - C:\Program Files (x86)\Winamp\System\jnetlib.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\aacPlusDecoder.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\auth.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\jpeg.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\xml.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\png.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\playlist.w5s ()
MOD - C:\Program Files (x86)\Winamp\tataki.dll ()
MOD - C:\Program Files (x86)\Winamp\zlib.dll ()
MOD - C:\Program Files (x86)\Winamp\System\timer.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\tagz.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\gif.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\bmp.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\dlmgr.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\gracenote.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\filereader.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\primo.w5s ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_local.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_pmp.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_disc.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_ipod.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_online.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_p4s.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_playlists.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_plg.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_impex.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_history.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_android.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\out_ds.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_usb.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_rg.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_transcode.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_activesync.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\out_disk.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_njb.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\out_wave.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_wm.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mp3.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_vorbis.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mod.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_midi.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_cdda.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_nsv.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_dshow.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_avi.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_flac.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mp4.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mkv.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_flv.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_autotag.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_bookmarks.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_swf.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_wave.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_linein.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_ff.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\freeform\wacs\freetype\freetype.wac ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_ml.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_jumpex.dll ()
MOD - C:\Program Files (x86)\Winamp\nde.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_orgler.dll ()
MOD - C:\Program Files (x86)\Winamp\nsutil.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_hotkeys.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_tray.dll ()
MOD - C:\Program Files (x86)\Winamp\libsndfile.dll ()
MOD - C:\Program Files (x86)\MSI Afterburner\RTTSH.dll ()
MOD - C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe ()
MOD - C:\Program Files (x86)\Razer\DeathAdder\razertra.exe ()
MOD - C:\Program Files (x86)\IObit\Game Booster\madbasic_.bpl ()
MOD - C:\Program Files (x86)\IObit\Game Booster\maddisAsm_.bpl ()
MOD - C:\Program Files (x86)\Razer\Tarantula\razertra.exe ()


========== Win32 Services (SafeList) ==========

SRV - (PnkBstrB) – C:\Windows\SysWOW64\PnkBstrB.exe ()
SRV - (PnkBstrA) – C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (nvUpdatusService) – C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (Creative Audio Engine Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (Creative ALchemy AL6 Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (IntuitUpdateService) – C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (CTAudSvcService) – C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (WcesComm) – C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (NVHDA) – C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (cpuz135) – C:\Windows\SysNative\drivers\cpuz135_x64.sys (CPUID)
DRV:64bit: - (sptd) – C:\Windows\SysNative\drivers\sptd.sys ()
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (DAdderFltr) – C:\Windows\SysNative\drivers\dadder.sys (Razer (Asia-Pacific) Pte Ltd)
DRV:64bit: - (vhidmini) – C:\Windows\SysNative\drivers\vHidDev.sys (Windows ® Win 7 DDK provider)
DRV:64bit: - (USBPNPA) – C:\Windows\SysNative\drivers\CM10864.sys (C-Media Electronics Inc)
DRV:64bit: - (xusb21) – C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (CYUSB) – C:\Windows\SysNative\drivers\CYUSB.sys (Cypress Semiconductor)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (usb_rndisx) – C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (xnacc) – C:\Windows\SysNative\drivers\xnacc.sys (Microsoft Corporation)
DRV:64bit: - (L1E) NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20) – C:\Windows\SysNative\drivers\L1E62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (netr28x) – C:\Windows\SysNative\drivers\netr28x.sys (Ralink Technology, Corp.)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (VIAHdAudAddService) – C:\Windows\SysNative\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV:64bit: - (AtiPcie) AMD PCI Express (3GIO) – C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (Ctafiltv) – C:\Windows\SysNative\drivers\Ctafiltv.sys (Creative Technology Ltd.)
DRV:64bit: - (TarFltr) – C:\Windows\SysNative\drivers\UsbFltr.sys (Razer USA Ltd.)
DRV:64bit: - (uisp) – C:\Windows\SysNative\drivers\usbicp.sys (Motorola)
DRV:64bit: - (MTsensor) – C:\Windows\SysNative\drivers\ASACPI.sys ()
DRV - (RivaTuner64) – C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys ()
DRV - (speedfan) – C:\Windows\SysWOW64\speedfan.sys (Almico Software)
DRV - (RTCore64) – C:\Program Files (x86)\MSI Afterburner\RTCore64.sys ()
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (uisp) – C:\Windows\SysWOW64\drivers\Usbicp.sys (Motorola)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?pc=Z045&form;=ZGAPHP
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 06 9B BB B0 BC ED CB 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 25 12 46 01 CA 5A 36 4E BE 8C D8 D9 FB 96 BC 61 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "gmail.com"
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:4.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: [removed]:1.0.53.2
FF - prefs.js..keyword.URL: "http://www.bing.com/search?pc=Z045&form;=ZGAADF&q;="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 63030
FF - prefs.js..network.proxy.type: 4


FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@fileplanet.com/fpdlm: C:\Program Files (x86)\Download Manager\npfpdlm.dll (IGN Entertainment)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Jeremy\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Jeremy\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Jeremy\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Jeremy\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/08/31 19:51:16 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/07/17 22:46:43 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\SoMud\scripts\mozilla
FF - HKEY_CURRENT_USER\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files (x86)\SoMud\scripts\mozilla

[2010/08/18 00:05:47 | 000,000,000 | —D | M] (No name found) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Extensions
[2010/08/18 00:05:47 | 000,000,000 | —D | M] (No name found) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Extensions\[removed]
[2011/08/18 21:15:20 | 000,000,000 | —D | M] (No name found) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\extensions
[2011/08/02 00:07:26 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/09/01 21:15:57 | 000,000,000 | —D | M] (XUL Cache) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\extensions\{c33c522d-462a-4e2b-a154-c421e4e002c0}
[2011/06/24 03:48:14 | 000,000,000 | —D | M] (Somoto Toolbar) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\extensions\{c3721e85-f0ac-4b7e-ae4c-3e738011dc9d}
[2011/08/18 21:15:20 | 000,000,000 | —D | M] (Battlefield Play4Free) – C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\extensions\[removed]
[2011/06/24 03:48:09 | 000,001,919 | —- | M] () – C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\1pyvcjpi.default\searchplugins\bing-zugo.xml
[2011/05/06 19:41:16 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/03/30 22:54:48 | 000,000,000 | —D | M] (Skype extension) – C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/06/23 08:29:57 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/11/24 01:13:53 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/30 02:49:08 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/05/06 19:41:16 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\distribution\extensions
[2011/05/06 19:41:16 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/08/31 19:51:16 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010/11/12 19:53:06 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010/07/12 12:33:56 | 000,012,800 | —- | M] (Nullsoft, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2011/07/02 01:16:28 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2010/01/01 04:00:00 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml.old
[2011/06/24 03:48:17 | 000,002,280 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\search.xml

O1 HOSTS File: ([2011/09/01 20:16:56 | 000,000,098 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Somoto Toolbar) - {c3721e85-f0ac-4b7e-ae4c-3e738011dc9d} - C:\Program Files (x86)\somototoolbar\vmntemplateX.dll ()
O3 - HKLM\..\Toolbar: (Somoto Toolbar) - {c3721e85-f0ac-4b7e-ae4c-3e738011dc9d} - C:\Program Files (x86)\somototoolbar\vmntemplateX.dll ()
O4:64bit: - HKLM..\Run: [Cm108Sound] C:\Windows\Syswow64\cm108.dll (C-Media Corporation)
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [CtaMon] C:\Windows\SysWow64\CtaMon.dll (Creative Technology Ltd.)
O4 - HKLM..\Run: [DeathAdder] C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe ()
O4 - HKLM..\Run: [googletalk] C:\Program Files (x86)\Google\Google Talk\googletalk.exe (Google)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Tarantula] C:\Program Files (x86)\Razer\Tarantula\razerhid.exe (Razer USA Ltd.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKCU..\Run: [igndlm.exe] C:\Program Files (x86)\Download Manager\DLM.exe (IGN Entertainment)
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [Steam] D:\Steam\steam.exe (Valve Corporation)
O4 - Startup: C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zotac FireStorm.lnk = C:\Program Files (x86)\ZOTAC FireStorm\Firestorm.exe (ZOTAC Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {140E4DF8-9E14-4A34-9577-C77561ED7883} http://content.systemrequirementslab.com.s…ri_4.1.72.0.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.0.0)
O16 - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{67087C97-1605-497A-9AC3-F0168C5B764E}: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2009/10/26 12:45:39 | 000,779,496 | R— | M] (BioWare) - E:\autorun.exe – [ UDF ]
O32 - AutoRun File - [2009/10/26 17:21:41 | 000,000,054 | R— | M] () - E:\autorun.inf – [ UDF ]
O33 - MountPoints2\{9c42d9a7-7e9d-11df-b12e-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{9c42d9a7-7e9d-11df-b12e-806e6f6e6963}\Shell\AutoRun\command - "" = E:\autorun.exe – [2009/10/26 12:45:39 | 000,779,496 | R— | M] (BioWare)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/09/01 22:44:39 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oblivion Mod Manager
[2011/09/01 22:33:08 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bethesda Softworks
[2011/09/01 22:32:05 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Local\Oblivion
[2011/09/01 20:58:06 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2011/09/01 20:16:05 | 000,000,000 | —D | C] – C:\_OTL
[2011/09/01 20:03:13 | 001,406,768 | —- | C] (Kaspersky Lab ZAO) – C:\Users\Jeremy\Desktop\TDSSKiller.exe
[2011/09/01 16:30:17 | 000,581,120 | —- | C] (OldTimer Tools) – C:\Users\Jeremy\Desktop\OTL.exe
[2011/09/01 16:29:08 | 001,916,416 | —- | C] (AVAST Software) – C:\Users\Jeremy\Desktop\aswMBR.exe
[2011/09/01 01:29:29 | 000,000,000 | —D | C] – C:\Program Files (x86)\Trend Micro
[2011/09/01 01:29:29 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011/09/01 00:17:46 | 000,041,272 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011/09/01 00:17:46 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/08/31 21:36:41 | 000,000,000 | -HSD | C] – C:\Windows\SysWow64\%APPDATA%
[2011/08/29 23:04:30 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Sony Creative Software Inc
[2011/08/29 22:48:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\SoulseekNS
[2011/08/29 22:48:13 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Soulseek NS
[2011/08/29 19:22:54 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\dvdcss
[2011/08/29 00:09:50 | 000,000,000 | —D | C] – C:\Users\Jeremy\Desktop\N7
[2011/08/25 13:26:49 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Local\THQ
[2011/08/24 17:45:54 | 000,000,000 | —D | C] – C:\Users\Jeremy\Documents\FOMM
[2011/08/24 02:15:26 | 000,000,000 | —D | C] – C:\Users\Jeremy\Desktop\G.E.C.K
[2011/08/23 23:23:01 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Local\FOMM
[2011/08/23 23:22:57 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fallout Mod Manager
[2011/08/23 23:22:56 | 000,000,000 | —D | C] – C:\Program Files (x86)\GeMM
[2011/08/21 20:49:01 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Origin
[2011/08/21 20:48:30 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Local\Origin
[2011/08/21 20:48:26 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
[2011/08/21 20:48:20 | 000,000,000 | —D | C] – C:\ProgramData\Origin
[2011/08/21 20:48:19 | 000,000,000 | —D | C] – C:\Program Files (x86)\Origin Games
[2011/08/21 20:48:19 | 000,000,000 | —D | C] – C:\ProgramData\Electronic Arts
[2011/08/21 20:48:14 | 000,000,000 | —D | C] – C:\Program Files (x86)\Origin
[2011/08/20 01:32:57 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Publish Providers
[2011/08/20 01:28:10 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
[2011/08/20 01:27:42 | 000,000,000 | —D | C] – C:\ProgramData\Sony
[2011/08/20 01:00:48 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Local\Sony
[2011/08/20 00:52:06 | 000,000,000 | —D | C] – C:\Program Files\Sony
[2011/08/20 00:52:06 | 000,000,000 | —D | C] – C:\Program Files (x86)\Sony
[2011/08/20 00:51:17 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Sony
[2011/08/19 20:24:07 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fraps
[2011/08/18 21:50:52 | 000,000,000 | —D | C] – C:\Users\Jeremy\Documents\Battlefield Play4Free
[2011/08/18 21:15:34 | 000,000,000 | —D | C] – C:\Program Files (x86)\EA Games
[2011/08/18 19:27:17 | 000,021,992 | —- | C] (CPUID) – C:\Windows\SysNative\drivers\cpuz135_x64.sys
[2011/08/18 19:27:17 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID
[2011/08/18 19:27:17 | 000,000,000 | —D | C] – C:\Program Files\CPUID
[2011/08/18 18:35:28 | 024,692,840 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcompiler.dll
[2011/08/18 18:35:28 | 022,470,248 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvoglv64.dll
[2011/08/18 18:35:28 | 017,193,576 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcompiler.dll
[2011/08/18 18:35:28 | 016,595,560 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvoglv32.dll
[2011/08/18 18:35:28 | 015,064,168 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvd3dumx.dll
[2011/08/18 18:35:28 | 012,636,776 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvd3dum.dll
[2011/08/18 18:35:28 | 008,355,944 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvwgf2umx.dll
[2011/08/18 18:35:28 | 007,254,632 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuda.dll
[2011/08/18 18:35:28 | 006,613,096 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvwgf2um.dll
[2011/08/18 18:35:28 | 005,404,776 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuda.dll
[2011/08/18 18:35:28 | 002,532,456 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvid.dll
[2011/08/18 18:35:28 | 002,391,656 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvid.dll
[2011/08/18 18:35:28 | 002,222,184 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvenc.dll
[2011/08/18 18:35:28 | 002,090,088 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvenc.dll
[2011/08/18 18:35:28 | 000,067,176 | —- | C] (Khronos Group) – C:\Windows\SysNative\OpenCL.dll
[2011/08/18 18:35:28 | 000,057,960 | —- | C] (Khronos Group) – C:\Windows\SysWow64\OpenCL.dll
[2011/08/18 18:00:12 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2011/08/18 18:00:12 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2011/08/14 07:43:47 | 000,000,000 | —D | C] – C:\Users\Jeremy\Desktop\New folder
[2011/08/09 23:42:38 | 000,199,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xmllite.dll
[2011/08/09 23:42:38 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\odbccu32.dll
[2011/08/09 23:42:38 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\odbccr32.dll
[2011/08/09 23:42:37 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\odbccu32.dll
[2011/08/09 23:42:37 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\odbccr32.dll
[2011/08/09 23:42:34 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2011/08/09 23:42:34 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2011/08/09 23:42:34 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2011/08/09 23:42:33 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2011/08/09 23:42:33 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2011/08/09 23:42:33 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2011/08/09 23:42:33 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2011/08/09 23:42:33 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2011/08/09 23:42:33 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2011/08/09 23:42:32 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2011/08/09 23:42:32 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2011/08/09 23:42:32 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2011/08/09 23:42:32 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2011/08/09 23:42:32 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2011/08/09 23:42:32 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2011/08/09 23:42:32 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2011/08/09 23:42:32 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2011/08/09 23:42:31 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2011/08/09 23:42:31 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2011/08/09 23:42:31 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2011/08/09 23:42:31 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2011/08/09 23:42:31 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2011/08/09 23:42:31 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2011/08/09 23:42:31 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2011/08/09 23:42:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2011/08/09 23:42:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2011/08/09 23:42:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2011/08/09 23:42:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2011/08/09 23:42:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2011/08/09 23:42:30 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2011/08/09 23:42:12 | 000,134,144 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2011/08/09 23:42:12 | 000,132,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2011/08/07 17:59:00 | 000,000,000 | —D | C] – C:\Users\Jeremy\Documents\Eidos
[2011/08/07 17:26:46 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Local\GRAW2
[2011/08/07 17:26:46 | 000,000,000 | —D | C] – C:\ProgramData\GRAW2
[2011/08/03 18:37:11 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MSI Afterburner
[2011/08/03 18:36:54 | 000,000,000 | —D | C] – C:\Program Files (x86)\MSI Afterburner
[2011/08/03 18:36:31 | 001,519,720 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvdispco64.dll
[2011/08/03 18:36:31 | 001,453,160 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvgenco64.dll
[2011/08/03 18:36:31 | 000,174,184 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\drivers\nvhda64v.sys
[2011/08/03 18:36:31 | 000,029,288 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvhdap64.dll
[2011/08/03 18:30:10 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition
[2011/08/03 18:30:09 | 000,000,000 | —D | C] – C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition
[2011/08/03 18:24:08 | 000,000,000 | —D | C] – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZOTAC FireStorm
[2011/08/03 18:24:07 | 000,000,000 | —D | C] – C:\Program Files (x86)\ZOTAC FireStorm
[2011/08/03 17:46:48 | 002,412,136 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvapi.dll
[2011/08/03 17:46:48 | 000,011,240 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\drivers\nvBridge.kmd
[1 C:\Users\Jeremy\Desktop\*.tmp files -> C:\Users\Jeremy\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/09/02 16:38:40 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2675488554-1281081424-3468828521-1000UA.job
[2011/09/02 16:38:33 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/09/02 16:38:33 | 000,000,860 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2675488554-1281081424-3468828521-1000Core.job
[2011/09/02 03:24:49 | 000,002,353 | —- | M] () – C:\Users\Jeremy\Desktop\Oric.Orinson.rtf
[2011/09/02 01:21:26 | 000,013,440 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/09/02 01:21:26 | 000,013,440 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/09/02 01:13:43 | 3220,578,304 | -HS- | M] () – C:\hiberfil.sys
[2011/09/02 01:05:15 | 000,000,023 | —- | M] () – C:\Windows\BlendSettings.ini
[2011/09/01 22:49:04 | 000,000,032 | —- | M] () – C:\Windows\CD_Start.INI
[2011/09/01 22:44:39 | 000,001,310 | —- | M] () – C:\Users\Jeremy\Application Data\Microsoft\Internet Explorer\Quick Launch\Oblivion Mod Manager.lnk
[2011/09/01 20:16:56 | 000,000,098 | —- | M] () – C:\Windows\SysNative\drivers\etc\Hosts
[2011/09/01 16:30:18 | 000,581,120 | —- | M] (OldTimer Tools) – C:\Users\Jeremy\Desktop\OTL.exe
[2011/09/01 16:29:11 | 001,916,416 | —- | M] (AVAST Software) – C:\Users\Jeremy\Desktop\aswMBR.exe
[2011/09/01 01:29:29 | 000,003,013 | —- | M] () – C:\Users\Jeremy\Desktop\HiJackThis.lnk
[2011/09/01 01:25:25 | 000,000,315 | —- | M] () – C:\Users\Jeremy\clear.reg
[2011/09/01 00:21:13 | 000,001,159 | —- | M] () – C:\Users\Jeremy\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/09/01 00:21:13 | 000,001,135 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/09/01 00:03:22 | 000,215,128 | —- | M] () – C:\Windows\SysWow64\PnkBstrB.xtr
[2011/09/01 00:03:22 | 000,215,128 | —- | M] () – C:\Windows\SysWow64\PnkBstrB.exe
[2011/08/31 23:59:09 | 000,092,398 | —- | M] () – C:\Users\Jeremy\Documents\cc_20110831_235904.reg
[2011/08/31 23:57:45 | 000,000,828 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2011/08/31 19:51:23 | 000,002,060 | —- | M] () – C:\Users\Jeremy\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/08/31 04:05:44 | 000,215,128 | —- | M] () – C:\Windows\SysWow64\PnkBstrB.ex0
[2011/08/29 20:13:06 | 000,015,440 | —- | M] () – C:\Users\Jeremy\Documents\FONV.veg
[2011/08/25 14:04:43 | 000,000,987 | —- | M] () – C:\Users\Public\Desktop\Origin.lnk
[2011/08/24 03:01:36 | 000,806,428 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2011/08/24 03:01:36 | 000,669,048 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2011/08/24 03:01:36 | 000,125,234 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2011/08/23 23:22:57 | 000,000,959 | —- | M] () – C:\Users\Jeremy\Desktop\Fallout Mod Manager.lnk
[2011/08/22 15:48:36 | 001,406,768 | —- | M] (Kaspersky Lab ZAO) – C:\Users\Jeremy\Desktop\TDSSKiller.exe
[2011/08/20 03:35:16 | 000,037,280 | —- | M] () – C:\Users\Jeremy\Documents\CHOPPER.veg
[2011/08/20 03:14:41 | 000,037,280 | —- | M] () – C:\Users\Jeremy\Documents\CHOPPER.veg.bak
[2011/08/20 01:28:13 | 000,001,046 | —- | M] () – C:\Users\Public\Desktop\Vegas Pro 10.0 (64-bit).lnk
[2011/08/19 20:24:07 | 000,000,566 | —- | M] () – C:\Users\Jeremy\Desktop\Fraps.lnk
[2011/08/18 22:05:53 | 000,075,136 | —- | M] () – C:\Windows\SysWow64\PnkBstrA.exe
[2011/08/18 19:27:17 | 000,000,934 | —- | M] () – C:\Users\Public\Desktop\CPUID HWMonitor.lnk
[2011/08/18 18:00:11 | 000,000,045 | —- | M] () – C:\Windows\SysWow64\initdebug.nfo
[2011/08/14 06:40:22 | 002,337,865 | —- | M] () – C:\Windows\SysWow64\pbsvc.exe
[2011/08/14 05:35:12 | 000,000,881 | —- | M] () – C:\Users\Public\Desktop\Ventrilo.lnk
[2011/08/10 03:03:50 | 000,786,274 | —- | M] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/08/03 18:37:11 | 000,001,106 | —- | M] () – C:\Users\Jeremy\Desktop\MSI Afterburner.lnk
[2011/08/03 18:24:23 | 000,001,117 | —- | M] () – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zotac FireStorm.lnk
[2011/08/03 18:16:02 | 000,804,067 | —- | M] () – C:\Users\Jeremy\Desktop\NVWillow.esp
[1 C:\Users\Jeremy\Desktop\*.tmp files -> C:\Users\Jeremy\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/09/02 03:24:48 | 000,002,353 | —- | C] () – C:\Users\Jeremy\Desktop\Oric.Orinson.rtf
[2011/09/01 23:27:18 | 000,000,023 | —- | C] () – C:\Windows\BlendSettings.ini
[2011/09/01 22:44:39 | 000,001,310 | —- | C] () – C:\Users\Jeremy\Application Data\Microsoft\Internet Explorer\Quick Launch\Oblivion Mod Manager.lnk
[2011/09/01 22:38:20 | 000,000,032 | —- | C] () – C:\Windows\CD_Start.INI
[2011/09/01 01:29:29 | 000,003,013 | —- | C] () – C:\Users\Jeremy\Desktop\HiJackThis.lnk
[2011/09/01 01:25:25 | 000,000,315 | —- | C] () – C:\Users\Jeremy\clear.reg
[2011/09/01 00:17:47 | 000,001,159 | —- | C] () – C:\Users\Jeremy\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/09/01 00:17:47 | 000,001,135 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/31 23:59:05 | 000,092,398 | —- | C] () – C:\Users\Jeremy\Documents\cc_20110831_235904.reg
[2011/08/29 20:13:06 | 000,015,440 | —- | C] () – C:\Users\Jeremy\Documents\FONV.veg
[2011/08/24 02:25:41 | 000,804,067 | —- | C] () – C:\Users\Jeremy\Desktop\NVWillow.esp
[2011/08/23 23:22:57 | 000,000,959 | —- | C] () – C:\Users\Jeremy\Desktop\Fallout Mod Manager.lnk
[2011/08/21 20:48:26 | 000,000,987 | —- | C] () – C:\Users\Public\Desktop\Origin.lnk
[2011/08/20 03:14:41 | 000,037,280 | —- | C] () – C:\Users\Jeremy\Documents\CHOPPER.veg.bak
[2011/08/20 03:14:41 | 000,037,280 | —- | C] () – C:\Users\Jeremy\Documents\CHOPPER.veg
[2011/08/20 01:28:13 | 000,001,046 | —- | C] () – C:\Users\Public\Desktop\Vegas Pro 10.0 (64-bit).lnk
[2011/08/19 20:24:07 | 000,000,566 | —- | C] () – C:\Users\Jeremy\Desktop\Fraps.lnk
[2011/08/18 19:27:17 | 000,000,934 | —- | C] () – C:\Users\Public\Desktop\CPUID HWMonitor.lnk
[2011/08/18 18:00:11 | 000,000,045 | —- | C] () – C:\Windows\SysWow64\initdebug.nfo
[2011/08/14 06:40:22 | 002,337,865 | —- | C] () – C:\Windows\SysWow64\pbsvc.exe
[2011/08/03 18:37:11 | 000,110,592 | —- | C] () – C:\Windows\SysNative\rtvcvfw32.dll
[2011/08/03 18:37:11 | 000,001,106 | —- | C] () – C:\Users\Jeremy\Desktop\MSI Afterburner.lnk
[2011/08/03 16:50:58 | 000,001,117 | —- | C] () – C:\Users\Jeremy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zotac FireStorm.lnk
[2011/08/03 03:31:54 | 000,311,912 | —- | C] () – C:\Windows\SysWow64\nvStreaming.exe
[2011/07/31 18:21:03 | 000,114,776 | -H– | C] () – C:\Windows\SysWow64\mlfcache.dat
[2011/07/13 18:27:09 | 000,000,015 | —- | C] () – C:\Windows\Firestorm.INI
[2011/07/05 23:21:39 | 000,009,466 | —- | C] () – C:\Users\Jeremy\AppData\Roaming\254A.1A0
[2011/07/04 15:13:34 | 000,007,597 | —- | C] () – C:\Users\Jeremy\AppData\Local\Resmon.ResmonCfg
[2011/07/02 01:32:50 | 000,000,268 | —- | C] () – C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2011/04/09 18:55:28 | 000,179,261 | —- | C] () – C:\Windows\SysWow64\xlive.dll.cat
[2011/02/16 18:39:19 | 000,143,360 | —- | C] () – C:\Windows\Vmix108.dll
[2011/02/16 18:39:15 | 000,000,522 | —- | C] () – C:\Windows\Cm108.ini.cfl
[2011/02/16 18:38:41 | 000,001,159 | —- | C] () – C:\Windows\Cm108.ini.imi
[2011/02/16 18:38:40 | 000,002,029 | —- | C] () – C:\Windows\Cm108.ini.cfg
[2011/01/12 21:15:45 | 000,003,584 | —- | C] () – C:\Users\Jeremy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/02 14:56:56 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2010/09/09 04:29:19 | 000,000,056 | -H– | C] () – C:\Windows\SysWow64\ezsidmv.dat
[2010/09/08 13:13:32 | 000,000,094 | —- | C] () – C:\Users\Jeremy\AppData\Local\fusioncache.dat
[2010/09/08 13:08:10 | 000,786,274 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2010/08/05 17:46:27 | 000,215,128 | —- | C] () – C:\Windows\SysWow64\PnkBstrB.exe
[2010/06/26 03:47:37 | 002,444,656 | —- | C] () – C:\Windows\SysWow64\pbsvc_apb.exe
[2010/06/24 03:56:44 | 002,434,856 | —- | C] () – C:\Windows\SysWow64\pbsvc_bc2.exe
[2010/06/24 03:56:44 | 000,075,136 | —- | C] () – C:\Windows\SysWow64\PnkBstrA.exe
[2010/06/23 23:13:24 | 000,015,872 | —- | C] () – C:\Windows\AsTaskSched.dll
[2010/06/23 23:11:11 | 000,001,769 | —- | C] () – C:\Windows\Language_trs.ini
[2010/06/23 05:26:20 | 000,000,262 | —- | C] () – C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
[2010/06/23 05:25:10 | 000,001,515 | —- | C] () – C:\Windows\Ctacfg.ini
[2010/06/23 05:25:10 | 000,000,504 | —- | C] () – C:\Windows\CtaMCcfg.ini
[2010/06/23 05:23:24 | 000,148,480 | —- | C] () – C:\Windows\SysWow64\APOMngr.DLL
[2010/06/23 05:23:24 | 000,073,728 | —- | C] () – C:\Windows\SysWow64\CmdRtr.DLL
[2010/06/23 04:43:38 | 000,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2009/11/11 06:41:10 | 000,001,318 | —- | C] () – C:\Windows\cm108.ini
[2009/07/14 01:38:36 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | —- | C] () – C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | —- | C] () – C:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 19:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 17:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | —- | C] () – C:\Windows\SysWow64\mlang.dat

< End of report >
Post #14
You appear clean of infections,please do the following.



Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.









Clean out your temp files.
Download Attribune's ATF Cleaner and save to your desktop.
Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.










Here are some recommendations to help you stay clean.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/



Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.

please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:
  • Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.


Thats it you are good to go.Safe surfing
Post #15
Thanks a plenty man. It's good having people like you to help with these kind of problems. I'll also use your advice on protecting my system from further attacks. You've been great. :notworthy:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI