Spyware / Malware / Virus Removal

3 different trojans and PING.exe process using 100% CPU

5 min read

Looking for the outcome? Ask AI

naturegrl55 Topic Starter

Post #1September 9, 2011, 11:20 PM UTC

Hey, so mine and my boyfriends computer has been running a little slow lately and has also crashed twice this week causing the computer to take a long time to go through start up repair and the first tiime we had to restore the computer to factory settings(i don't think it was a reformat as we didn't have the windows os disc). Both times the computer crashed was right after we tried to install windows updates, and when the computer finally starts up, the same updates are still there to be downloaded. I did a full virus scan using microsoft security essentials, which only showed one infection which was Trojan.Hiloti and I quaratined and removed it but I started noticing in the task manager that the process PING *32.exe is running sometimes at 1,000,000 K and using 100% of my CPU. I downloaded malwarebytes anti malware and it found 3 infections called Trojan.Hiloti, Trojan.LVBP and Trojan.Agent

I quarantined them and it said it removed them but theyre still in the quarantine? I'm using a trial of malwarebytes and the real time protection keeps telling me that access to a potentially malicious website was blocked and the process is ping.exe
Anywho, here's a hijackthis log

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:17:41 PM, on 09/09/2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe
C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
C:\Windows\PLFSetI.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
C:\Program Files (x86)\Launch Manager\LManager.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Launch Manager\LMworker.exe
C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…44z1i5t46n2l272
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…44z1i5t46n2l272
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…44z1i5t46n2l272
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…44z1i5t46n2l272
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll
O2 - BHO: Partner BHO Class - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SuiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"
O4 - HKLM\..\Run: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
O4 - HKLM\..\Run: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
O4 - HKLM\..\Run: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - (no file)
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - (no file)
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: Microsoft.NET Framework KernelSecurity x2.0b (.Net bKernelSecurity) - Unknown owner - C:\Windows\system32\bKernelSecurity.exe (file missing)
O23 - Service: Microsoft.NET Framework SecurityCrypt x2.0b (.Net bSecurityCrypt) - Unknown owner - C:\Windows\system32\bSecurityCrypt.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: CNG Key Isolation Service (CNGKeyLock) - Unknown owner - c:\windows\system32\CNGKeyLock.exe (file missing)
O23 - Service: Dritek WMI Service (DsiWMIService) - Dritek System Inc. - C:\Program Files (x86)\Launch Manager\dsiwmis.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\Acer Games\Acer Game Console\GameConsoleService.exe
O23 - Service: GREGService - Acer Incorporated - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: MicrosoftHardwareDriver - Unknown owner - c:\windows\SysWOW64\sysDriverHardWare.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: MyWinLocker Service (MWLService) - Egis Technology Inc. - C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Norton PC Checkup Application Launcher - Symantec Corporation - C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\SymcPCCULaunchSvc.exe
O23 - Service: NTI IScheduleSvc - NewTech Infosystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - NewTech Infosystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: Partner Service - Google Inc. - C:\ProgramData\Partner\Partner.exe
O23 - Service: Common Client Job Manager Service (PCCUJobMgr) - Symantec Corporation - C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Spybot S&D 2 Live Protection Service (SDHookService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookSvc.exe
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: SysCacheDriver - Unknown owner - c:\windows\SysWOW64\sysSecurityCheck.exe (file missing)
O23 - Service: SystemWindows (systemCheck) - Unknown owner - c:\windows\SysWOW64\servicescache.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Updater Service - Acer Group - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 13534 bytes

mowman

Post #2September 10, 2011, 9:02 PM UTC

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post

Download aswMBR.exe ( 511KB ) to your desktop.
Double click the aswMBR.exe to run it
Click the Scan button to start scan
On completion of the scan click Save Log, save it to your Desktop and post in your next reply

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

naturegrl55

Post #3September 11, 2011, 10:26 AM UTC

thx for the reply, just wanted to leave a quick note that i'm doing the scan as we speak!

naturegrl55

Post #4September 11, 2011, 11:03 AM UTC

thanks so much again here are the logs

aswMBR log

aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-09-11 03:21:20
—————————–
03:21:20.936 OS Version: Windows x64 6.1.7601 Service Pack 1
03:21:20.936 Number of processors: 1 586 0x603
03:21:20.936 ComputerName: ESY-PC UserName: Esy
03:21:31.061 Initialize success
03:26:55.656 AVAST engine defs: 11091100
03:28:22.689 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
03:28:22.689 Disk 0 Vendor: Hitachi_HTS545025B9A300 PB2OC60F Size: 238475MB BusType: 11
03:28:22.689 Device \Driver\atapi -> MajorFunction fffffa80031106c0
03:28:24.732 Disk 0 MBR read successfully
03:28:24.732 Disk 0 MBR scan
03:28:24.748 Disk 0 MBR:Alureon-G [Rtk]
03:28:24.748 Disk 0 TDL4@MBR code has been found
03:28:24.764 Disk 0 MBR hidden
03:28:24.764 Disk 0 MBR [TDL4] **ROOTKIT**
03:28:24.764 Disk 0 trace - called modules:
03:28:24.764 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0xfffffa80031106c0]<<
03:28:24.779 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80030a61f0]
03:28:24.779 3 CLASSPNP.SYS[fffff8800160143f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa800306d060]
03:28:25.294 \Driver\atapi[0xfffffa8003087160] -> IRP_MJ_CREATE -> 0xfffffa80031106c0
03:28:26.027 AVAST engine scan C:\Windows
03:28:29.147 AVAST engine scan C:\Windows\system32
03:31:06.427 AVAST engine scan C:\Windows\system32\drivers
03:31:18.798 AVAST engine scan C:\Users\Esy
03:33:14.698 AVAST engine scan C:\ProgramData
03:33:53.183 Scan finished successfully
03:35:51.698 Disk 0 MBR has been saved successfully to "C:\Users\Esy\Desktop\MBR.dat"
03:35:51.707 The log file has been saved successfully to "C:\Users\Esy\Desktop\aswMBR.txt"

OTL logs

(otl text)

OTL logfile created on: 11/09/2011 3:38:11 AM - Run 1
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Users\Esy\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

2.75 Gb Total Physical Memory | 1.56 Gb Available Physical Memory | 56.75% Memory free
5.49 Gb Paging File | 3.58 Gb Available in Paging File | 65.17% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 232.88 Gb Total Space | 93.74 Gb Free Space | 40.25% Space Free | Partition Type: NTFS

Computer Name: ESY-PC | User Name: Esy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Esy\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\SymcPCCULaunchSvc.exe (Symantec Corporation)
PRC - C:\Windows\PLFSetI.exe ()
PRC - C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.)
PRC - C:\Program Files (x86)\Launch Manager\LMworker.exe (Dritek System Inc.)
PRC - C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer Group)
PRC - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.)
PRC - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
PRC - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Acer Incorporated)
PRC - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
PRC - C:\Windows\SysWOW64\PING.EXE (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Steam\bin\libcef.dll ()
MOD - C:\Program Files (x86)\Steam\bin\avcodec-52.dll ()
MOD - C:\Program Files (x86)\Steam\bin\chromehtml.dll ()
MOD - C:\Program Files (x86)\Steam\bin\avformat-52.dll ()
MOD - C:\Program Files (x86)\Steam\bin\avutil-50.dll ()
MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\JSDialogPack150.bpl ()
MOD - C:\Windows\PLFSetI.exe ()
MOD - C:\Program Files (x86)\Launch Manager\CdDirIo.dll ()
MOD - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll ()

========== Win32 Services (SafeList) ==========

SRV:64bit: - (.Net bKernelMain) – C:\Windows\SysNative\bKernelMain.exe ()
SRV:64bit: - (.Net bSecurityCrypt) – C:\Windows\SysNative\bSecurityCrypt.exe ()
SRV:64bit: - (.Net bKernelSecurity) – C:\Windows\SysNative\bKernelSecurity.exe ()
SRV:64bit: - (ePowerSvc) – C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated)
SRV:64bit: - (NisSrv) – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (Updater Service) – C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer Group)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (SDHookService) – C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookSvc.exe (Safer-Networking Ltd.)
SRV - (SDWSCService) – C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.)
SRV - (SDUpdateService) – C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.)
SRV - (SDScannerService) – C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (PCCUJobMgr) – C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe (Symantec Corporation)
SRV - (Norton PC Checkup Application Launcher) – C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\SymcPCCULaunchSvc.exe (Symantec Corporation)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (DsiWMIService) – C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.)
SRV - (Partner Service) – C:\ProgramData\Partner\Partner.exe (Google Inc.)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (NTI IScheduleSvc) – C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.)
SRV - (MWLService) – C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe (Egis Technology Inc.)
SRV - (GREGService) – C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Acer Incorporated)
SRV - (GameConsoleService) – C:\Program Files (x86)\Acer Games\Acer Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (bapcmci) – C:\Windows\SysNative\Drivers\bapcmci64.sys ()
DRV:64bit: - (bpcrasys) – C:\Windows\SysNative\Drivers\bpcrasys64.sys ()
DRV:64bit: - (bakerneldrv) – C:\Windows\SysNative\Drivers\bakerneldrv64.sys ()
DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (SCDEmu) – C:\Windows\SysNative\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV:64bit: - (dc3d) – C:\Windows\SysNative\drivers\dc3d.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (usbfilter) – C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)
DRV:64bit: - (NisDrv) – C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (RTHDMIAzAudService) – C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (k57nd60a) Broadcom NetLink ™ – C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atipmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (AtiPcie) AMD PCI Express (3GIO) – C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (NTIDrvr) – C:\Windows\SysNative\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV:64bit: - (UBHelper) – C:\Windows\SysNative\drivers\UBHelper.sys (NewTech Infosystems Corporation)
DRV:64bit: - (RSUSBSTOR) – C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (BCM43XX) – C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (mwlPSDVDisk) – C:\Windows\SysNative\drivers\mwlPSDVDisk.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDFilter) – C:\Windows\SysNative\drivers\mwlPSDFilter.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDNServ) – C:\Windows\SysNative\drivers\mwlPSDNserv.sys (Egis Technology Inc.)
DRV - (SDHookDriver) – C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookDrv64.sys ()
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…44z1i5t46n2l272
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…44z1i5t46n2l272
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…44z1i5t46n2l272
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…44z1i5t46n2l272

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…44z1i5t46n2l272
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…44z1i5t46n2l272
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60129.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/09/06 22:37:04 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2011/09/06 22:37:39 | 000,000,000 | —D | M] (No name found) – C:\Users\Esy\AppData\Roaming\mozilla\Extensions
[2011/09/07 09:22:28 | 000,000,000 | —D | M] (No name found) – C:\Users\Esy\AppData\Roaming\mozilla\Firefox\Profiles\n5jrdjxn.default\extensions
[2011/09/07 09:22:28 | 000,000,000 | —D | M] (WOT) – C:\Users\Esy\AppData\Roaming\mozilla\Firefox\Profiles\n5jrdjxn.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2011/09/06 22:37:04 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
() (No name found) – C:\USERS\ESY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\N5JRDJXN.DEFAULT\EXTENSIONS\{197573FA-9BF9-11DF-9D68-A441DFD72085}.XPI
[2011/09/02 23:01:45 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/09/02 16:25:59 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

Hosts file not found
O2:64bit: - BHO: (no name) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No CLSID value found.
O2:64bit: - BHO: (Partner BHO Class) - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg64.dll (Google Inc.)
O2:64bit: - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - No CLSID value found.
O2 - BHO: (no name) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O2 - BHO: (Partner BHO Class) - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [EgisUpdate] C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SDTray] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{205253D9-B0F2-46BE-B8C1-00D0A94B7D06}: DhcpNameServer = 10.110.15.1 10.110.15.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8ED535B8-6CC5-4FF6-857F-BBA7941983CA}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - Reg Error: Key error. File not found
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\SDWinLogon: DllName - SDWinLogon.dll - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\Launch.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\blank.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\MoWAS_Setup.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\AppData\Local\Temporary Internet Files
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\Templates
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\Start Menu
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\SendTo
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\Recent
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\PrintHood
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\NetHood
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\Documents\My Videos
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\Documents\My Pictures
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\Documents\My Music
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\My Documents
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\Local Settings
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\AppData\Local\History
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\Cookies
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\Application Data
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\AppData\Local\Application Data
[2011/09/11 03:36:17 | 000,581,120 | —- | C] (OldTimer Tools) – C:\Users\Esy\Desktop\OTL.exe
[2011/09/11 03:20:14 | 001,916,416 | —- | C] (AVAST Software) – C:\Users\Esy\Desktop\aswMBR.exe
[2011/09/10 13:09:03 | 000,000,000 | —D | C] – C:\Windows\SysWow64\URTTEMP
[2011/09/10 12:22:55 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SEGA
[2011/09/10 12:22:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\SEGA
[2011/09/09 14:54:35 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011/09/09 14:54:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\Trend Micro
[2011/09/09 06:55:51 | 000,000,000 | —D | C] – C:\ProgramData\Blizzard Entertainment
[2011/09/09 04:32:33 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\Malwarebytes
[2011/09/09 04:32:17 | 000,041,272 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011/09/09 04:32:17 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/09/09 04:32:14 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/09/09 04:32:06 | 000,025,912 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2011/09/09 04:32:05 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011/09/09 03:23:12 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
[2011/09/09 02:06:25 | 000,000,000 | —D | C] – C:\Users\Public\Documents\Blizzard Entertainment
[2011/09/09 00:49:54 | 000,000,000 | —D | C] – C:\ProgramData\Blizzard
[2011/09/08 22:02:44 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Blizzard Entertainment
[2011/09/08 21:50:47 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\Tific
[2011/09/08 21:50:47 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Local\Tific
[2011/09/08 21:49:39 | 000,000,000 | —D | C] – C:\Windows\SysNative\drivers\NortonPCCheckupx64
[2011/09/08 21:49:39 | 000,000,000 | —D | C] – C:\Windows\SysNative\drivers\NortonPCCheckupx64\02000C0.01B
[2011/09/08 21:49:37 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton PC Checkup
[2011/09/08 21:49:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Norton PC Checkup
[2011/09/08 20:00:02 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\1C Company
[2011/09/08 19:50:28 | 000,000,000 | —D | C] – C:\Program Files (x86)\1C Company
[2011/09/08 18:25:34 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
[2011/09/08 17:49:17 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\The Creative Assembly
[2011/09/08 17:48:01 | 000,527,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAudio2_7.dll
[2011/09/08 17:48:01 | 000,518,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAudio2_7.dll
[2011/09/08 17:48:01 | 000,077,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAPOFX1_5.dll
[2011/09/08 17:48:01 | 000,074,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAPOFX1_5.dll
[2011/09/08 17:47:58 | 000,239,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine3_7.dll
[2011/09/08 17:47:58 | 000,176,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine3_7.dll
[2011/09/08 17:47:57 | 002,526,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_43.dll
[2011/09/08 17:47:57 | 002,106,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_43.dll
[2011/09/08 17:47:57 | 001,907,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dcsx_43.dll
[2011/09/08 17:47:57 | 001,868,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dcsx_43.dll
[2011/09/08 17:47:56 | 000,276,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx11_43.dll
[2011/09/08 17:47:56 | 000,248,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx11_43.dll
[2011/09/08 17:47:55 | 000,511,328 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_43.dll
[2011/09/08 17:47:55 | 000,470,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_43.dll
[2011/09/08 17:47:52 | 002,401,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX9_43.dll
[2011/09/08 17:47:52 | 001,998,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DX9_43.dll
[2011/09/08 17:47:50 | 000,530,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAudio2_6.dll
[2011/09/08 17:47:50 | 000,528,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAudio2_6.dll
[2011/09/08 17:47:50 | 000,078,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAPOFX1_4.dll
[2011/09/08 17:47:50 | 000,074,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAPOFX1_4.dll
[2011/09/08 17:47:48 | 000,238,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine3_6.dll
[2011/09/08 17:47:48 | 000,176,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine3_6.dll
[2011/09/08 17:47:46 | 000,024,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\X3DAudio1_7.dll
[2011/09/08 17:47:46 | 000,022,360 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\X3DAudio1_7.dll
[2011/09/08 17:47:44 | 000,517,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAudio2_5.dll
[2011/09/08 17:47:43 | 000,238,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine3_5.dll
[2011/09/08 17:47:43 | 000,176,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine3_5.dll
[2011/09/08 17:47:42 | 002,582,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_42.dll
[2011/09/08 17:47:42 | 001,974,616 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_42.dll
[2011/09/08 17:47:41 | 005,554,512 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dcsx_42.dll
[2011/09/08 17:47:41 | 005,501,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dcsx_42.dll
[2011/09/08 17:47:38 | 000,285,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx11_42.dll
[2011/09/08 17:47:38 | 000,235,344 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx11_42.dll
[2011/09/08 17:47:35 | 002,475,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX9_42.dll
[2011/09/08 17:47:35 | 001,892,184 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DX9_42.dll
[2011/09/08 17:47:33 | 002,430,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_41.dll
[2011/09/08 17:47:33 | 000,520,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_41.dll
[2011/09/08 17:47:31 | 005,425,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX9_41.dll
[2011/09/08 17:47:31 | 004,178,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DX9_41.dll
[2011/09/08 17:47:24 | 000,521,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAudio2_4.dll
[2011/09/08 17:47:24 | 000,517,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAudio2_4.dll
[2011/09/08 17:47:24 | 000,073,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAPOFX1_3.dll
[2011/09/08 17:47:22 | 000,235,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine3_4.dll
[2011/09/08 17:47:22 | 000,174,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine3_4.dll
[2011/09/08 17:47:21 | 000,024,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\X3DAudio1_6.dll
[2011/09/08 17:47:21 | 000,022,360 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\X3DAudio1_6.dll
[2011/09/08 17:47:20 | 002,605,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_40.dll
[2011/09/08 17:47:20 | 002,036,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_40.dll
[2011/09/08 17:47:20 | 000,519,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_40.dll
[2011/09/08 17:47:20 | 000,452,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_40.dll
[2011/09/08 17:47:18 | 005,631,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX9_40.dll
[2011/09/08 17:47:18 | 004,379,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DX9_40.dll
[2011/09/08 17:47:17 | 000,518,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAudio2_3.dll
[2011/09/08 17:47:17 | 000,514,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAudio2_3.dll
[2011/09/08 17:47:17 | 000,074,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAPOFX1_2.dll
[2011/09/08 17:47:17 | 000,070,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAPOFX1_2.dll
[2011/09/08 17:47:16 | 000,235,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine3_3.dll
[2011/09/08 17:47:16 | 000,175,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine3_3.dll
[2011/09/08 17:47:14 | 000,025,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\X3DAudio1_5.dll
[2011/09/08 17:47:14 | 000,023,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\X3DAudio1_5.dll
[2011/09/08 17:47:12 | 000,513,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAudio2_2.dll
[2011/09/08 17:47:12 | 000,509,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAudio2_2.dll
[2011/09/08 17:47:12 | 000,072,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAPOFX1_1.dll
[2011/09/08 17:47:12 | 000,068,616 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAPOFX1_1.dll
[2011/09/08 17:47:10 | 000,238,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine3_2.dll
[2011/09/08 17:47:10 | 000,177,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine3_2.dll
[2011/09/08 17:47:08 | 001,942,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_39.dll
[2011/09/08 17:47:08 | 001,493,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_39.dll
[2011/09/08 17:47:08 | 000,540,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_39.dll
[2011/09/08 17:47:08 | 000,467,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_39.dll
[2011/09/08 17:47:06 | 004,992,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX9_39.dll
[2011/09/08 17:47:06 | 003,851,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DX9_39.dll
[2011/09/08 17:46:57 | 000,511,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAudio2_1.dll
[2011/09/08 17:46:57 | 000,507,400 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAudio2_1.dll
[2011/09/08 17:46:57 | 000,068,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAPOFX1_0.dll
[2011/09/08 17:46:57 | 000,065,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAPOFX1_0.dll
[2011/09/08 17:46:53 | 000,238,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine3_1.dll
[2011/09/08 17:46:53 | 000,177,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine3_1.dll
[2011/09/08 17:46:50 | 000,028,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\X3DAudio1_4.dll
[2011/09/08 17:46:50 | 000,025,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\X3DAudio1_4.dll
[2011/09/08 17:46:48 | 001,941,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_38.dll
[2011/09/08 17:46:48 | 001,491,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_38.dll
[2011/09/08 17:46:48 | 000,540,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_38.dll
[2011/09/08 17:46:48 | 000,467,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_38.dll
[2011/09/08 17:46:46 | 004,991,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX9_38.dll
[2011/09/08 17:46:46 | 003,850,760 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DX9_38.dll
[2011/09/08 17:46:42 | 000,489,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAudio2_0.dll
[2011/09/08 17:46:42 | 000,479,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAudio2_0.dll
[2011/09/08 17:46:40 | 000,238,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine3_0.dll
[2011/09/08 17:46:40 | 000,177,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine3_0.dll
[2011/09/08 17:46:40 | 000,028,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\X3DAudio1_3.dll
[2011/09/08 17:46:40 | 000,025,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\X3DAudio1_3.dll
[2011/09/08 17:46:38 | 001,860,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_37.dll
[2011/09/08 17:46:38 | 001,420,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_37.dll
[2011/09/08 17:46:38 | 000,529,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_37.dll
[2011/09/08 17:46:38 | 000,462,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_37.dll
[2011/09/08 17:46:35 | 004,910,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX9_37.dll
[2011/09/08 17:46:35 | 003,786,760 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DX9_37.dll
[2011/09/08 17:46:31 | 000,411,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_10.dll
[2011/09/08 17:46:31 | 000,267,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_10.dll
[2011/09/08 17:46:28 | 002,006,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_36.dll
[2011/09/08 17:46:28 | 001,374,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_36.dll
[2011/09/08 17:46:28 | 000,508,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_36.dll
[2011/09/08 17:46:28 | 000,444,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_36.dll
[2011/09/08 17:46:27 | 005,081,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_36.dll
[2011/09/08 17:46:27 | 003,734,536 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_36.dll
[2011/09/08 17:46:15 | 000,411,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_9.dll
[2011/09/08 17:46:15 | 000,267,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_9.dll
[2011/09/08 17:46:12 | 001,985,904 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_35.dll
[2011/09/08 17:46:12 | 001,358,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_35.dll
[2011/09/08 17:46:12 | 000,508,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_35.dll
[2011/09/08 17:46:12 | 000,444,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_35.dll
[2011/09/08 17:46:08 | 005,073,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_35.dll
[2011/09/08 17:46:08 | 003,727,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_35.dll
[2011/09/08 17:46:05 | 000,409,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_8.dll
[2011/09/08 17:46:05 | 000,266,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_8.dll
[2011/09/08 17:46:05 | 000,021,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\X3DAudio1_2.dll
[2011/09/08 17:46:05 | 000,017,928 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\X3DAudio1_2.dll
[2011/09/08 17:46:04 | 001,401,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_34.dll
[2011/09/08 17:46:04 | 001,124,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_34.dll
[2011/09/08 17:46:04 | 000,506,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_34.dll
[2011/09/08 17:46:04 | 000,443,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_34.dll
[2011/09/08 17:46:03 | 004,496,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_34.dll
[2011/09/08 17:46:03 | 003,497,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_34.dll
[2011/09/08 17:46:02 | 000,107,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xinput1_3.dll
[2011/09/08 17:46:02 | 000,081,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xinput1_3.dll
[2011/09/08 17:45:59 | 000,403,304 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_7.dll
[2011/09/08 17:45:59 | 000,261,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_7.dll
[2011/09/08 17:45:58 | 000,506,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_33.dll
[2011/09/08 17:45:58 | 000,443,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_33.dll
[2011/09/08 17:45:57 | 001,400,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_33.dll
[2011/09/08 17:45:57 | 001,123,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_33.dll
[2011/09/08 17:45:55 | 004,494,184 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_33.dll
[2011/09/08 17:45:55 | 003,495,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_33.dll
[2011/09/08 17:45:51 | 000,393,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_6.dll
[2011/09/08 17:45:51 | 000,255,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_6.dll
[2011/09/08 17:45:45 | 000,469,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10.dll
[2011/09/08 17:45:45 | 000,440,080 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10.dll
[2011/09/08 17:45:45 | 000,390,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_5.dll
[2011/09/08 17:45:45 | 000,251,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_5.dll
[2011/09/08 17:45:36 | 000,364,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_4.dll
[2011/09/08 17:45:36 | 000,237,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_4.dll
[2011/09/08 17:45:36 | 000,017,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\x3daudio1_1.dll
[2011/09/08 17:45:36 | 000,015,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\x3daudio1_1.dll
[2011/09/08 17:45:35 | 003,977,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_31.dll
[2011/09/08 17:45:35 | 002,414,360 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_31.dll
[2011/09/08 17:45:33 | 000,363,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_3.dll
[2011/09/08 17:45:33 | 000,236,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_3.dll
[2011/09/08 17:45:32 | 000,083,736 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xinput1_2.dll
[2011/09/08 17:45:32 | 000,062,744 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xinput1_2.dll
[2011/09/08 17:45:30 | 000,354,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_2.dll
[2011/09/08 17:45:30 | 000,230,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_2.dll
[2011/09/08 17:45:29 | 000,083,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xinput1_1.dll
[2011/09/08 17:45:29 | 000,062,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xinput1_1.dll
[2011/09/08 17:45:26 | 000,352,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_1.dll
[2011/09/08 17:45:26 | 000,229,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_1.dll
[2011/09/08 17:45:03 | 003,927,248 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_30.dll
[2011/09/08 17:45:03 | 002,388,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_30.dll
[2011/09/08 17:45:00 | 000,355,536 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_0.dll
[2011/09/08 17:45:00 | 000,230,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_0.dll
[2011/09/08 17:45:00 | 000,016,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\x3daudio1_0.dll
[2011/09/08 17:45:00 | 000,014,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\x3daudio1_0.dll
[2011/09/08 17:44:59 | 003,830,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_29.dll
[2011/09/08 17:44:59 | 002,332,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_29.dll
[2011/09/08 17:44:57 | 003,815,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_28.dll
[2011/09/08 17:44:57 | 002,323,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_28.dll
[2011/09/08 17:44:49 | 003,767,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_26.dll
[2011/09/08 17:44:49 | 002,297,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_26.dll
[2011/09/08 17:44:48 | 003,823,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_25.dll
[2011/09/08 17:44:48 | 002,337,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_25.dll
[2011/09/08 17:44:46 | 003,544,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_24.dll
[2011/09/08 17:44:46 | 002,222,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_24.dll
[2011/09/08 17:38:44 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Steam
[2011/09/08 17:38:28 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
[2011/09/08 17:38:24 | 000,000,000 | —D | C] – C:\Program Files (x86)\Steam
[2011/09/08 17:34:53 | 000,000,000 | —D | C] – C:\ProgramData\UAB
[2011/09/08 17:34:41 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Local\PC_Drivers_Headquarters
[2011/09/08 17:34:05 | 000,000,000 | —D | C] – C:\ProgramData\PC Drivers HeadQuarters
[2011/09/08 17:32:32 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Detective
[2011/09/08 17:32:23 | 000,000,000 | —D | C] – C:\Program Files (x86)\PC Drivers HeadQuarters
[2011/09/08 15:50:05 | 000,000,000 | —D | C] – C:\Games
[2011/09/07 22:14:08 | 008,007,680 | R— | C] ( ) – C:\Windows\SysNative\Microsoft.mshtml.dll
[2011/09/07 22:14:08 | 000,126,976 | R— | C] ( ) – C:\Windows\SysNative\Interop.SHDocVw.dll
[2011/09/07 18:01:39 | 000,000,000 | —D | C] – C:\79acb1d3152ca8786c7c
[2011/09/07 17:40:48 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2011/09/07 17:25:43 | 000,000,000 | -HSD | C] – C:\Windows\SysWow64\%APPDATA%
[2011/09/07 16:54:18 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft
[2011/09/07 16:42:23 | 000,000,000 | —D | C] – C:\Windows\SysWow64\directx
[2011/09/07 16:38:31 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2011/09/07 16:17:01 | 000,000,000 | —D | C] – C:\Users\Esy\Documents\HGECBody_v1dot21
[2011/09/07 15:26:39 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oblivion Mod Manager
[2011/09/07 15:00:39 | 003,807,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_27.dll
[2011/09/07 15:00:39 | 002,319,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_27.dll
[2011/09/07 14:57:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Bethesda Softworks
[2011/09/07 14:57:34 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bethesda Softworks
[2011/09/07 14:54:32 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Local\Oblivion
[2011/09/07 14:54:32 | 000,000,000 | —D | C] – C:\Users\Esy\Documents\My Games
[2011/09/07 14:31:33 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO
[2011/09/07 14:31:28 | 000,093,240 | —- | C] (PowerISO Computing, Inc.) – C:\Windows\SysNative\drivers\scdemu.sys
[2011/09/07 14:31:27 | 000,000,000 | —D | C] – C:\Program Files (x86)\PowerISO
[2011/09/07 14:12:57 | 000,404,640 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011/09/07 10:36:11 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Local\Microsoft Games
[2011/09/07 09:46:44 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2011/09/07 09:46:12 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
[2011/09/07 09:46:01 | 000,017,272 | —- | C] (Safer Networking Limited) – C:\Windows\SysNative\sdnclean64.exe
[2011/09/07 09:45:53 | 000,000,000 | —D | C] – C:\Program Files (x86)\Spybot - Search & Destroy 2
[2011/09/07 07:15:24 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Local\ElevatedDiagnostics
[2011/09/07 07:05:43 | 000,000,000 | —D | C] – C:\Windows\Minidump
[2011/09/06 22:37:31 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\Mozilla
[2011/09/06 22:37:31 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Local\Mozilla
[2011/09/06 22:37:04 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2011/09/06 22:31:02 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\Google
[2011/09/06 22:31:01 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Local\Google
[2011/09/06 22:28:34 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/09/06 22:28:04 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Local\Temp
[2011/09/06 22:21:56 | 000,000,000 | —D | C] – C:\Windows\temp
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\ProgramData\Templates
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\ProgramData\Start Menu
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\Users\Public\Documents\My Videos
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\Users\Public\Documents\My Pictures
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\Users\Public\Documents\My Music
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\ProgramData\Favorites
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\Documents and Settings
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\ProgramData\Documents
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\ProgramData\Desktop
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\ProgramData\Application Data
[2011/09/06 22:16:47 | 000,000,000 | —D | C] – C:\OEM
[2011/09/06 21:50:00 | 000,000,000 | —D | C] – C:\Program Files (x86)\SystemRequirementsLab
[2011/09/06 21:48:36 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\SystemRequirementsLab
[2011/09/06 21:47:45 | 000,000,000 | —D | C] – C:\Windows\Sun
[2011/09/06 21:44:39 | 000,000,000 | —D | C] – C:\Users\Esy\Documents\Vuze Downloads
[2011/09/06 21:41:04 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip
[2011/09/06 21:40:55 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Local\WinZip
[2011/09/06 21:40:55 | 000,000,000 | —D | C] – C:\ProgramData\WinZip
[2011/09/06 21:40:44 | 000,000,000 | —D | C] – C:\Program Files (x86)\WinZip
[2011/09/06 21:40:12 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\Azureus
[2011/09/06 21:39:23 | 000,000,000 | —D | C] – C:\Program Files (x86)\Vuze
[2011/03/12 12:52:10 | 008,007,680 | —- | C] ( ) – C:\Windows\SysWow64\Microsoft.mshtml.dll
[2011/03/12 12:52:10 | 000,126,976 | —- | C] ( ) – C:\Windows\SysWow64\Interop.SHDocVw.dll
[2011/03/10 12:23:10 | 000,049,464 | —- | C] ( ) – C:\Windows\AutosetFrequency.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/09/11 03:40:08 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/09/11 03:36:20 | 000,581,120 | —- | M] (OldTimer Tools) – C:\Users\Esy\Desktop\OTL.exe
[2011/09/11 03:35:51 | 000,000,512 | —- | M] () – C:\Users\Esy\Desktop\MBR.dat
[2011/09/11 03:20:25 | 001,916,416 | —- | M] (AVAST Software) – C:\Users\Esy\Desktop\aswMBR.exe
[2011/09/11 03:17:15 | 000,025,308 | RHS- | M] () – C:\Windows\SysNative\masteraclini.enu
[2011/09/11 03:17:15 | 000,000,116 | RH– | M] () – C:\Windows\SysNative\masteraclbini.enu
[2011/09/11 03:16:22 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/09/10 21:47:52 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/09/10 21:47:52 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/09/10 21:40:51 | 000,000,358 | —- | M] () – C:\Windows\tasks\Check for updates (Spybot - Search & Destroy).job
[2011/09/10 21:40:35 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/09/10 21:40:27 | 000,000,312 | —- | M] () – C:\Windows\tasks\Scan the system (Spybot - Search & Destroy).job
[2011/09/10 21:40:27 | 000,000,302 | —- | M] () – C:\Windows\tasks\Refresh immunization (Spybot - Search & Destroy).job
[2011/09/10 21:38:20 | 2210,578,432 | -HS- | M] () – C:\hiberfil.sys
[2011/09/10 15:12:29 | 000,002,169 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War Teutonic.lnk
[2011/09/10 15:07:15 | 000,002,169 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War Crusades.lnk
[2011/09/10 15:03:14 | 000,002,179 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War Britannia.lnk
[2011/09/10 14:59:20 | 000,002,169 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War Americas.lnk
[2011/09/10 13:15:05 | 000,002,111 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War.lnk
[2011/09/10 13:10:28 | 000,738,602 | —- | M] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/09/10 13:10:28 | 000,638,888 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2011/09/10 13:10:28 | 000,115,302 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2011/09/10 12:55:05 | 000,000,219 | —- | M] () – C:\Users\Esy\Desktop\Day of Defeat Source.url
[2011/09/09 19:23:53 | 000,001,171 | —- | M] () – C:\Users\Public\Desktop\World of Warcraft.lnk
[2011/09/09 14:54:35 | 000,002,965 | —- | M] () – C:\Users\Esy\Desktop\HiJackThis.lnk
[2011/09/09 06:11:14 | 000,729,688 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2011/09/09 04:32:18 | 000,001,109 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/09/08 21:50:14 | 000,002,334 | —- | M] () – C:\Users\Public\Desktop\Norton PC Checkup.LNK
[2011/09/08 20:00:10 | 000,002,272 | —- | M] () – C:\Users\Esy\Desktop\Men of War. Assault Squad.lnk
[2011/09/08 19:12:05 | 000,001,186 | —- | M] () – C:\Users\Esy\Desktop\Empire Total War.lnk
[2011/09/08 19:11:46 | 000,001,457 | —- | M] () – C:\Users\Esy\Desktop\MoW Red Tide.lnk
[2011/09/08 17:38:54 | 000,000,921 | —- | M] () – C:\Users\Public\Desktop\Steam.lnk
[2011/09/08 17:32:33 | 000,002,477 | —- | M] () – C:\Users\Public\Desktop\Driver Detective.lnk
[2011/09/08 17:27:44 | 000,001,162 | —- | M] () – C:\Users\Public\Desktop\Install Microsoft IntelliPoint.lnk
[2011/09/08 17:27:23 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01009.Wdf
[2011/09/07 23:10:12 | 000,000,023 | —- | M] () – C:\Windows\BlendSettings.ini
[2011/09/07 22:58:16 | 000,007,601 | —- | M] () – C:\Users\Esy\AppData\Local\resmon.resmoncfg
[2011/09/07 22:14:09 | 000,096,520 | RH– | M] () – C:\Windows\SysNative\bFireWallDart.exe
[2011/09/07 22:14:08 | 008,007,680 | R— | M] ( ) – C:\Windows\SysNative\Microsoft.mshtml.dll
[2011/09/07 22:14:08 | 000,126,976 | R— | M] ( ) – C:\Windows\SysNative\Interop.SHDocVw.dll
[2011/09/07 22:14:07 | 001,369,088 | RH– | M] () – C:\Windows\SysNative\7z.dll
[2011/09/07 22:14:07 | 000,256,000 | RH– | M] () – C:\Windows\SysNative\SevenZipSharp.dll
[2011/09/07 22:14:07 | 000,200,704 | R— | M] () – C:\Windows\SysNative\ICSharpCode.SharpZipLib.dll
[2011/09/07 22:14:07 | 000,061,704 | RH– | M] () – C:\Windows\SysNative\bmessagePop.exe
[2011/09/07 22:14:06 | 002,493,192 | RH– | M] () – C:\Windows\SysNative\bwinLogonUser.exe
[2011/09/07 22:14:06 | 002,493,192 | RH– | M] () – C:\Windows\SysNative\bwinLogonSystem.exe
[2011/09/07 22:14:02 | 000,000,039 | RHS- | M] () – C:\Windows\SysNative\masteracl.enu
[2011/09/07 22:14:00 | 000,000,709 | -HS- | M] () – C:\Windows\SysNative\settings.ini
[2011/09/07 22:09:58 | 000,043,602 | -H– | M] () – C:\Windows\SysWow64\masteraclini.enu
[2011/09/07 22:09:56 | 008,865,032 | RH– | M] () – C:\Windows\SysNative\bKernelMain.exe
[2011/09/07 22:09:49 | 009,029,384 | RH– | M] () – C:\Windows\SysNative\bSecurityCrypt.exe
[2011/09/07 22:09:42 | 009,034,504 | RH– | M] () – C:\Windows\SysNative\bKernelSecurity.exe
[2011/09/07 22:09:30 | 000,019,592 | —- | M] () – C:\Windows\SysNative\drivers\bapcmci64.sys
[2011/09/07 22:09:30 | 000,016,520 | —- | M] () – C:\Windows\SysNative\drivers\bpcrasys64.sys
[2011/09/07 22:09:29 | 000,020,616 | —- | M] () – C:\Windows\SysNative\drivers\bakerneldrv64.sys
[2011/09/07 22:06:15 | 142,219,065 | —- | M] () – C:\Windows\MEMORY.DMP
[2011/09/07 15:13:51 | 000,000,032 | —- | M] () – C:\Windows\CD_Start.INI
[2011/09/07 15:12:58 | 000,002,164 | —- | M] () – C:\Users\Public\Desktop\Oblivion.lnk
[2011/09/07 14:31:35 | 000,001,007 | —- | M] () – C:\Users\Public\Desktop\PowerISO.lnk
[2011/09/07 14:12:57 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011/09/07 09:46:13 | 000,002,173 | —- | M] () – C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
[2011/09/06 22:37:09 | 000,001,138 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/09/06 22:30:25 | 000,001,437 | —- | M] () – C:\Users\Esy\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/09/06 22:23:52 | 001,056,768 | —- | M] () – C:\Windows\SysWow64\defltbase.sdb
[2011/09/06 22:22:53 | 000,368,312 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2011/09/06 21:41:04 | 000,002,319 | —- | M] () – C:\Users\Public\Desktop\WinZip.lnk
[2011/09/06 21:39:38 | 000,001,848 | —- | M] () – C:\Users\Public\Desktop\Vuze.lnk
[2011/09/06 21:39:38 | 000,001,848 | —- | M] () – C:\Users\Esy\Application Data\Microsoft\Internet Explorer\Quick Launch\Vuze.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/09/11 03:35:51 | 000,000,512 | —- | C] () – C:\Users\Esy\Desktop\MBR.dat
[2011/09/10 15:12:29 | 000,002,169 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War Teutonic.lnk
[2011/09/10 15:07:15 | 000,002,169 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War Crusades.lnk
[2011/09/10 15:03:14 | 000,002,179 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War Britannia.lnk
[2011/09/10 14:59:20 | 000,002,169 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War Americas.lnk
[2011/09/10 12:55:05 | 000,000,219 | —- | C] () – C:\Users\Esy\Desktop\Day of Defeat Source.url
[2011/09/10 12:31:59 | 000,002,111 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War.lnk
[2011/09/09 14:54:35 | 000,002,965 | —- | C] () – C:\Users\Esy\Desktop\HiJackThis.lnk
[2011/09/09 04:32:18 | 000,001,109 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/09/08 22:46:53 | 000,001,171 | —- | C] () – C:\Users\Public\Desktop\World of Warcraft.lnk
[2011/09/08 21:50:14 | 000,002,334 | —- | C] () – C:\Users\Public\Desktop\Norton PC Checkup.LNK
[2011/09/08 21:49:39 | 000,000,172 | —- | C] () – C:\Windows\SysNative\drivers\NortonPCCheckupx64\02000C0.01B\isolate.ini
[2011/09/08 20:00:10 | 000,002,272 | —- | C] () – C:\Users\Esy\Desktop\Men of War. Assault Squad.lnk
[2011/09/08 19:12:05 | 000,001,186 | —- | C] () – C:\Users\Esy\Desktop\Empire Total War.lnk
[2011/09/08 19:11:46 | 000,001,457 | —- | C] () – C:\Users\Esy\Desktop\MoW Red Tide.lnk
[2011/09/08 17:38:54 | 000,000,921 | —- | C] () – C:\Users\Public\Desktop\Steam.lnk
[2011/09/08 17:32:32 | 000,002,477 | —- | C] () – C:\Users\Public\Desktop\Driver Detective.lnk
[2011/09/08 17:27:44 | 000,001,162 | —- | C] () – C:\Users\Public\Desktop\Install Microsoft IntelliPoint.lnk
[2011/09/08 17:27:23 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01009.WdLS\x00\x00\x00\x00

naturegrl55

Post #5September 11, 2011, 11:04 AM UTC last edited September 11, 2011, 11:06 AM UTC

(OTL extras)

OTL Extras logfile created on: 11/09/2011 3:38:11 AM - Run 1
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Users\Esy\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

2.75 Gb Total Physical Memory | 1.56 Gb Available Physical Memory | 56.75% Memory free
5.49 Gb Paging File | 3.58 Gb Available in Paging File | 65.17% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 232.88 Gb Total Space | 93.74 Gb Free Space | 40.25% Space Free | Partition Type: NTFS

Computer Name: ESY-PC | User Name: Esy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Disabled:Spybot-S&D 2 Scanner Service – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Disabled:Spybot-S&D 2 Scanner Service – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service – (Safer-Networking Ltd.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{1F557316-CFC0-41BD-AFF7-8BC49CE444D7}" = Shredder
"{3B20226B-63ED-B863-B224-FE40401B21CA}" = ATI Catalyst Install Manager
"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
"{774088D4-0777-4D78-904D-E435B318F5D2}" = Microsoft Antimalware
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{E77543EE-6FB5-4FF6-AB70-635392C8C756}" = Microsoft Security Client
"{EEB06ECB-38F0-68CD-B215-94D50914C0F8}" = ccc-utility64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01868E82-DA4F-BFF8-45CF-9B1CAE8810D9}" = Catalyst Control Center Core Implementation
"{01CC7DB7-909B-E630-A44A-8118036CAF3C}" = CCC Help Korean
"{02A10468-2F1C-447C-AD8E-4DEDDEA25AE2}" = Medieval II Total War : Kingdoms : Crusades
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{07367450-E3E6-B4A1-E19C-A07429026680}" = CCC Help Swedish
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D7CD0D9-4A88-4A63-8F91-3F4E8F371768}" = MyWinLocker
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{14C87AA7-08E6-419F-A165-998EBE5023D7}" = Oblivion - Knights of the Nine
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{16D919E6-F019-4E15-BFBE-4A85EF19DA57}" = Oblivion - Spell Tomes
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1A655D51-1423-48A3-B748-8F5A0BE294C8}" = Microsoft Visual J# .NET Redistributable Package 1.1
"{1C42AA63-B354-56AF-69CA-FA73285368BE}" = CCC Help German
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1F77C418-2C90-459C-BD33-B56A4182B9FA}" = System Requirements Lab CYRI
"{1FFDACFC-898C-FC99-0140-AE2FC18B710E}" = Catalyst Control Center Graphics Full New
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{268E2A87-470B-118B-B3AD-6F2615B86623}" = CCC Help Greek
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 22
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2F2E3D62-8B8C-448F-8900-451325E50948}" = Oblivion - Wizard's Tower
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion
"{3601754A-C72B-E4B3-CE39-78CCD0B58DC9}" = CCC Help Russian
"{3839C2FF-2CD0-4601-91A8-B1E40A9BE8A8}" = Driver Detective
"{3A69B28B-6E44-E512-C395-EEDCB5BCB485}" = CCC Help Danish
"{3ABEBD00-299D-4DCA-967F-B912163AB5EA}" = Oblivion - Horse Armor Pack
"{3BA616F8-F969-4DE7-0C85-35BE954DDB8A}" = CCC Help Hungarian
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management
"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
"{3EED6569-D845-F8D1-9648-84729711590E}" = CCC Help Italian
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A41156A-0669-F7B5-B24C-5E25C69F1E68}" = CCC Help Turkish
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{5449FB4F-1802-4D5B-A6D8-087DB1142147}" = Realtek HDMI Audio Driver for ATI
"{63ADFC07-D92A-670C-3826-BB0C9CC41D8A}" = CCC Help Polish
"{6488561D-83C8-6987-6163-744E60680139}" = CCC Help Japanese
"{67E03279-F703-408F-B4BF-46B5FC8D70CD}" = Microsoft Works
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69CA5A5F-7541-5216-6433-DE69E4245116}" = Catalyst Control Center Graphics Light
"{69F214C9-507D-7EB5-FF08-926CFD0D5EC6}" = Catalyst Control Center Localization All
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"{75983B66-804C-40D1-BA13-64DAF652A6F1}" = Medieval II Total War : Kingdoms : Americas
"{762CB899-DF14-EB84-78F5-888C83AA7DC3}" = Catalyst Control Center Graphics Previews Common
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7760D94E-B1B5-40A0-9AA0-ABF942108755}" = Acer Crystal Eye Webcam
"{7AEE1963-7001-4C37-BC20-2FAEB74AA41C}" = Medieval II Total War : Kingdoms : Teutonic
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{83E4C065-91B9-20DD-74DA-90A71242CE18}" = CCC Help Norwegian
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8AEAE107-B186-4EA8-5F84-3AAA3158FEB1}" = CCC Help Chinese Standard
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{E64BA721-2310-4B55-BE5A-2925F9706192}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002A-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{975B24AC-8CB7-B4E1-E666-37964657576E}" = CCC Help Chinese Traditional
"{987B04C4-B5AC-4AD6-A7E9-8D681085B850}" = AMD USB Filter Driver
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0A20753-92DF-4631-82B4-9CACE2FCED6A}" = Oblivion - The Fighter's Stronghold
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A45B7A40-694C-BAB8-EE69-4240ADFEA1FF}" = CCC Help Finnish
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.1 MUI
"{AD768FF7-E329-886C-D88E-585F26BB8738}" = CCC Help Dutch
"{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" = Spybot - Search & Destroy 2
"{B8F5BACE-194E-0203-023E-2FFEF68EE290}" = CCC Help English
"{C0698BDA-0D29-40EE-8570-A31106DF9AB1}" = Medieval II Total War
"{C2695E83-CF1D-43D1-84FE-B3BEC561012A}" = Shredder
"{C450D07C-3914-5481-A068-29975DA5C596}" = CCC Help French
"{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}" = Norton Online Backup
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C9165CF3-A14D-A281-B62E-37312AA9E63D}" = CCC Help Spanish
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240C0}" = WinZip 15.0
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CEDDEE73-3D36-41C2-AA40-29355D9FBD63}" = Medieval II Total War : Kingdoms : Britannia
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D4E16961-E6FA-4689-AD09-3DB7E5770167}" = Catalyst Control Center InstallProxy
"{D6B1E149-790E-3B60-07F9-07A40ECAFBA0}" = Catalyst Control Center Graphics Full Existing
"{D8B5C1BB-5951-422D-A4D5-451675614956}_is1" = Men of War: Assault Squad (Remove Only)
"{DBF91CC3-41F6-0D99-3D2D-686C59865652}" = ccc-core-static
"{DD49AC0F-E08A-F77D-AB38-2EE9CD5D8F0B}" = CCC Help Thai
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECEFADB-0486-6252-C312-49DDAC71DF33}" = CCC Help Portuguese
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EC425CFC-EE78-4A91-AA25-3BFA65B75364}" = Oblivion - Orrery
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{EF295F5C-7B57-47AA-8889-6B3E8E214E89}" = Oblivion - Mehrunes Razor
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F7425F93-2071-A946-008A-6ACA60B43FB2}" = CCC Help Czech
"{FC635D8E-FFBA-4B2C-BE68-A37D56BDFB74}" = Catalyst Control Center - Branding
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FFFFFD17-B460-41EB-93F1-C48ABAD63828}" = Oblivion - Thieves Den
"8461-7759-5462-8226" = Vuze
"Acer Game Console" = Acer Game Console
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Acer Welcome Center" = Welcome Center
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"Identity Card" = Identity Card
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Acer Backup Manager
"InstallShield_{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Mozilla Firefox 6.0.2 (x86 en-US)" = Mozilla Firefox 6.0.2 (x86 en-US)
"NortonPCCheckup" = Norton PC Checkup
"Oblivion mod manager_is1" = Oblivion mod manager 1.1.12
"PowerISO" = PowerISO
"Steam App 300" = Day of Defeat: Source
"WildTangent acer Master Uninstall" = Acer Games
"WinLiveSuite" = Windows Live Essentials
"World of Warcraft" = World of Warcraft
"WT078749" = Bejeweled 2 Deluxe
"WT078774" = Zuma Deluxe
"WT078953" = Blackhawk Striker 2
"WT078961" = Bob the Builder Can-Do-Zoo
"WT079017" = Faerie Solitaire
"WT079021" = FATE - The Traitor Soul
"WT079065" = Jewel Quest Solitaire 3
"WT079097" = Monopoly
"WT079101" = Mystery P.I. - Lost in Los Angeles
"WT079105" = Penguins!
"WT079109" = Plants vs. Zombies
"WT079113" = Polar Bowler
"WT079117" = Polar Golfer
"WT079149" = Scrabble Plus
"WT079153" = The Price is Right
"WT079173" = Virtual Villagers - A New Home
"WT079179" = Yahtzee
"WT079193" = Build-a-lot 2
"WT079218" = Escape Rosecliff Island
"WT079643" = Virtual Families

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 08/09/2011 6:51:08 PM | Computer Name = Esy-PC | Source = Application Hang | ID = 1002
Description = The program Install.exe version 0.0.0.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Action Center control panel. Process ID: 10a8 Start Time:
01cc6e799edf61b9 Termination Time: 8 Application Path: C:\Users\Esy\Documents\Vuze
Downloads\Empire.Total.War.Special.Forces.Edition.FullRip-Ka0s\Install.exe Report
Id: eb3d08c5-da6c-11e0-94d0-88ae1d10efd9

Error - 08/09/2011 9:22:34 PM | Computer Name = Esy-PC | Source = Application Hang | ID = 1002
Description = The program Empire.exe version 1.0.0.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Action Center control panel. Process ID: 175c Start Time:
01cc6e8a4c879240 Termination Time: 206 Application Path: C:\Games\Empire.Total.War-KaOs\Empire.exe

Report
Id:

Error - 08/09/2011 11:19:38 PM | Computer Name = Esy-PC | Source = Application Hang | ID = 1002
Description = The program Empire.exe version 1.0.0.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Action Center control panel. Process ID: 1cdc Start Time:
01cc6e9ceb5eea6e Termination Time: 90 Application Path: C:\Games\Empire.Total.War-KaOs\Empire.exe

Report
Id:

Error - 09/09/2011 12:14:25 AM | Computer Name = Esy-PC | Source = Application Hang | ID = 1002
Description = The program Empire.exe version 1.0.0.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Action Center control panel. Process ID: 1f80 Start Time:
01cc6e9f8b60ae47 Termination Time: 85 Application Path: C:\Games\Empire.Total.War-KaOs\Empire.exe

Report
Id:

Error - 09/09/2011 12:56:04 AM | Computer Name = Esy-PC | Source = Application Error | ID = 1000
Description = Faulting application name: norton_pc_checkup_updater.exe, version:
8.0.41.0, time stamp: 0x4d0b76fb Faulting module name: SDHook32.dll, version: 2.0.5.1,
time stamp: 0x4e36cc58 Exception code: 0xc0000417 Fault offset: 0x00034e67 Faulting
process id: 0x1f34 Faulting application start time: 0x01cc6eac3074323c Faulting application
path: c:\program files (x86)\norton pc checkup\engine\2.0.12.27\norton_pc_checkup_updater.exe
Faulting
module path: C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHook32.dll Report
Id: 04c72759-daa0-11e0-94d0-88ae1d10efd9

Error - 09/09/2011 7:30:12 AM | Computer Name = Esy-PC | Source = Application Hang | ID = 1002
Description = The program firefox.exe version 6.0.2.4262 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 1ff8 Start
Time: 01cc6ee2fe3e0267 Termination Time: 37 Application Path: C:\Program Files (x86)\Mozilla
Firefox\firefox.exe Report Id: f69a591a-dad6-11e0-94d0-88ae1d10efd9

Error - 09/09/2011 11:23:34 AM | Computer Name = Esy-PC | Source = Application Error | ID = 1000
Description = Faulting application name: cmd.exe, version: 6.1.7601.17514, time
stamp: 0x4ce78e2b Faulting module name: SDHook32.dll, version: 2.0.5.1, time stamp:
0x4e36cc58 Exception code: 0xc0000005 Fault offset: 0x0003e2e5 Faulting process id:
0x1068 Faulting application start time: 0x01cc6f0425379396 Faulting application path:
C:\Windows\SysWOW64\cmd.exe Faulting module path: C:\Program Files (x86)\Spybot
- Search & Destroy 2\SDHook32.dll Report Id: ae10e719-daf7-11e0-a2b7-88ae1d10efd9

Error - 10/09/2011 4:10:36 PM | Computer Name = Esy-PC | Source = Application Error | ID = 1000
Description = Faulting application name: aspnet_regiis.exe, version: 1.1.4322.573,
time stamp: 0x3e559ac4 Faulting module name: SDHook32.dll, version: 2.0.5.1, time
stamp: 0x4e36cc58 Exception code: 0xc0000417 Fault offset: 0x00034e67 Faulting process
id: 0x1674 Faulting application start time: 0x01cc6ff59afc3805 Faulting application
path: C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe Faulting module
path: C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHook32.dll Report Id:
f1effcbf-dbe8-11e0-a2b7-88ae1d10efd9

Error - 10/09/2011 4:45:19 PM | Computer Name = Esy-PC | Source = Application Hang | ID = 1002
Description = The program hl2.exe version 0.0.0.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Action Center control panel. Process ID: 17b4 Start Time:
01cc6ff9fa35bbdf Termination Time: 723 Application Path: c:\program files (x86)\steam\steamapps\dorfyisgreat\day
of defeat source\hl2.exe Report Id:

Error - 10/09/2011 6:06:28 PM | Computer Name = Esy-PC | Source = Application Hang | ID = 1002
Description = The program mbam.exe version 1.51.1.1076 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 117c Start
Time: 01cc6f7168b69698 Termination Time: 206 Application Path: C:\Program Files (x86)\Malwarebytes'
Anti-Malware\mbam.exe Report Id: 1bf834c0-dbf9-11e0-a2b7-88ae1d10efd9

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

mowman

Post #6September 11, 2011, 11:15 AM UTC

Please download TDSSKiller.zip

Extract it to your desktop
Double click TDSSKiller.exe
Press Start Scan
- Only if Malicious objects are found then ensure Cure is selected
  If suspicious objects are found select skip
- Then click Continue > Reboot now
Copy and paste the log in your next reply
- A copy of the log will be saved automatically to the root of the drive (typically C:\)

Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt for further review.

naturegrl55

Post #7September 11, 2011, 11:36 AM UTC

so just to be sure, when i use the tds tool do i only "cure" if there are malicious objects and no suspicious files?

mowman

Post #8September 11, 2011, 11:50 AM UTC

Cure malicious files,skip any suspicious ones

naturegrl55

Post #9September 11, 2011, 8:59 PM UTC last edited September 11, 2011, 9:13 PM UTC

hey! here are the new logs

(TDS) 2011/09/11 04:55:36.0741 4416 TDSS rootkit removing tool 2.5.21.0 Sep 10 2011 21:07:05 2011/09/11 04:55:37.0833 4416 ================================================================================ 2011/09/11 04:55:37.0833 4416 SystemInfo: 2011/09/11 04:55:37.0833 4416 2011/09/11 04:55:37.0833 4416 OS Version: 6.1.7601 ServicePack: 1.0 2011/09/11 04:55:37.0833 4416 Product type: Workstation 2011/09/11 04:55:37.0833 4416 ComputerName: ESY-PC 2011/09/11 04:55:37.0864 4416 UserName: Esy 2011/09/11 04:55:37.0864 4416 Windows directory: C:\Windows 2011/09/11 04:55:37.0864 4416 System windows directory: C:\Windows 2011/09/11 04:55:37.0864 4416 Running under WOW64 2011/09/11 04:55:37.0864 4416 Processor architecture: Intel x64 2011/09/11 04:55:37.0864 4416 Number of processors: 1 2011/09/11 04:55:37.0864 4416 Page size: 0x1000 2011/09/11 04:55:37.0864 4416 Boot type: Normal boot 2011/09/11 04:55:37.0864 4416 ================================================================================ 2011/09/11 04:55:40.0423 4416 Initialize success 2011/09/11 04:55:45.0805 3520 ================================================================================ 2011/09/11 04:55:45.0805 3520 Scan started 2011/09/11 04:55:45.0805 3520 Mode: Manual; 2011/09/11 04:55:45.0805 3520 ================================================================================ 2011/09/11 04:55:47.0209 3520 Suspicious service (NoAccess): .Net bKernelMain 2011/09/11 04:55:47.0443 3520 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys 2011/09/11 04:55:47.0505 3520 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys 2011/09/11 04:55:47.0739 3520 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys 2011/09/11 04:55:47.0833 3520 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys 2011/09/11 04:55:48.0129 3520 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys 2011/09/11 04:55:48.0191 3520 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys 2011/09/11 04:55:48.0394 3520 AFD (d31dc7a16dea4a9baf179f3d6fbdb38c) C:\Windows\system32\drivers\afd.sys 2011/09/11 04:55:48.0706 3520 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys 2011/09/11 04:55:48.0987 3520 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys 2011/09/11 04:55:49.0471 3520 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys 2011/09/11 04:55:49.0595 3520 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys 2011/09/11 04:55:49.0861 3520 amdkmdag (83418f6ee5a81dddd8e248fcbfc99af6) C:\Windows\system32\DRIVERS\atipmdag.sys 2011/09/11 04:55:50.0173 3520 amdkmdap (7e58b5e1deaa70bd46997068df06b4e3) C:\Windows\system32\DRIVERS\atikmpag.sys 2011/09/11 04:55:50.0219 3520 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 2011/09/11 04:55:50.0391 3520 amdsata (6ec6d772eae38dc17c14aed9b178d24b) C:\Windows\system32\drivers\amdsata.sys 2011/09/11 04:55:50.0453 3520 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys 2011/09/11 04:55:50.0500 3520 amdxata (1142a21db581a84ea5597b03a26ebaa0) C:\Windows\system32\drivers\amdxata.sys 2011/09/11 04:55:50.0719 3520 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys 2011/09/11 04:55:50.0859 3520 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys 2011/09/11 04:55:50.0984 3520 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys 2011/09/11 04:55:51.0093 3520 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 2011/09/11 04:55:51.0202 3520 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys 2011/09/11 04:55:51.0452 3520 athr (e857eee6b92aaa473ebb3465add8f7e7) C:\Windows\system32\DRIVERS\athrx.sys 2011/09/11 04:55:51.0733 3520 AtiPcie (c07a040d6b5a42dd41ee386cf90974c8) C:\Windows\system32\DRIVERS\AtiPcie.sys 2011/09/11 04:55:51.0935 3520 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys 2011/09/11 04:55:52.0154 3520 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 2011/09/11 04:55:52.0247 3520 bakerneldrv (eaeb6d36e2dae256ff265ba48e1ef41b) C:\Windows\system32\Drivers\bakerneldrv64.sys 2011/09/11 04:55:52.0247 3520 Suspicious file (NoAccess): C:\Windows\system32\Drivers\bakerneldrv64.sys. md5: eaeb6d36e2dae256ff265ba48e1ef41b 2011/09/11 04:55:52.0263 3520 bakerneldrv - detected LockedFile.Multi.Generic (1) 2011/09/11 04:55:52.0388 3520 bapcmci (b29ccb1e0bcab156b7ece3603b42a059) C:\Windows\system32\Drivers\bapcmci64.sys 2011/09/11 04:55:52.0388 3520 Suspicious file (NoAccess): C:\Windows\system32\Drivers\bapcmci64.sys. md5: b29ccb1e0bcab156b7ece3603b42a059 2011/09/11 04:55:52.0403 3520 bapcmci - detected LockedFile.Multi.Generic (1) 2011/09/11 04:55:52.0669 3520 BCM43XX (fde8c8dc07e75347e4c6b455a0964217) C:\Windows\system32\DRIVERS\bcmwl664.sys 2011/09/11 04:55:52.0981 3520 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 2011/09/11 04:55:53.0386 3520 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 2011/09/11 04:55:53.0542 3520 bowser (91ce0d3dc57dd377e690a2d324022b08) C:\Windows\system32\DRIVERS\bowser.sys 2011/09/11 04:55:53.0714 3520 bpcrasys (888343846ce9e1457eb1e092176b972c) C:\Windows\system32\Drivers\bpcrasys64.sys 2011/09/11 04:55:53.0714 3520 Suspicious file (NoAccess): C:\Windows\system32\Drivers\bpcrasys64.sys. md5: 888343846ce9e1457eb1e092176b972c 2011/09/11 04:55:53.0714 3520 bpcrasys - detected LockedFile.Multi.Generic (1) 2011/09/11 04:55:53.0807 3520 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys 2011/09/11 04:55:53.0854 3520 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys 2011/09/11 04:55:54.0026 3520 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 2011/09/11 04:55:54.0057 3520 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 2011/09/11 04:55:54.0088 3520 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 2011/09/11 04:55:54.0166 3520 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 2011/09/11 04:55:54.0197 3520 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys 2011/09/11 04:55:54.0291 3520 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 2011/09/11 04:55:54.0463 3520 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys 2011/09/11 04:55:54.0587 3520 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys 2011/09/11 04:55:54.0759 3520 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 2011/09/11 04:55:55.0040 3520 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 2011/09/11 04:55:55.0102 3520 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys 2011/09/11 04:55:55.0196 3520 CNG (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys 2011/09/11 04:55:55.0383 3520 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 2011/09/11 04:55:55.0508 3520 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys 2011/09/11 04:55:55.0742 3520 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys 2011/09/11 04:55:55.0835 3520 dc3d (7af9dac504fbd047cbc3e64ae52c92bf) C:\Windows\system32\DRIVERS\dc3d.sys 2011/09/11 04:55:56.0007 3520 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys 2011/09/11 04:55:56.0069 3520 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 2011/09/11 04:55:56.0350 3520 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys 2011/09/11 04:55:56.0475 3520 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 2011/09/11 04:55:56.0693 3520 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys 2011/09/11 04:55:56.0974 3520 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys 2011/09/11 04:55:57.0271 3520 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys 2011/09/11 04:55:57.0505 3520 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys 2011/09/11 04:55:57.0707 3520 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 2011/09/11 04:55:57.0879 3520 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 2011/09/11 04:55:58.0207 3520 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys 2011/09/11 04:55:58.0300 3520 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 2011/09/11 04:55:58.0456 3520 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 2011/09/11 04:55:58.0581 3520 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys 2011/09/11 04:55:58.0971 3520 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys 2011/09/11 04:55:59.0065 3520 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 2011/09/11 04:55:59.0314 3520 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys 2011/09/11 04:55:59.0439 3520 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys 2011/09/11 04:55:59.0579 3520 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys 2011/09/11 04:55:59.0876 3520 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 2011/09/11 04:55:59.0969 3520 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys 2011/09/11 04:56:00.0172 3520 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys 2011/09/11 04:56:00.0250 3520 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys 2011/09/11 04:56:00.0281 3520 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys 2011/09/11 04:56:00.0328 3520 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys 2011/09/11 04:56:00.0578 3520 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys 2011/09/11 04:56:00.0718 3520 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys 2011/09/11 04:56:00.0874 3520 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys 2011/09/11 04:56:01.0093 3520 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys 2011/09/11 04:56:01.0249 3520 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys 2011/09/11 04:56:01.0467 3520 iaStorV (3df4395a7cf8b7a72a5f4606366b8c2d) C:\Windows\system32\drivers\iaStorV.sys 2011/09/11 04:56:01.0545 3520 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys 2011/09/11 04:56:01.0857 3520 IntcAzAudAddService (feadc18677a85a123e95a9b976101120) C:\Windows\system32\drivers\RTKVHD64.sys 2011/09/11 04:56:02.0075 3520 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys 2011/09/11 04:56:02.0153 3520 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys 2011/09/11 04:56:02.0278 3520 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys 2011/09/11 04:56:02.0481 3520 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys 2011/09/11 04:56:02.0575 3520 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 2011/09/11 04:56:02.0777 3520 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 2011/09/11 04:56:02.0887 3520 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys 2011/09/11 04:56:03.0089 3520 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys 2011/09/11 04:56:03.0308 3520 k57nd60a (c9b4ecc187581e5bf3f76648884b7829) C:\Windows\system32\DRIVERS\k57nd60a.sys 2011/09/11 04:56:03.0355 3520 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys 2011/09/11 04:56:03.0433 3520 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys 2011/09/11 04:56:03.0589 3520 KSecDD (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys 2011/09/11 04:56:03.0635 3520 KSecPkg (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys 2011/09/11 04:56:03.0776 3520 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 2011/09/11 04:56:03.0901 3520 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 2011/09/11 04:56:04.0119 3520 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys 2011/09/11 04:56:04.0181 3520 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys 2011/09/11 04:56:04.0213 3520 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys 2011/09/11 04:56:04.0400 3520 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys 2011/09/11 04:56:04.0478 3520 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 2011/09/11 04:56:04.0712 3520 MBAMProtector (9c4fb231b6e02f84580de2f00f3c5293) C:\Windows\system32\drivers\mbam.sys 2011/09/11 04:56:04.0790 3520 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys 2011/09/11 04:56:04.0961 3520 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys 2011/09/11 04:56:05.0086 3520 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 2011/09/11 04:56:05.0258 3520 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 2011/09/11 04:56:05.0305 3520 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys 2011/09/11 04:56:05.0476 3520 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 2011/09/11 04:56:05.0570 3520 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys 2011/09/11 04:56:05.0617 3520 MpFilter (e6ba8e5a4a871899e23d64573ef58ee9) C:\Windows\system32\DRIVERS\MpFilter.sys 2011/09/11 04:56:05.0788 3520 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys 2011/09/11 04:56:05.0866 3520 MpNWMon (98b09a4f2c462441030b83a80a3f6fb3) C:\Windows\system32\DRIVERS\MpNWMon.sys 2011/09/11 04:56:06.0022 3520 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 2011/09/11 04:56:06.0100 3520 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys 2011/09/11 04:56:06.0225 3520 mrxsmb (faf015b07e3a2874a790a39b7d2c579f) C:\Windows\system32\DRIVERS\mrxsmb.sys 2011/09/11 04:56:06.0303 3520 mrxsmb10 (08e2345df129082bcdffdc1440f9c00d) C:\Windows\system32\DRIVERS\mrxsmb10.sys 2011/09/11 04:56:06.0412 3520 mrxsmb20 (108d87409c5812ef47d81e22843e8c9d) C:\Windows\system32\DRIVERS\mrxsmb20.sys 2011/09/11 04:56:06.0537 3520 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys 2011/09/11 04:56:06.0662 3520 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys 2011/09/11 04:56:06.0771 3520 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 2011/09/11 04:56:06.0896 3520 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 2011/09/11 04:56:07.0021 3520 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys 2011/09/11 04:56:07.0130 3520 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 2011/09/11 04:56:07.0255 3520 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 2011/09/11 04:56:07.0364 3520 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 2011/09/11 04:56:07.0473 3520 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys 2011/09/11 04:56:07.0567 3520 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys 2011/09/11 04:56:07.0660 3520 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 2011/09/11 04:56:07.0754 3520 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys 2011/09/11 04:56:07.0816 3520 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 2011/09/11 04:56:07.0925 3520 mwlPSDFilter (6ffecc25b39dc7652a0cec0ada9db589) C:\Windows\system32\DRIVERS\mwlPSDFilter.sys 2011/09/11 04:56:08.0035 3520 mwlPSDNServ (0befe32ca56d6ee89d58175725596a85) C:\Windows\system32\DRIVERS\mwlPSDNServ.sys 2011/09/11 04:56:08.0066 3520 mwlPSDVDisk (d43bc633b8660463e446e28e14a51262) C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys 2011/09/11 04:56:08.0222 3520 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 2011/09/11 04:56:08.0471 3520 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys 2011/09/11 04:56:08.0659 3520 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 2011/09/11 04:56:08.0783 3520 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 2011/09/11 04:56:08.0986 3520 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys 2011/09/11 04:56:09.0049 3520 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys 2011/09/11 04:56:09.0095 3520 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys 2011/09/11 04:56:09.0283 3520 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 2011/09/11 04:56:09.0361 3520 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys 2011/09/11 04:56:09.0579 3520 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys 2011/09/11 04:56:09.0657 3520 NisDrv (3713e8452b88d3e0be095e06b6fbc776) C:\Windows\system32\DRIVERS\NisDrvWFP.sys 2011/09/11 04:56:09.0860 3520 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 2011/09/11 04:56:09.0985 3520 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 2011/09/11 04:56:10.0109 3520 Ntfs (05d78aa5cb5f3f5c31160bdb955d0b7c) C:\Windows\system32\drivers\Ntfs.sys 2011/09/11 04:56:10.0515 3520 NTIDrvr (64ddd0dee976302f4bd93e5efcc2f013) C:\Windows\system32\drivers\NTIDrvr.sys 2011/09/11 04:56:10.0733 3520 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 2011/09/11 04:56:10.0827 3520 nvraid (5d9fd91f3d38dc9da01e3cb5fa89cd48) C:\Windows\system32\drivers\nvraid.sys 2011/09/11 04:56:11.0014 3520 nvstor (f7cd50fe7139f07e77da8ac8033d1832) C:\Windows\system32\drivers\nvstor.sys 2011/09/11 04:56:11.0139 3520 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys 2011/09/11 04:56:11.0201 3520 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys 2011/09/11 04:56:11.0264 3520 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys 2011/09/11 04:56:11.0342 3520 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys 2011/09/11 04:56:11.0545 3520 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys 2011/09/11 04:56:11.0591 3520 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys 2011/09/11 04:56:11.0732 3520 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys 2011/09/11 04:56:11.0857 3520 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 2011/09/11 04:56:11.0966 3520 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 2011/09/11 04:56:12.0231 3520 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys 2011/09/11 04:56:12.0293 3520 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys 2011/09/11 04:56:12.0481 3520 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys 2011/09/11 04:56:12.0637 3520 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys 2011/09/11 04:56:12.0808 3520 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys 2011/09/11 04:56:12.0902 3520 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 2011/09/11 04:56:12.0964 3520 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 2011/09/11 04:56:13.0105 3520 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 2011/09/11 04:56:13.0183 3520 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys 2011/09/11 04:56:13.0229 3520 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 2011/09/11 04:56:13.0619 3520 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 2011/09/11 04:56:13.0760 3520 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys 2011/09/11 04:56:13.0838 3520 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys 2011/09/11 04:56:13.0916 3520 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 2011/09/11 04:56:14.0087 3520 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 2011/09/11 04:56:14.0165 3520 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 2011/09/11 04:56:14.0321 3520 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys 2011/09/11 04:56:14.0477 3520 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys 2011/09/11 04:56:14.0758 3520 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 2011/09/11 04:56:14.0867 3520 RSUSBSTOR (3ceee53bbf8ba284ff44585cec0162fe) C:\Windows\System32\Drivers\RtsUStor.sys 2011/09/11 04:56:15.0117 3520 RTHDMIAzAudService (4e821c740a675f6d040be41d59a62b1d) C:\Windows\system32\drivers\RtHDMIVX.sys 2011/09/11 04:56:15.0242 3520 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys 2011/09/11 04:56:15.0367 3520 SCDEmu (b2f50286dc82b93c013e3fc57ba1a956) C:\Windows\system32\drivers\SCDEmu.sys 2011/09/11 04:56:15.0601 3520 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys 2011/09/11 04:56:15.0835 3520 SDHookDriver (d13f1f73269f28ce813ae0c64176b78d) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookDrv64.sys 2011/09/11 04:56:16.0100 3520 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 2011/09/11 04:56:16.0178 3520 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys 2011/09/11 04:56:16.0365 3520 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys 2011/09/11 04:56:16.0427 3520 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys 2011/09/11 04:56:16.0521 3520 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys 2011/09/11 04:56:16.0599 3520 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys 2011/09/11 04:56:16.0833 3520 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys 2011/09/11 04:56:16.0895 3520 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys 2011/09/11 04:56:17.0145 3520 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys 2011/09/11 04:56:17.0192 3520 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys 2011/09/11 04:56:17.0285 3520 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 2011/09/11 04:56:17.0535 3520 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 2011/09/11 04:56:17.0769 3520 srv (2098b8556d1cec2aca9a29cd479e3692) C:\Windows\system32\DRIVERS\srv.sys 2011/09/11 04:56:17.0941 3520 srv2 (d0f73a42040f21f92fd314b42ac5c9e7) C:\Windows\system32\DRIVERS\srv2.sys 2011/09/11 04:56:18.0003 3520 srvnet (2ba8f3250828ccdb4204ecf2c6f40b6a) C:\Windows\system32\DRIVERS\srvnet.sys 2011/09/11 04:56:18.0253 3520 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys 2011/09/11 04:56:18.0315 3520 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys 2011/09/11 04:56:18.0533 3520 SynTP (064a2530a4a7c7cec1be6a1945645be4) C:\Windows\system32\DRIVERS\SynTP.sys 2011/09/11 04:56:18.0736 3520 Tcpip (509383e505c973ed7534a06b3d19688d) C:\Windows\system32\drivers\tcpip.sys 2011/09/11 04:56:19.0017 3520 TCPIP6 (509383e505c973ed7534a06b3d19688d) C:\Windows\system32\DRIVERS\tcpip.sys 2011/09/11 04:56:19.0282 3520 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys 2011/09/11 04:56:19.0391 3520 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 2011/09/11 04:56:19.0579 3520 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys 2011/09/11 04:56:19.0766 3520 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys 2011/09/11 04:56:19.0859 3520 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys 2011/09/11 04:56:20.0125 3520 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys 2011/09/11 04:56:20.0249 3520 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys 2011/09/11 04:56:20.0437 3520 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys 2011/09/11 04:56:20.0561 3520 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys 2011/09/11 04:56:20.0717 3520 UBHelper (2e22c1fd397a5a9ffef55e9d1fc96c00) C:\Windows\system32\drivers\UBHelper.sys 2011/09/11 04:56:20.0842 3520 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys 2011/09/11 04:56:20.0951 3520 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys 2011/09/11 04:56:21.0185 3520 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys 2011/09/11 04:56:21.0248 3520 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys 2011/09/11 04:56:21.0451 3520 usbccgp (481dff26b4dca8f4cbac1f7dce1d6829) C:\Windows\system32\drivers\usbccgp.sys 2011/09/11 04:56:21.0669 3520 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys 2011/09/11 04:56:21.0778 3520 usbehci (2ea4aff7be7eb4632e3aa8595b0803b5) C:\Windows\system32\DRIVERS\usbehci.sys 2011/09/11 04:56:21.0919 3520 usbfilter (2c780746dc44a28fe67004dc58173f05) C:\Windows\system32\DRIVERS\usbfilter.sys 2011/09/11 04:56:22.0012 3520 usbhub (dc96bd9ccb8403251bcf25047573558e) C:\Windows\system32\drivers\usbhub.sys 2011/09/11 04:56:22.0044 3520 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys 2011/09/11 04:56:22.0106 3520 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 2011/09/11 04:56:22.0184 3520 USBSTOR (d76510cfa0fc09023077f22c2f979d86) C:\Windows\system32\DRIVERS\USBSTOR.SYS 2011/09/11 04:56:22.0309 3520 usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\DRIVERS\usbuhci.sys 2011/09/11 04:56:22.0449 3520 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys 2011/09/11 04:56:22.0590 3520 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys 2011/09/11 04:56:22.0808 3520 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 2011/09/11 04:56:22.0933 3520 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 2011/09/11 04:56:22.0995 3520 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys 2011/09/11 04:56:23.0198 3520 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys 2011/09/11 04:56:23.0292 3520 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys 2011/09/11 04:56:23.0416 3520 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys 2011/09/11 04:56:23.0604 3520 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys 2011/09/11 04:56:23.0806 3520 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys 2011/09/11 04:56:23.0900 3520 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys 2011/09/11 04:56:24.0072 3520 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys 2011/09/11 04:56:24.0165 3520 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys 2011/09/11 04:56:24.0368 3520 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 2011/09/11 04:56:24.0415 3520 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 2011/09/11 04:56:24.0696 3520 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys 2011/09/11 04:56:24.0789 3520 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 2011/09/11 04:56:25.0070 3520 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 2011/09/11 04:56:25.0132 3520 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 2011/09/11 04:56:25.0429 3520 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys 2011/09/11 04:56:25.0538 3520 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 2011/09/11 04:56:25.0678 3520 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys 2011/09/11 04:56:25.0756 3520 MBR (0x1B8) (035ce1c0bf49cb716bd6db7a4cf480b7) \Device\Harddisk0\DR0 2011/09/11 04:56:25.0772 3520 \Device\Harddisk0\DR0 - detected Rootkit.Win32.TDSS.tdl4 (0) 2011/09/11 04:56:25.0803 3520 Boot (0x1200) (e385b19ab0f96dd684f90369c9c60588) \Device\Harddisk0\DR0\Partition0 2011/09/11 04:56:25.0819 3520 ================================================================================ 2011/09/11 04:56:25.0819 3520 Scan finished 2011/09/11 04:56:25.0819 3520 ================================================================================ 2011/09/11 04:56:25.0834 3764 Detected object count: 4 2011/09/11 04:56:25.0834 3764 Actual detected object count: 4 2011/09/11 04:57:55.0832 3764 LockedFile.Multi.Generic(bakerneldrv) - User select action: Skip 2011/09/11 04:57:55.0832 3764 LockedFile.Multi.Generic(bapcmci) - User select action: Skip 2011/09/11 04:57:55.0847 3764 LockedFile.Multi.Generic(bpcrasys) - User select action: Skip 2011/09/11 04:57:55.0894 3764 \Device\Harddisk0\DR0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot 2011/09/11 04:57:55.0894 3764 \Device\Harddisk0\DR0 - ok 2011/09/11 04:57:55.0894 3764 Rootkit.Win32.TDSS.tdl4(\Device\Harddisk0\DR0) - User select action: Cure 2011/09/11 04:58:03.0335 4140 Deinitialize success (combofix) when i did this scan and rebooted it kept popping a window up saying "windows command process manager stopped working" or something along those lines ComboFix 11-09-11.05 - Esy 11/09/2011 13:11:50.2.1 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.2811.1466 [GMT -7:00] Running from: C:\Users\[removed]\Desktop\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Spybot - Search & Destroy *Disabled/Updated* {1EAF1D03-5480-F3B2-EB14-11F0F5EE2699} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Windows\system32\settings.ini —- Previous Run ——- C:\Windows\system32\settings.ini ((((((((((((((((((((((((( Files Created from 2011-08-11 to 2011-09-11 ))))))))))))))))))))))))))))))) 2011-10-03 19:16:16 . 2011-10-03 19:16:16 ——– d-sh–we C:\Users\Esy\AppData\Local\History 2011-10-03 19:16:16 . 2011-10-03 19:16:16 ——– d-sh–we C:\Users\Esy\AppData\Local\Application Data 2011-09-10 20:09:03 . 2011-09-10 20:09:03 ——– d—–w- C:\Windows\SysWow64\URTTEMP 2011-09-10 19:22:55 . 2011-09-10 19:22:55 ——– d—–w- C:\Program Files (x86)\SEGA 2011-09-10 19:21:36 . 2011-08-12 04:10:02 8862544 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{DD1402A5-4AA0-462A-A538-978F9BF5E954}\mpengine.dll 2011-09-09 21:54:35 . 2011-09-09 21:54:35 388096 —-a-r- C:\Users\Esy\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2011-09-09 21:54:33 . 2011-09-09 21:54:33 ——– d—–w- C:\Program Files (x86)\Trend Micro 2011-09-09 13:55:51 . 2011-09-09 14:03:07 ——– d—–w- C:\ProgramData\Blizzard Entertainment 2011-09-09 11:32:33 . 2011-09-09 11:32:33 ——– d—–w- C:\Users\Esy\AppData\Roaming\Malwarebytes 2011-09-09 11:32:17 . 2011-07-07 02:52:42 41272 —-a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys 2011-09-09 11:32:14 . 2011-09-09 11:32:14 ——– d—–w- C:\ProgramData\Malwarebytes 2011-09-09 11:32:06 . 2011-07-07 02:52:42 25912 —-a-w- C:\Windows\system32\drivers\mbam.sys 2011-09-09 11:32:05 . 2011-09-09 11:32:25 ——– d—–w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2011-09-09 08:01:19 . 2011-09-09 09:05:22 ——– d—–w- C:\Users\Public\Games 2011-09-09 07:49:54 . 2011-09-09 07:49:54 ——– d—–w- C:\ProgramData\Blizzard 2011-09-09 05:02:44 . 2011-09-09 09:07:19 ——– d—–w- C:\Program Files (x86)\Common Files\Blizzard Entertainment 2011-09-09 04:50:47 . 2011-09-09 04:55:42 ——– d—–w- C:\Users\Esy\AppData\Local\Tific 2011-09-09 04:50:47 . 2011-09-09 04:50:47 ——– d—–w- C:\Users\Esy\AppData\Roaming\Tific 2011-09-09 04:49:39 . 2011-09-09 04:49:39 ——– d—–w- C:\Windows\system32\drivers\NortonPCCheckupx64 2011-09-09 04:49:37 . 2011-09-09 04:49:54 ——– d—–w- C:\Program Files (x86)\Norton PC Checkup 2011-09-09 02:50:28 . 2011-09-09 02:50:28 ——– d—–w- C:\Program Files (x86)\1C Company 2011-09-09 00:49:17 . 2011-09-09 00:49:17 ——– d—–w- C:\Users\Esy\AppData\Roaming\The Creative Assembly 2011-09-09 00:48:01 . 2010-06-02 11:55:30 77656 —-a-w- C:\Windows\system32\XAPOFX1_5.dll 2011-09-09 00:48:01 . 2010-06-02 11:55:30 74072 —-a-w- C:\Windows\SysWow64\XAPOFX1_5.dll 2011-09-09 00:48:01 . 2010-06-02 11:55:30 527192 —-a-w- C:\Windows\SysWow64\XAudio2_7.dll 2011-09-09 00:48:01 . 2010-06-02 11:55:30 518488 —-a-w- C:\Windows\system32\XAudio2_7.dll 2011-09-09 00:46:57 . 2008-05-30 21:19:24 511496 —-a-w- C:\Windows\system32\XAudio2_1.dll 2011-09-09 00:45:59 . 2007-04-05 01:55:14 403304 —-a-w- C:\Windows\system32\xactengine2_7.dll 2011-09-09 00:44:49 . 2005-05-26 22:34:58 3767504 —-a-w- C:\Windows\system32\d3dx9_26.dll 2011-09-09 00:44:49 . 2005-05-26 22:34:52 2297552 —-a-w- C:\Windows\SysWow64\d3dx9_26.dll 2011-09-09 00:38:44 . 2011-09-09 00:38:44 ——– d—–w- C:\Program Files (x86)\Common Files\Steam 2011-09-09 00:38:24 . 2011-09-11 20:41:31 ——– d—–w- C:\Program Files (x86)\Steam 2011-09-09 00:34:53 . 2011-09-09 00:34:53 ——– d—–w- C:\ProgramData\UAB 2011-09-09 00:34:41 . 2011-09-09 00:34:41 ——– d—–w- C:\Users\Esy\AppData\Local\PC_Drivers_Headquarters 2011-09-09 00:34:05 . 2011-09-09 00:34:05 ——– d—–w- C:\ProgramData\PC Drivers HeadQuarters 2011-09-09 00:32:23 . 2011-09-09 00:32:23 ——– d—–w- C:\Program Files (x86)\PC Drivers HeadQuarters 2011-09-08 22:50:05 . 2011-09-09 01:41:36 ——– d—–w- C:\Games 2011-09-08 05:14:08 . 2011-09-08 05:14:08 8007680 ——r- C:\Windows\system32\Microsoft.mshtml.dll 2011-09-08 05:14:08 . 2011-09-08 05:14:08 126976 ——r- C:\Windows\system32\Interop.SHDocVw.dll 2011-09-08 05:10:00 . 2011-03-12 20:59:38 364032 –sha-r- C:\Windows\system32\vshadowamd64.exe 2011-09-08 05:10:00 . 2011-03-12 20:59:36 405504 –sha-r- C:\Windows\system32\vshadow.exe 2011-09-08 05:10:00 . 2011-03-12 20:59:36 352256 –sha-r- C:\Windows\system32\vshadowXP.exe 2011-09-08 05:08:33 . 2011-03-12 20:00:34 601424 ——w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{279F139F-E12A-4779-9814-0B426B2C3253}\gapaengine.dll 2011-09-08 01:01:39 . 2011-09-08 01:08:35 ——– d—–w- C:\79acb1d3152ca8786c7c 2011-09-08 00:25:43 . 2011-09-08 00:25:43 ——– d-sh–w- C:\Windows\SysWow64\%APPDATA% 2011-09-07 23:54:18 . 2011-09-07 23:54:18 ——– d—–w- C:\Program Files (x86)\Microsoft 2011-09-07 23:42:45 . 2011-09-09 03:00:25 ——– d–h–w- C:\Windows\msdownld.tmp 2011-09-07 21:57:37 . 2011-09-07 21:57:37 ——– d—–w- C:\Program Files (x86)\Bethesda Softworks 2011-09-07 21:54:52 . 2005-04-04 06:00:26 63488 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ISBEW64.exe 2011-09-07 21:54:51 . 2005-04-04 06:02:24 69714 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll 2011-09-07 21:54:51 . 2005-04-04 06:01:28 274432 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll 2011-09-07 21:54:51 . 2005-04-04 06:00:52 184320 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll 2011-09-07 21:54:51 . 2005-04-04 05:59:52 5632 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe 2011-09-07 21:54:50 . 2005-04-04 06:02:58 753664 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll 2011-09-07 21:54:49 . 2011-09-07 21:54:49 331908 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll 2011-09-07 21:54:49 . 2011-09-07 21:54:49 200836 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll 2011-09-07 21:54:32 . 2011-09-07 23:40:40 ——– d—–w- C:\Users\Esy\AppData\Local\Oblivion 2011-09-07 21:31:28 . 2011-06-15 08:30:46 93240 —-a-w- C:\Windows\system32\drivers\scdemu.sys 2011-09-07 21:31:27 . 2011-09-07 21:31:32 ——– d—–w- C:\Program Files (x86)\PowerISO 2011-09-07 21:12:57 . 2011-09-07 21:12:57 404640 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2011-09-07 17:36:11 . 2011-09-07 21:25:51 ——– d—–w- C:\Users\Esy\AppData\Local\Microsoft Games 2011-09-07 16:46:44 . 2011-09-07 20:17:15 ——– d—–w- C:\ProgramData\Spybot - Search & Destroy 2011-09-07 16:46:01 . 2009-01-25 20:14:02 17272 —-a-w- C:\Windows\system32\sdnclean64.exe 2011-09-07 16:45:53 . 2011-09-07 19:34:15 ——– d—–w- C:\Program Files (x86)\Spybot - Search & Destroy 2 2011-09-07 14:32:31 . 2011-03-12 20:00:34 601424 ——w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll 2011-09-07 14:15:24 . 2011-09-07 14:15:24 ——– d—–w- C:\Users\Esy\AppData\Local\ElevatedDiagnostics 2011-09-07 05:37:31 . 2011-09-07 05:37:31 ——– d—–w- C:\Users\Esy\AppData\Local\Mozilla 2011-09-07 05:31:01 . 2011-09-07 16:15:29 ——– d—–w- C:\Users\Esy\AppData\Local\Google 2011-09-07 05:28:04 . 2011-09-11 20:42:38 ——– d—–w- C:\Users\Esy\AppData\Local\Temp 2011-09-07 04:50:00 . 2011-09-07 04:50:00 ——– d—–w- C:\Program Files (x86)\SystemRequirementsLab 2011-09-07 04:48:36 . 2011-09-07 04:53:22 ——– d—–w- C:\Users\Esy\AppData\Roaming\SystemRequirementsLab 2011-09-07 04:47:45 . 2011-09-07 04:47:45 ——– d—–w- C:\Windows\Sun 2011-09-07 04:40:55 . 2011-09-07 04:41:10 ——– d—–w- C:\ProgramData\WinZip 2011-09-07 04:40:55 . 2011-09-07 04:40:56 ——– d—–w- C:\Users\Esy\AppData\Local\WinZip 2011-09-07 04:40:12 . 2011-09-10 20:21:43 ——– d—–w- C:\Users\Esy\AppData\Roaming\Azureus 2011-09-07 04:39:23 . 2011-09-07 04:39:36 ——– d—–w- C:\Program Files (x86)\Vuze . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2011-09-07 14:06:46 . 2010-06-24 20:33:56 18328 —-a-w- C:\ProgramData\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-08-12 04:10:02 . 2011-03-12 20:01:10 8862544 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2011-03-12 20:59:36 405504 –sha-r- C:\Windows\System32\vshadow.exe 2011-03-12 20:59:38 364032 –sha-r- C:\Windows\System32\vshadowamd64.exe 2011-03-12 20:59:36 352256 –sha-r- C:\Windows\System32\vshadowXP.exe ((((((((((((((((((((((((((((( SnapShot@2011-09-11_13.14.58 ))))))))))))))))))))))))))))))))))))))))) - 2011-09-07 04:44:16 . 2011-09-11 13:14:24 16384 C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat + 2011-09-07 04:44:16 . 2011-09-11 20:41:15 16384 C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat + 2009-07-14 06:10:34 . 2011-09-11 20:42:52 43196 C:\Windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2011-09-07 05:30:31 . 2011-09-11 20:41:19 16384 C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-09-07 05:30:31 . 2011-09-11 12:52:37 16384 C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-09-07 05:30:30 . 2011-09-11 20:41:19 49152 C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2011-09-07 05:30:30 . 2011-09-11 12:52:37 49152 C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2011-09-07 05:30:31 . 2011-09-11 12:52:37 32768 C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-09-07 05:30:31 . 2011-09-11 20:41:19 32768 C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-03-10 19:44:58 . 2011-09-11 20:42:52 6914 C:\Windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-721086422-525782586-966166575-1000_UserData.bin - 2011-09-11 12:19:08 . 2011-09-11 12:19:08 2048 C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2011-09-11 20:40:54 . 2011-09-11 20:40:54 2048 C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2011-09-11 20:40:54 . 2011-09-11 20:40:54 2048 C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2011-09-11 12:19:08 . 2011-09-11 12:19:08 2048 C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2011-09-07 05:30:58 . 2011-09-11 13:14:25 360448 C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-09-07 05:30:58 . 2011-09-11 20:41:14 360448 C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-03-11 08:53:16 . 2011-09-11 20:07:25 219984 C:\Windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin - 2009-07-14 06:01:48 . 2011-09-11 12:18:02 353168 C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 06:01:48 . 2011-09-11 20:40:01 353168 C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2011-09-07 05:30:57 . 2011-09-11 13:14:25 3227648 C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2011-09-07 05:30:57 . 2011-09-11 20:41:15 3227648 C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2011-09-07 05:30:58 . 2011-09-11 13:14:25 3522560 C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-09-07 05:30:58 . 2011-09-11 20:41:15 3522560 C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown REGEDIT4 Supplementary scan did not complete!

mowman

Post #10September 12, 2011, 1:09 PM UTC

Delete the copy of Combofix you have and download a fresh one from the links below,run it and post the new log.

Link 1
Link 2

Please scan the following files

Please visit Virus Total by clicking here.
Click the Browse button and search for the following file: C:\Windows\system32\Drivers\bakerneldrv64.sys
Click Open.
Then click Send File.
Please be patient while the file is scanned.
If Virus Total tells you that the file has already been scanned, click "reanalyse now".

Once the scan results appear, copy and paste them into Notepad and repeat the procedure for the following file(s):
C:\Windows\system32\Drivers\bapcmci64.sys
C:\Windows\system32\Drivers\bpcrasys64.sys
Please provide the results from the scans in your next reply.

naturegrl55

Post #11September 12, 2011, 9:51 PM UTC

Here is the new combofix log, and i tried to scan the files you listed but they won't show up when i try to browse for them on virus total. I made sure to click show hidden folder, files, system files and file extensions and i can see the files you want me to scan if i search for them, but as soon as i try to search after pressing browse on virus total they aren't there? ComboFix 11-09-12.03 - Esy 12/09/2011 14:11:20.3.1 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.2811.1858 [GMT -7:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Spybot - Search & Destroy *Disabled/Updated* {1EAF1D03-5480-F3B2-EB14-11F0F5EE2699} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\system32\settings.ini . —- Previous Run ——- . c:\windows\system32\settings.ini . . ((((((((((((((((((((((((( Files Created from 2011-08-12 to 2011-09-12 ))))))))))))))))))))))))))))))) . . 2011-10-03 19:16 . 2011-10-03 19:16 ——– d-sh–we c:\users\Esy\AppData\Local\History 2011-10-03 19:16 . 2011-10-03 19:16 ——– d-sh–we c:\users\Esy\AppData\Local\Application Data 2011-09-12 03:13 . 2011-09-12 05:27 ——– d—–w- c:\users\Esy\AppData\Roaming\.minecraft 2011-09-12 00:43 . 2011-09-12 00:43 ——– d—–w- c:\users\Esy\AppData\Roaming\WildTangent 2011-09-10 20:09 . 2011-09-10 20:09 ——– d—–w- c:\windows\SysWow64\URTTEMP 2011-09-10 19:22 . 2011-09-10 19:22 ——– d—–w- c:\program files (x86)\SEGA 2011-09-10 19:21 . 2011-08-12 04:10 8862544 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DD1402A5-4AA0-462A-A538-978F9BF5E954}\mpengine.dll 2011-09-09 21:54 . 2011-09-09 21:54 388096 —-a-r- c:\users\Esy\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2011-09-09 21:54 . 2011-09-09 21:54 ——– d—–w- c:\program files (x86)\Trend Micro 2011-09-09 13:55 . 2011-09-09 14:03 ——– d—–w- c:\programdata\Blizzard Entertainment 2011-09-09 11:32 . 2011-09-09 11:32 ——– d—–w- c:\users\Esy\AppData\Roaming\Malwarebytes 2011-09-09 11:32 . 2011-07-07 02:52 41272 —-a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys 2011-09-09 11:32 . 2011-09-09 11:32 ——– d—–w- c:\programdata\Malwarebytes 2011-09-09 11:32 . 2011-07-07 02:52 25912 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-09-09 11:32 . 2011-09-09 11:32 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2011-09-09 08:01 . 2011-09-09 09:05 ——– d—–w- c:\users\Public\Games 2011-09-09 07:49 . 2011-09-09 07:49 ——– d—–w- c:\programdata\Blizzard 2011-09-09 05:02 . 2011-09-09 09:07 ——– d—–w- c:\program files (x86)\Common Files\Blizzard Entertainment 2011-09-09 04:50 . 2011-09-09 04:55 ——– d—–w- c:\users\Esy\AppData\Local\Tific 2011-09-09 04:50 . 2011-09-09 04:50 ——– d—–w- c:\users\Esy\AppData\Roaming\Tific 2011-09-09 04:49 . 2011-09-09 04:49 ——– d—–w- c:\windows\system32\drivers\NortonPCCheckupx64 2011-09-09 04:49 . 2011-09-09 04:49 ——– d—–w- c:\program files (x86)\Norton PC Checkup 2011-09-09 02:50 . 2011-09-09 02:50 ——– d—–w- c:\program files (x86)\1C Company 2011-09-09 00:49 . 2011-09-09 00:49 ——– d—–w- c:\users\Esy\AppData\Roaming\The Creative Assembly 2011-09-09 00:48 . 2010-06-02 11:55 77656 —-a-w- c:\windows\system32\XAPOFX1_5.dll 2011-09-09 00:48 . 2010-06-02 11:55 74072 —-a-w- c:\windows\SysWow64\XAPOFX1_5.dll 2011-09-09 00:48 . 2010-06-02 11:55 527192 —-a-w- c:\windows\SysWow64\XAudio2_7.dll 2011-09-09 00:48 . 2010-06-02 11:55 518488 —-a-w- c:\windows\system32\XAudio2_7.dll 2011-09-09 00:46 . 2008-05-30 21:19 511496 —-a-w- c:\windows\system32\XAudio2_1.dll 2011-09-09 00:45 . 2007-04-05 01:55 403304 —-a-w- c:\windows\system32\xactengine2_7.dll 2011-09-09 00:44 . 2005-05-26 22:34 3767504 —-a-w- c:\windows\system32\d3dx9_26.dll 2011-09-09 00:44 . 2005-05-26 22:34 2297552 —-a-w- c:\windows\SysWow64\d3dx9_26.dll 2011-09-09 00:38 . 2011-09-09 00:38 ——– d—–w- c:\program files (x86)\Common Files\Steam 2011-09-09 00:38 . 2011-09-12 05:37 ——– d—–w- c:\program files (x86)\Steam 2011-09-09 00:34 . 2011-09-09 00:34 ——– d—–w- c:\programdata\UAB 2011-09-09 00:34 . 2011-09-09 00:34 ——– d—–w- c:\users\Esy\AppData\Local\PC_Drivers_Headquarters 2011-09-09 00:34 . 2011-09-09 00:34 ——– d—–w- c:\programdata\PC Drivers HeadQuarters 2011-09-09 00:32 . 2011-09-09 00:32 ——– d—–w- c:\program files (x86)\PC Drivers HeadQuarters 2011-09-08 22:50 . 2011-09-09 01:41 ——– d—–w- C:\Games 2011-09-08 05:14 . 2011-09-08 05:14 8007680 ——r- c:\windows\system32\Microsoft.mshtml.dll 2011-09-08 05:14 . 2011-09-08 05:14 126976 ——r- c:\windows\system32\Interop.SHDocVw.dll 2011-09-08 05:10 . 2011-03-12 20:59 364032 –sha-r- c:\windows\system32\vshadowamd64.exe 2011-09-08 05:10 . 2011-03-12 20:59 405504 –sha-r- c:\windows\system32\vshadow.exe 2011-09-08 05:10 . 2011-03-12 20:59 352256 –sha-r- c:\windows\system32\vshadowXP.exe 2011-09-08 05:08 . 2011-03-12 20:00 601424 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{279F139F-E12A-4779-9814-0B426B2C3253}\gapaengine.dll 2011-09-08 01:01 . 2011-09-08 01:08 ——– d—–w- C:\79acb1d3152ca8786c7c 2011-09-08 00:25 . 2011-09-08 00:25 ——– d-sh–w- c:\windows\SysWow64\%APPDATA% 2011-09-07 23:54 . 2011-09-07 23:54 ——– d—–w- c:\program files (x86)\Microsoft 2011-09-07 23:42 . 2011-09-09 03:00 ——– d–h–w- c:\windows\msdownld.tmp 2011-09-07 21:57 . 2011-09-07 21:57 ——– d—–w- c:\program files (x86)\Bethesda Softworks 2011-09-07 21:54 . 2005-04-04 06:00 63488 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ISBEW64.exe 2011-09-07 21:54 . 2005-04-04 06:02 69714 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll 2011-09-07 21:54 . 2005-04-04 06:01 274432 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll 2011-09-07 21:54 . 2005-04-04 06:00 184320 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll 2011-09-07 21:54 . 2005-04-04 05:59 5632 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe 2011-09-07 21:54 . 2005-04-04 06:02 753664 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll 2011-09-07 21:54 . 2011-09-07 21:54 331908 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll 2011-09-07 21:54 . 2011-09-07 21:54 200836 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll 2011-09-07 21:54 . 2011-09-07 23:40 ——– d—–w- c:\users\Esy\AppData\Local\Oblivion 2011-09-07 21:31 . 2011-06-15 08:30 93240 —-a-w- c:\windows\system32\drivers\scdemu.sys 2011-09-07 21:31 . 2011-09-07 21:31 ——– d—–w- c:\program files (x86)\PowerISO 2011-09-07 21:12 . 2011-09-07 21:12 404640 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2011-09-07 17:36 . 2011-09-07 21:25 ——– d—–w- c:\users\Esy\AppData\Local\Microsoft Games 2011-09-07 16:46 . 2011-09-07 20:17 ——– d—–w- c:\programdata\Spybot - Search & Destroy 2011-09-07 14:32 . 2011-03-12 20:00 601424 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll 2011-09-07 14:15 . 2011-09-07 14:15 ——– d—–w- c:\users\Esy\AppData\Local\ElevatedDiagnostics 2011-09-07 05:37 . 2011-09-07 05:37 ——– d—–w- c:\users\Esy\AppData\Local\Mozilla 2011-09-07 05:31 . 2011-09-07 16:15 ——– d—–w- c:\users\Esy\AppData\Local\Google 2011-09-07 05:28 . 2011-09-12 21:24 ——– d—–w- c:\users\Esy\AppData\Local\Temp 2011-09-07 04:50 . 2011-09-07 04:50 ——– d—–w- c:\program files (x86)\SystemRequirementsLab 2011-09-07 04:48 . 2011-09-07 04:53 ——– d—–w- c:\users\Esy\AppData\Roaming\SystemRequirementsLab 2011-09-07 04:47 . 2011-09-07 04:47 ——– d—–w- c:\windows\Sun 2011-09-07 04:40 . 2011-09-07 04:41 ——– d—–w- c:\programdata\WinZip 2011-09-07 04:40 . 2011-09-07 04:40 ——– d—–w- c:\users\Esy\AppData\Local\WinZip 2011-09-07 04:40 . 2011-09-12 10:41 ——– d—–w- c:\users\Esy\AppData\Roaming\Azureus 2011-09-07 04:39 . 2011-09-07 04:39 ——– d—–w- c:\program files (x86)\Vuze . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-09-07 14:06 . 2010-06-24 20:33 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-08-12 04:10 . 2011-03-12 20:01 8862544 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2011-03-12 20:59 405504 –sha-r- c:\windows\System32\vshadow.exe 2011-03-12 20:59 364032 –sha-r- c:\windows\System32\vshadowamd64.exe 2011-03-12 20:59 352256 –sha-r- c:\windows\System32\vshadowXP.exe . . ((((((((((((((((((((((((((((( SnapShot@2011-09-11_13.14.58 ))))))))))))))))))))))))))))))))))))))))) . - 2011-09-07 04:44 . 2011-09-11 13:14 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat + 2011-09-07 04:44 . 2011-09-12 21:02 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat + 2010-05-28 11:04 . 2011-09-12 21:25 32130 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 06:10 . 2011-09-12 21:25 43744 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin - 2011-09-07 05:30 . 2011-09-11 12:52 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-09-07 05:30 . 2011-09-12 21:22 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-09-07 05:30 . 2011-09-11 12:52 49152 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2011-09-07 05:30 . 2011-09-12 21:22 49152 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2011-09-07 05:30 . 2011-09-11 12:52 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-09-07 05:30 . 2011-09-12 21:22 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-09-07 21:33 . 2011-09-12 21:00 7300 c:\windows\system32\wdi\ERCQueuedResolutions.dat + 2011-03-10 19:44 . 2011-09-12 21:10 7358 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-721086422-525782586-966166575-1000_UserData.bin - 2011-09-11 12:19 . 2011-09-11 12:19 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2011-09-12 21:22 . 2011-09-12 21:22 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2011-09-11 12:19 . 2011-09-11 12:19 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2011-09-12 21:22 . 2011-09-12 21:22 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2011-09-07 05:30 . 2011-09-11 13:14 360448 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-09-07 05:30 . 2011-09-12 21:02 360448 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-03-11 08:53 . 2011-09-12 20:47 224976 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2009-07-14 06:01 . 2011-09-12 21:21 353168 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2009-07-14 06:01 . 2011-09-11 12:18 353168 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2011-09-08 01:18 . 2011-09-11 12:18 790552 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-721086422-525782586-966166575-1000-12288.dat + 2011-09-08 01:18 . 2011-09-12 21:00 790552 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-721086422-525782586-966166575-1000-12288.dat - 2011-09-07 05:30 . 2011-09-11 13:14 3227648 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2011-09-07 05:30 . 2011-09-12 21:02 3227648 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2011-09-07 05:30 . 2011-09-11 13:14 3522560 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-09-07 05:30 . 2011-09-12 21:02 3522560 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}] 2010-05-28 11:35 433648 —-a-w- c:\programdata\Partner\Partner.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2010-02-01 18:03 120176 —-a-w- c:\program files (x86)\EgisTec MyWinLocker\x86\PSDProtect.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2010-02-01 337264] "EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2009-12-25 201512] "EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2009-12-25 401192] "BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2010-03-08 260608] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-29 98304] "LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-05-28 1300560] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R0 akerneldrv;akerneldrv;c:\windows\system32\Drivers\akerneldrv64.sys [x] R0 apcmci;apcmci;c:\windows\system32\Drivers\apcmci64.sys [x] R0 pcrasys;pcrasys;c:\windows\system32\Drivers\pcrasys64.sys [x] R2 .Net bKernelSecurity;Microsoft.NET Framework KernelSecurity x2.0b;c:\windows\system32\bKernelSecurity.exe [x] R2 .Net bSecurityCrypt;Microsoft.NET Framework SecurityCrypt x2.0b;c:\windows\system32\bSecurityCrypt.exe [x] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 CNGKeyLock;CNG Key Isolation Service;c:\windows\system32\CNGKeyLock.exe [x] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-07 135664] R2 MicrosoftHardwareDriver;MicrosoftHardwareDriver;c:\windows\SysWOW64\sysDriverHardWare.exe [x] R2 SysCacheDriver;SysCacheDriver;c:\windows\SysWOW64\sysSecurityCheck.exe [x] R2 systemCheck;SystemWindows;c:\windows\SysWOW64\servicescache.exe [x] R3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [x] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-07 135664] R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x] R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [2010-02-01 305520] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616] R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-11-06 50432] R3 Partner Service;Partner Service;c:\programdata\Partner\Partner.exe [2010-05-28 332272] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] S0 bakerneldrv;bakerneldrv;c:\windows\system32\Drivers\bakerneldrv64.sys [x] S0 bapcmci;bapcmci;c:\windows\system32\Drivers\bapcmci64.sys [x] S0 bpcrasys;bpcrasys;c:\windows\system32\Drivers\bpcrasys64.sys [x] S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x] S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x] S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 .Net bKernelMain;Microsoft.NET Framework KernelMain x2.0b;c:\windows\system32\bKernelMain.exe [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2010-05-28 325200] S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2011-03-10 865824] S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-07 366640] S2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;c:\program files (x86)\Norton PC Checkup\Engine\2.0.12.27\SymcPCCULaunchSvc.exe [2011-05-03 123320] S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-03-08 250368] S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-11-06 144640] S2 PCCUJobMgr;Common Client Job Manager Service;c:\program files (x86)\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe [2011-05-03 126392] S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2010-05-28 243232] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [x] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x] S3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x] . . Contents of the 'Scheduled Tasks' folder . 2011-09-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-07 04:38] . 2011-09-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-07 04:38] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}] 2010-05-28 11:35 750064 —-a-w- c:\programdata\Partner\Partner64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2010-02-01 18:06 137584 —-a-w- c:\program files (x86)\EgisTec MyWinLocker\x64\PSDProtect.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-05-28 9644576] "mwlDaemon"="c:\program files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe" [2010-02-01 349552] "PLFSetI"="c:\windows\PLFSetI.exe" [2011-03-10 206208] "Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2011-03-10 860192] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 1436224] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ——- Supplementary Scan ——- . uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=1009&m=aspire_5251&r=27360311d305l0444z1i5t46n2l272 uLocal Page = c:\windows\system32\blank.htm mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=1009&m=aspire_5251&r=27360311d305l0444z1i5t46n2l272 mLocal Page = c:\windows\SysWOW64\blank.htm IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 IE: Google Sidewiki… - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html TCP: DhcpNameServer = 192.168.2.1 FF - ProfilePath - c:\users\Esy\AppData\Roaming\Mozilla\Firefox\Profiles\n5jrdjxn.default\ . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Toolbar-Locked - (no file) HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCCUJobMgr] "ImagePath"="\"c:\program files (x86)\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe\" /s \"PCCUJobMgr\" /m \"c:\program files (x86)\Norton PC Checkup\Engine\2.0.12.27\diMaster.dll\" /prefetch:1" . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\.Net bKernelMain] "ImagePath"="system32\bKernelMain.exe" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,5a,7b,b6,7d,cc,84,d1,45,81,71,55,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,5a,7b,b6,7d,cc,84,d1,45,81,71,55,\ . [HKEY_USERS\S-1-5-21-721086422-525782586-966166575-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" . [HKEY_USERS\S-1-5-21-721086422-525782586-966166575-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\DbgagD\1*] "value"="?\09\03\07\04')?" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2011-09-12 14:31:10 - machine was rebooted ComboFix-quarantined-files.txt 2011-09-12 21:31 . Pre-Run: 98,650,558,464 bytes free Post-Run: 98,578,497,536 bytes free . - - End Of File - - 958C151C53E3B41EB56C6B092667F101

mowman

Post #12September 12, 2011, 11:28 PM UTC

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Next

Run the following scan: Eset Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

naturegrl55

Post #13September 13, 2011, 2:03 AM UTC

Hey so the mbam log came out with no detections and same with eset Malwarebytes' Anti-Malware 1.51.1.1800 www.malwarebytes.org Database version: 7698 Windows 6.1.7601 Service Pack 1 Internet Explorer 8.0.7601.17514 12/09/2011 5:47:59 PM mbam-log-2011-09-12 (17-47-59).txt Scan type: Quick scan Objects scanned: 173736 Time elapsed: 3 minute(s), 51 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

mowman

Post #14September 13, 2011, 11:04 AM UTC

Open OTL,click run scan and post the new log,also tell me how the computer is running now.

naturegrl55

Post #15September 13, 2011, 11:59 AM UTC last edited September 13, 2011, 12:01 PM UTC

Hey, here's the OTL log. The computer seems to be running fine, but while to otl was scanning my microsoft security essentials blocked a virus called Tojan Alureon.A

OTL logfile created on: 13/09/2011 4:44:05 AM - Run 2
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Users\Esy\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

2.75 Gb Total Physical Memory | 1.85 Gb Available Physical Memory | 67.33% Memory free
5.49 Gb Paging File | 4.13 Gb Available in Paging File | 75.27% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 232.88 Gb Total Space | 88.80 Gb Free Space | 38.13% Space Free | Partition Type: NTFS
Drive D: | 2.76 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: ESY-PC | User Name: Esy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Esy\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\SymcPCCULaunchSvc.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.)
PRC - C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer Group)
PRC - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.)
PRC - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
PRC - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Acer Incorporated)
PRC - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)

========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Steam\bin\libcef.dll ()
MOD - C:\Program Files (x86)\Steam\bin\avcodec-52.dll ()
MOD - C:\Program Files (x86)\Steam\bin\chromehtml.dll ()
MOD - C:\Program Files (x86)\Steam\bin\avformat-52.dll ()
MOD - C:\Program Files (x86)\Steam\bin\avutil-50.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\Launch Manager\CdDirIo.dll ()
MOD - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll ()

========== Win32 Services (SafeList) ==========

SRV:64bit: - (.Net bKernelMain) – C:\Windows\SysNative\bKernelMain.exe ()
SRV:64bit: - (.Net bSecurityCrypt) – C:\Windows\SysNative\bSecurityCrypt.exe ()
SRV:64bit: - (.Net bKernelSecurity) – C:\Windows\SysNative\bKernelSecurity.exe ()
SRV:64bit: - (ePowerSvc) – C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated)
SRV:64bit: - (NisSrv) – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (Updater Service) – C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer Group)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (PCCUJobMgr) – C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe (Symantec Corporation)
SRV - (Norton PC Checkup Application Launcher) – C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\SymcPCCULaunchSvc.exe (Symantec Corporation)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (DsiWMIService) – C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.)
SRV - (Partner Service) – C:\ProgramData\Partner\Partner.exe (Google Inc.)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (NTI IScheduleSvc) – C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.)
SRV - (MWLService) – C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe (Egis Technology Inc.)
SRV - (GREGService) – C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Acer Incorporated)
SRV - (GameConsoleService) – C:\Program Files (x86)\Acer Games\Acer Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (bapcmci) – C:\Windows\SysNative\Drivers\bapcmci64.sys ()
DRV:64bit: - (bpcrasys) – C:\Windows\SysNative\Drivers\bpcrasys64.sys ()
DRV:64bit: - (bakerneldrv) – C:\Windows\SysNative\Drivers\bakerneldrv64.sys ()
DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (SCDEmu) – C:\Windows\SysNative\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV:64bit: - (dc3d) – C:\Windows\SysNative\drivers\dc3d.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (usbfilter) – C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)
DRV:64bit: - (NisDrv) – C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (RTHDMIAzAudService) – C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (k57nd60a) Broadcom NetLink ™ – C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atipmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (AtiPcie) AMD PCI Express (3GIO) – C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (NTIDrvr) – C:\Windows\SysNative\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV:64bit: - (UBHelper) – C:\Windows\SysNative\drivers\UBHelper.sys (NewTech Infosystems Corporation)
DRV:64bit: - (RSUSBSTOR) – C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (BCM43XX) – C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (mwlPSDVDisk) – C:\Windows\SysNative\drivers\mwlPSDVDisk.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDFilter) – C:\Windows\SysNative\drivers\mwlPSDFilter.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDNServ) – C:\Windows\SysNative\drivers\mwlPSDNserv.sys (Egis Technology Inc.)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…44z1i5t46n2l272
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…44z1i5t46n2l272

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…44z1i5t46n2l272
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60129.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/09/06 22:37:04 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2011/09/06 22:37:39 | 000,000,000 | —D | M] (No name found) – C:\Users\Esy\AppData\Roaming\mozilla\Extensions
[2011/09/07 09:22:28 | 000,000,000 | —D | M] (No name found) – C:\Users\Esy\AppData\Roaming\mozilla\Firefox\Profiles\n5jrdjxn.default\extensions
[2011/09/07 09:22:28 | 000,000,000 | —D | M] (WOT) – C:\Users\Esy\AppData\Roaming\mozilla\Firefox\Profiles\n5jrdjxn.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2011/09/06 22:37:04 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
() (No name found) – C:\USERS\ESY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\N5JRDJXN.DEFAULT\EXTENSIONS\{197573FA-9BF9-11DF-9D68-A441DFD72085}.XPI
[2011/09/02 23:01:45 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/09/02 16:25:59 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/09/12 14:24:01 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (no name) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No CLSID value found.
O2:64bit: - BHO: (Partner BHO Class) - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg64.dll (Google Inc.)
O2:64bit: - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - No CLSID value found.
O2 - BHO: (no name) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No CLSID value found.
O2 - BHO: (Partner BHO Class) - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [EgisUpdate] C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{205253D9-B0F2-46BE-B8C1-00D0A94B7D06}: DhcpNameServer = 10.110.15.1 10.110.15.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8ED535B8-6CC5-4FF6-857F-BBA7941983CA}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - Reg Error: Key error. File not found
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\AppData\Local\Temporary Internet Files
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\Templates
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\Start Menu
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\SendTo
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\Recent
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\PrintHood
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\NetHood
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\Documents\My Videos
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\Documents\My Pictures
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\Documents\My Music
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\My Documents
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\Local Settings
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\AppData\Local\History
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\Cookies
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\Application Data
[2011/10/03 12:16:16 | 000,000,000 | -HSD | C] – C:\Users\Esy\AppData\Local\Application Data
[2011/09/12 17:49:36 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2011/09/12 17:49:16 | 002,322,184 | —- | C] (ESET) – C:\Users\Esy\Desktop\esetsmartinstaller_enu.exe
[2011/09/12 13:55:28 | 004,203,719 | R— | C] (Swearware) – C:\Users\Esy\Desktop\ComboFix.exe
[2011/09/11 20:13:13 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\.minecraft
[2011/09/11 17:43:16 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\WildTangent
[2011/09/11 05:07:26 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/09/11 05:07:26 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/09/11 05:07:26 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/09/11 05:06:20 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2011/09/11 05:06:16 | 000,000,000 | —D | C] – C:\Qoobox
[2011/09/11 03:36:17 | 000,581,120 | —- | C] (OldTimer Tools) – C:\Users\Esy\Desktop\OTL.exe
[2011/09/11 03:20:14 | 001,916,416 | —- | C] (AVAST Software) – C:\Users\Esy\Desktop\aswMBR.exe
[2011/09/10 21:08:10 | 001,402,672 | —- | C] (Kaspersky Lab ZAO) – C:\Users\Esy\Desktop\TDSSKiller.exe
[2011/09/10 13:09:03 | 000,000,000 | —D | C] – C:\Windows\SysWow64\URTTEMP
[2011/09/10 12:22:55 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SEGA
[2011/09/10 12:22:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\SEGA
[2011/09/09 14:54:35 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011/09/09 14:54:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\Trend Micro
[2011/09/09 06:55:51 | 000,000,000 | —D | C] – C:\ProgramData\Blizzard Entertainment
[2011/09/09 04:32:33 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\Malwarebytes
[2011/09/09 04:32:17 | 000,041,272 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011/09/09 04:32:17 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/09/09 04:32:14 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/09/09 04:32:06 | 000,025,912 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2011/09/09 04:32:05 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011/09/09 03:23:12 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
[2011/09/09 02:06:25 | 000,000,000 | —D | C] – C:\Users\Public\Documents\Blizzard Entertainment
[2011/09/09 00:49:54 | 000,000,000 | —D | C] – C:\ProgramData\Blizzard
[2011/09/08 22:02:44 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Blizzard Entertainment
[2011/09/08 21:50:47 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\Tific
[2011/09/08 21:50:47 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Local\Tific
[2011/09/08 21:49:39 | 000,000,000 | —D | C] – C:\Windows\SysNative\drivers\NortonPCCheckupx64
[2011/09/08 21:49:39 | 000,000,000 | —D | C] – C:\Windows\SysNative\drivers\NortonPCCheckupx64\02000C0.01B
[2011/09/08 21:49:37 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton PC Checkup
[2011/09/08 21:49:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Norton PC Checkup
[2011/09/08 20:00:02 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\1C Company
[2011/09/08 19:50:28 | 000,000,000 | —D | C] – C:\Program Files (x86)\1C Company
[2011/09/08 18:25:34 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
[2011/09/08 17:49:17 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\The Creative Assembly
[2011/09/08 17:48:01 | 000,527,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAudio2_7.dll
[2011/09/08 17:48:01 | 000,518,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAudio2_7.dll
[2011/09/08 17:48:01 | 000,077,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAPOFX1_5.dll
[2011/09/08 17:48:01 | 000,074,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAPOFX1_5.dll
[2011/09/08 17:47:58 | 000,239,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine3_7.dll
[2011/09/08 17:47:58 | 000,176,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine3_7.dll
[2011/09/08 17:47:57 | 002,526,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_43.dll
[2011/09/08 17:47:57 | 002,106,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_43.dll
[2011/09/08 17:47:57 | 001,907,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dcsx_43.dll
[2011/09/08 17:47:57 | 001,868,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dcsx_43.dll
[2011/09/08 17:47:56 | 000,276,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx11_43.dll
[2011/09/08 17:47:56 | 000,248,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx11_43.dll
[2011/09/08 17:47:55 | 000,511,328 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_43.dll
[2011/09/08 17:47:55 | 000,470,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_43.dll
[2011/09/08 17:47:52 | 002,401,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX9_43.dll
[2011/09/08 17:47:52 | 001,998,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DX9_43.dll
[2011/09/08 17:47:50 | 000,530,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAudio2_6.dll
[2011/09/08 17:47:50 | 000,528,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAudio2_6.dll
[2011/09/08 17:47:50 | 000,078,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAPOFX1_4.dll
[2011/09/08 17:47:50 | 000,074,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAPOFX1_4.dll
[2011/09/08 17:47:48 | 000,238,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine3_6.dll
[2011/09/08 17:47:48 | 000,176,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine3_6.dll
[2011/09/08 17:47:46 | 000,024,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\X3DAudio1_7.dll
[2011/09/08 17:47:46 | 000,022,360 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\X3DAudio1_7.dll
[2011/09/08 17:47:44 | 000,517,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAudio2_5.dll
[2011/09/08 17:47:43 | 000,238,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine3_5.dll
[2011/09/08 17:47:43 | 000,176,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine3_5.dll
[2011/09/08 17:47:42 | 002,582,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_42.dll
[2011/09/08 17:47:42 | 001,974,616 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_42.dll
[2011/09/08 17:47:41 | 005,554,512 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dcsx_42.dll
[2011/09/08 17:47:41 | 005,501,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dcsx_42.dll
[2011/09/08 17:47:38 | 000,285,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx11_42.dll
[2011/09/08 17:47:38 | 000,235,344 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx11_42.dll
[2011/09/08 17:47:35 | 002,475,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX9_42.dll
[2011/09/08 17:47:35 | 001,892,184 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DX9_42.dll
[2011/09/08 17:47:33 | 002,430,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_41.dll
[2011/09/08 17:47:33 | 000,520,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_41.dll
[2011/09/08 17:47:31 | 005,425,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX9_41.dll
[2011/09/08 17:47:31 | 004,178,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DX9_41.dll
[2011/09/08 17:47:24 | 000,521,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAudio2_4.dll
[2011/09/08 17:47:24 | 000,517,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAudio2_4.dll
[2011/09/08 17:47:24 | 000,073,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAPOFX1_3.dll
[2011/09/08 17:47:22 | 000,235,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine3_4.dll
[2011/09/08 17:47:22 | 000,174,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine3_4.dll
[2011/09/08 17:47:21 | 000,024,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\X3DAudio1_6.dll
[2011/09/08 17:47:21 | 000,022,360 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\X3DAudio1_6.dll
[2011/09/08 17:47:20 | 002,605,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_40.dll
[2011/09/08 17:47:20 | 002,036,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_40.dll
[2011/09/08 17:47:20 | 000,519,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_40.dll
[2011/09/08 17:47:20 | 000,452,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_40.dll
[2011/09/08 17:47:18 | 005,631,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX9_40.dll
[2011/09/08 17:47:18 | 004,379,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DX9_40.dll
[2011/09/08 17:47:17 | 000,518,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAudio2_3.dll
[2011/09/08 17:47:17 | 000,514,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAudio2_3.dll
[2011/09/08 17:47:17 | 000,074,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAPOFX1_2.dll
[2011/09/08 17:47:17 | 000,070,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAPOFX1_2.dll
[2011/09/08 17:47:16 | 000,235,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine3_3.dll
[2011/09/08 17:47:16 | 000,175,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine3_3.dll
[2011/09/08 17:47:14 | 000,025,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\X3DAudio1_5.dll
[2011/09/08 17:47:14 | 000,023,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\X3DAudio1_5.dll
[2011/09/08 17:47:12 | 000,513,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAudio2_2.dll
[2011/09/08 17:47:12 | 000,509,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAudio2_2.dll
[2011/09/08 17:47:12 | 000,072,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAPOFX1_1.dll
[2011/09/08 17:47:12 | 000,068,616 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAPOFX1_1.dll
[2011/09/08 17:47:10 | 000,238,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine3_2.dll
[2011/09/08 17:47:10 | 000,177,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine3_2.dll
[2011/09/08 17:47:08 | 001,942,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_39.dll
[2011/09/08 17:47:08 | 001,493,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_39.dll
[2011/09/08 17:47:08 | 000,540,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_39.dll
[2011/09/08 17:47:08 | 000,467,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_39.dll
[2011/09/08 17:47:06 | 004,992,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX9_39.dll
[2011/09/08 17:47:06 | 003,851,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DX9_39.dll
[2011/09/08 17:46:57 | 000,511,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAudio2_1.dll
[2011/09/08 17:46:57 | 000,507,400 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAudio2_1.dll
[2011/09/08 17:46:57 | 000,068,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAPOFX1_0.dll
[2011/09/08 17:46:57 | 000,065,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAPOFX1_0.dll
[2011/09/08 17:46:53 | 000,238,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine3_1.dll
[2011/09/08 17:46:53 | 000,177,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine3_1.dll
[2011/09/08 17:46:50 | 000,028,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\X3DAudio1_4.dll
[2011/09/08 17:46:50 | 000,025,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\X3DAudio1_4.dll
[2011/09/08 17:46:48 | 001,941,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_38.dll
[2011/09/08 17:46:48 | 001,491,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_38.dll
[2011/09/08 17:46:48 | 000,540,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_38.dll
[2011/09/08 17:46:48 | 000,467,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_38.dll
[2011/09/08 17:46:46 | 004,991,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX9_38.dll
[2011/09/08 17:46:46 | 003,850,760 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DX9_38.dll
[2011/09/08 17:46:42 | 000,489,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAudio2_0.dll
[2011/09/08 17:46:42 | 000,479,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAudio2_0.dll
[2011/09/08 17:46:40 | 000,238,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine3_0.dll
[2011/09/08 17:46:40 | 000,177,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine3_0.dll
[2011/09/08 17:46:40 | 000,028,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\X3DAudio1_3.dll
[2011/09/08 17:46:40 | 000,025,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\X3DAudio1_3.dll
[2011/09/08 17:46:38 | 001,860,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_37.dll
[2011/09/08 17:46:38 | 001,420,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_37.dll
[2011/09/08 17:46:38 | 000,529,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_37.dll
[2011/09/08 17:46:38 | 000,462,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_37.dll
[2011/09/08 17:46:35 | 004,910,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX9_37.dll
[2011/09/08 17:46:35 | 003,786,760 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DX9_37.dll
[2011/09/08 17:46:31 | 000,411,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_10.dll
[2011/09/08 17:46:31 | 000,267,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_10.dll
[2011/09/08 17:46:28 | 002,006,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_36.dll
[2011/09/08 17:46:28 | 001,374,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_36.dll
[2011/09/08 17:46:28 | 000,508,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_36.dll
[2011/09/08 17:46:28 | 000,444,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_36.dll
[2011/09/08 17:46:27 | 005,081,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_36.dll
[2011/09/08 17:46:27 | 003,734,536 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_36.dll
[2011/09/08 17:46:15 | 000,411,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_9.dll
[2011/09/08 17:46:15 | 000,267,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_9.dll
[2011/09/08 17:46:12 | 001,985,904 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_35.dll
[2011/09/08 17:46:12 | 001,358,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_35.dll
[2011/09/08 17:46:12 | 000,508,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_35.dll
[2011/09/08 17:46:12 | 000,444,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_35.dll
[2011/09/08 17:46:08 | 005,073,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_35.dll
[2011/09/08 17:46:08 | 003,727,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_35.dll
[2011/09/08 17:46:05 | 000,409,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_8.dll
[2011/09/08 17:46:05 | 000,266,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_8.dll
[2011/09/08 17:46:05 | 000,021,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\X3DAudio1_2.dll
[2011/09/08 17:46:05 | 000,017,928 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\X3DAudio1_2.dll
[2011/09/08 17:46:04 | 001,401,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_34.dll
[2011/09/08 17:46:04 | 001,124,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_34.dll
[2011/09/08 17:46:04 | 000,506,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_34.dll
[2011/09/08 17:46:04 | 000,443,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_34.dll
[2011/09/08 17:46:03 | 004,496,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_34.dll
[2011/09/08 17:46:03 | 003,497,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_34.dll
[2011/09/08 17:46:02 | 000,107,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xinput1_3.dll
[2011/09/08 17:46:02 | 000,081,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xinput1_3.dll
[2011/09/08 17:45:59 | 000,403,304 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_7.dll
[2011/09/08 17:45:59 | 000,261,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_7.dll
[2011/09/08 17:45:58 | 000,506,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_33.dll
[2011/09/08 17:45:58 | 000,443,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_33.dll
[2011/09/08 17:45:57 | 001,400,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_33.dll
[2011/09/08 17:45:57 | 001,123,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_33.dll
[2011/09/08 17:45:55 | 004,494,184 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_33.dll
[2011/09/08 17:45:55 | 003,495,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_33.dll
[2011/09/08 17:45:51 | 000,393,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_6.dll
[2011/09/08 17:45:51 | 000,255,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_6.dll
[2011/09/08 17:45:45 | 000,469,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10.dll
[2011/09/08 17:45:45 | 000,440,080 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10.dll
[2011/09/08 17:45:45 | 000,390,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_5.dll
[2011/09/08 17:45:45 | 000,251,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_5.dll
[2011/09/08 17:45:36 | 000,364,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_4.dll
[2011/09/08 17:45:36 | 000,237,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_4.dll
[2011/09/08 17:45:36 | 000,017,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\x3daudio1_1.dll
[2011/09/08 17:45:36 | 000,015,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\x3daudio1_1.dll
[2011/09/08 17:45:35 | 003,977,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_31.dll
[2011/09/08 17:45:35 | 002,414,360 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_31.dll
[2011/09/08 17:45:33 | 000,363,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_3.dll
[2011/09/08 17:45:33 | 000,236,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_3.dll
[2011/09/08 17:45:32 | 000,083,736 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xinput1_2.dll
[2011/09/08 17:45:32 | 000,062,744 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xinput1_2.dll
[2011/09/08 17:45:30 | 000,354,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_2.dll
[2011/09/08 17:45:30 | 000,230,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_2.dll
[2011/09/08 17:45:29 | 000,083,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xinput1_1.dll
[2011/09/08 17:45:29 | 000,062,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xinput1_1.dll
[2011/09/08 17:45:26 | 000,352,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_1.dll
[2011/09/08 17:45:26 | 000,229,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_1.dll
[2011/09/08 17:45:03 | 003,927,248 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_30.dll
[2011/09/08 17:45:03 | 002,388,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_30.dll
[2011/09/08 17:45:00 | 000,355,536 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine2_0.dll
[2011/09/08 17:45:00 | 000,230,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine2_0.dll
[2011/09/08 17:45:00 | 000,016,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\x3daudio1_0.dll
[2011/09/08 17:45:00 | 000,014,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\x3daudio1_0.dll
[2011/09/08 17:44:59 | 003,830,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_29.dll
[2011/09/08 17:44:59 | 002,332,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_29.dll
[2011/09/08 17:44:57 | 003,815,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_28.dll
[2011/09/08 17:44:57 | 002,323,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_28.dll
[2011/09/08 17:44:49 | 003,767,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_26.dll
[2011/09/08 17:44:49 | 002,297,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_26.dll
[2011/09/08 17:44:48 | 003,823,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_25.dll
[2011/09/08 17:44:48 | 002,337,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_25.dll
[2011/09/08 17:44:46 | 003,544,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_24.dll
[2011/09/08 17:44:46 | 002,222,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_24.dll
[2011/09/08 17:38:44 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Steam
[2011/09/08 17:38:28 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
[2011/09/08 17:38:24 | 000,000,000 | —D | C] – C:\Program Files (x86)\Steam
[2011/09/08 17:34:53 | 000,000,000 | —D | C] – C:\ProgramData\UAB
[2011/09/08 17:34:41 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Local\PC_Drivers_Headquarters
[2011/09/08 17:34:05 | 000,000,000 | —D | C] – C:\ProgramData\PC Drivers HeadQuarters
[2011/09/08 17:32:32 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Detective
[2011/09/08 17:32:23 | 000,000,000 | —D | C] – C:\Program Files (x86)\PC Drivers HeadQuarters
[2011/09/08 15:50:05 | 000,000,000 | —D | C] – C:\Games
[2011/09/07 22:14:08 | 008,007,680 | R— | C] ( ) – C:\Windows\SysNative\Microsoft.mshtml.dll
[2011/09/07 22:14:08 | 000,126,976 | R— | C] ( ) – C:\Windows\SysNative\Interop.SHDocVw.dll
[2011/09/07 18:01:39 | 000,000,000 | —D | C] – C:\79acb1d3152ca8786c7c
[2011/09/07 17:40:48 | 000,000,000 | —D | C] – C:\Config.Msi
[2011/09/07 17:25:43 | 000,000,000 | -HSD | C] – C:\Windows\SysWow64\%APPDATA%
[2011/09/07 16:54:18 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft
[2011/09/07 16:42:23 | 000,000,000 | —D | C] – C:\Windows\SysWow64\directx
[2011/09/07 16:38:31 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2011/09/07 16:17:01 | 000,000,000 | —D | C] – C:\Users\Esy\Documents\HGECBody_v1dot21
[2011/09/07 15:26:39 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oblivion Mod Manager
[2011/09/07 15:00:39 | 003,807,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9_27.dll
[2011/09/07 15:00:39 | 002,319,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9_27.dll
[2011/09/07 14:57:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Bethesda Softworks
[2011/09/07 14:57:34 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bethesda Softworks
[2011/09/07 14:54:32 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Local\Oblivion
[2011/09/07 14:54:32 | 000,000,000 | —D | C] – C:\Users\Esy\Documents\My Games
[2011/09/07 14:31:33 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO
[2011/09/07 14:31:28 | 000,093,240 | —- | C] (PowerISO Computing, Inc.) – C:\Windows\SysNative\drivers\scdemu.sys
[2011/09/07 14:31:27 | 000,000,000 | —D | C] – C:\Program Files (x86)\PowerISO
[2011/09/07 14:12:57 | 000,404,640 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011/09/07 10:36:11 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Local\Microsoft Games
[2011/09/07 09:46:44 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2011/09/07 07:15:24 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Local\ElevatedDiagnostics
[2011/09/07 07:05:43 | 000,000,000 | —D | C] – C:\Windows\Minidump
[2011/09/06 22:37:31 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\Mozilla
[2011/09/06 22:37:31 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Local\Mozilla
[2011/09/06 22:37:04 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2011/09/06 22:31:02 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\Google
[2011/09/06 22:31:01 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Local\Google
[2011/09/06 22:28:04 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Local\Temp
[2011/09/06 22:21:56 | 000,000,000 | —D | C] – C:\Windows\temp
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\ProgramData\Templates
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\ProgramData\Start Menu
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\Users\Public\Documents\My Videos
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\Users\Public\Documents\My Pictures
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\Users\Public\Documents\My Music
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\ProgramData\Favorites
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\Documents and Settings
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\ProgramData\Documents
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\ProgramData\Desktop
[2011/09/06 22:18:21 | 000,000,000 | -HSD | C] – C:\ProgramData\Application Data
[2011/09/06 22:16:47 | 000,000,000 | —D | C] – C:\OEM
[2011/09/06 21:50:00 | 000,000,000 | —D | C] – C:\Program Files (x86)\SystemRequirementsLab
[2011/09/06 21:48:36 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\SystemRequirementsLab
[2011/09/06 21:47:45 | 000,000,000 | —D | C] – C:\Windows\Sun
[2011/09/06 21:44:39 | 000,000,000 | —D | C] – C:\Users\Esy\Documents\Vuze Downloads
[2011/09/06 21:41:04 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip
[2011/09/06 21:40:55 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Local\WinZip
[2011/09/06 21:40:55 | 000,000,000 | —D | C] – C:\ProgramData\WinZip
[2011/09/06 21:40:44 | 000,000,000 | —D | C] – C:\Program Files (x86)\WinZip
[2011/09/06 21:40:12 | 000,000,000 | —D | C] – C:\Users\Esy\AppData\Roaming\Azureus
[2011/09/06 21:39:23 | 000,000,000 | —D | C] – C:\Program Files (x86)\Vuze
[2011/03/12 12:52:10 | 008,007,680 | —- | C] ( ) – C:\Windows\SysWow64\Microsoft.mshtml.dll
[2011/03/12 12:52:10 | 000,126,976 | —- | C] ( ) – C:\Windows\SysWow64\Interop.SHDocVw.dll
[2011/03/10 12:23:10 | 000,049,464 | —- | C] ( ) – C:\Windows\AutosetFrequency.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/09/13 04:40:01 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/09/13 04:40:00 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/09/13 04:00:56 | 000,025,308 | RHS- | M] () – C:\Windows\SysNative\masteraclini.enu
[2011/09/13 04:00:56 | 000,000,116 | RH– | M] () – C:\Windows\SysNative\masteraclbini.enu
[2011/09/12 23:07:46 | 000,001,171 | —- | M] () – C:\Users\Public\Desktop\World of Warcraft.lnk
[2011/09/12 19:59:03 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/09/12 17:49:20 | 002,322,184 | —- | M] (ESET) – C:\Users\Esy\Desktop\esetsmartinstaller_enu.exe
[2011/09/12 14:33:21 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/09/12 14:33:21 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/09/12 14:24:01 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2011/09/12 14:22:01 | 2210,578,432 | -HS- | M] () – C:\hiberfil.sys
[2011/09/12 13:55:38 | 004,203,719 | R— | M] (Swearware) – C:\Users\Esy\Desktop\ComboFix.exe
[2011/09/11 22:37:21 | 000,005,887 | —- | M] () – C:\Users\Esy\Desktop\Minecraft.lnk
[2011/09/11 19:19:23 | 004,194,322 | —- | M] () – C:\memory_map.tga
[2011/09/11 03:36:20 | 000,581,120 | —- | M] (OldTimer Tools) – C:\Users\Esy\Desktop\OTL.exe
[2011/09/11 03:35:51 | 000,000,512 | —- | M] () – C:\Users\Esy\Desktop\MBR.dat
[2011/09/11 03:20:25 | 001,916,416 | —- | M] (AVAST Software) – C:\Users\Esy\Desktop\aswMBR.exe
[2011/09/10 21:08:10 | 001,402,672 | —- | M] (Kaspersky Lab ZAO) – C:\Users\Esy\Desktop\TDSSKiller.exe
[2011/09/10 15:12:29 | 000,002,169 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War Teutonic.lnk
[2011/09/10 15:07:15 | 000,002,169 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War Crusades.lnk
[2011/09/10 15:03:14 | 000,002,179 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War Britannia.lnk
[2011/09/10 14:59:20 | 000,002,169 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War Americas.lnk
[2011/09/10 13:15:05 | 000,002,111 | —- | M] () – C:\Users\Public\Desktop\Medieval II Total War.lnk
[2011/09/10 13:10:28 | 000,738,602 | —- | M] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/09/10 13:10:28 | 000,638,888 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2011/09/10 13:10:28 | 000,115,302 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2011/09/10 12:55:05 | 000,000,219 | —- | M] () – C:\Users\Esy\Desktop\Day of Defeat Source.url
[2011/09/09 14:54:35 | 000,002,965 | —- | M] () – C:\Users\Esy\Desktop\HiJackThis.lnk
[2011/09/09 06:11:14 | 000,729,688 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2011/09/09 04:32:18 | 000,001,109 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/09/08 21:50:14 | 000,002,334 | —- | M] () – C:\Users\Public\Desktop\Norton PC Checkup.LNK
[2011/09/08 20:00:10 | 000,002,272 | —- | M] () – C:\Users\Esy\Desktop\Men of War. Assault Squad.lnk
[2011/09/08 19:12:05 | 000,001,186 | —- | M] () – C:\Users\Esy\Desktop\Empire Total War.lnk
[2011/09/08 19:11:46 | 000,001,457 | —- | M] () – C:\Users\Esy\Desktop\MoW Red Tide.lnk
[2011/09/08 17:38:54 | 000,000,921 | —- | M] () – C:\Users\Public\Desktop\Steam.lnk
[2011/09/08 17:32:33 | 000,002,477 | —- | M] () – C:\Users\Public\Desktop\Driver Detective.lnk
[2011/09/08 17:27:44 | 000,001,162 | —- | M] () – C:\Users\Public\Desktop\Install Microsoft IntelliPoint.lnk
[2011/09/08 17:27:23 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01009.Wdf
[2011/09/07 23:10:12 | 000,000,023 | —- | M] () – C:\Windows\BlendSettings.ini
[2011/09/07 22:58:16 | 000,007,601 | —- | M] () – C:\Users\Esy\AppData\Local\resmon.resmoncfg
[2011/09/07 22:14:09 | 000,096,520 | RH– | M] () – C:\Windows\SysNative\bFireWallDart.exe
[2011/09/07 22:14:08 | 008,007,680 | R— | M] ( ) – C:\Windows\SysNative\Microsoft.mshtml.dll
[2011/09/07 22:14:08 | 000,126,976 | R— | M] ( ) – C:\Windows\SysNative\Interop.SHDocVw.dll
[2011/09/07 22:14:07 | 001,369,088 | RH– | M] () – C:\Windows\SysNative\7z.dll
[2011/09/07 22:14:07 | 000,256,000 | RH– | M] () – C:\Windows\SysNative\SevenZipSharp.dll
[2011/09/07 22:14:07 | 000,200,704 | R— | M] () – C:\Windows\SysNative\ICSharpCode.SharpZipLib.dll
[2011/09/07 22:14:07 | 000,061,704 | RH– | M] () – C:\Windows\SysNative\bmessagePop.exe
[2011/09/07 22:14:06 | 002,493,192 | RH– | M] () – C:\Windows\SysNative\bwinLogonUser.exe
[2011/09/07 22:14:06 | 002,493,192 | RH– | M] () – C:\Windows\SysNative\bwinLogonSystem.exe
[2011/09/07 22:14:02 | 000,000,039 | RHS- | M] () – C:\Windows\SysNative\masteracl.enu
[2011/09/07 22:09:58 | 000,043,602 | -H– | M] () – C:\Windows\SysWow64\masteraclini.enu
[2011/09/07 22:09:56 | 008,865,032 | RH– | M] () – C:\Windows\SysNative\bKernelMain.exe
[2011/09/07 22:09:49 | 009,029,384 | RH– | M] () – C:\Windows\SysNative\bSecurityCrypt.exe
[2011/09/07 22:09:42 | 009,034,504 | RH– | M] () – C:\Windows\SysNative\bKernelSecurity.exe
[2011/09/07 22:09:30 | 000,019,592 | —- | M] () – C:\Windows\SysNative\drivers\bapcmci64.sys
[2011/09/07 22:09:30 | 000,016,520 | —- | M] () – C:\Windows\SysNative\drivers\bpcrasys64.sys
[2011/09/07 22:09:29 | 000,020,616 | —- | M] () – C:\Windows\SysNative\drivers\bakerneldrv64.sys
[2011/09/07 22:06:15 | 142,219,065 | —- | M] () – C:\Windows\MEMORY.DMP
[2011/09/07 15:13:51 | 000,000,032 | —- | M] () – C:\Windows\CD_Start.INI
[2011/09/07 15:12:58 | 000,002,164 | —- | M] () – C:\Users\Public\Desktop\Oblivion.lnk
[2011/09/07 14:31:35 | 000,001,007 | —- | M] () – C:\Users\Public\Desktop\PowerISO.lnk
[2011/09/07 14:12:57 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011/09/06 22:37:09 | 000,001,138 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/09/06 22:30:25 | 000,001,437 | —- | M] () – C:\Users\Esy\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/09/06 22:23:52 | 001,056,768 | —- | M] () – C:\Windows\SysWow64\defltbase.sdb
[2011/09/06 22:22:53 | 000,368,312 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2011/09/06 21:41:04 | 000,002,319 | —- | M] () – C:\Users\Public\Desktop\WinZip.lnk
[2011/09/06 21:39:38 | 000,001,848 | —- | M] () – C:\Users\Public\Desktop\Vuze.lnk
[2011/09/06 21:39:38 | 000,001,848 | —- | M] () – C:\Users\Esy\Application Data\Microsoft\Internet Explorer\Quick Launch\Vuze.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/09/11 22:37:21 | 000,005,887 | —- | C] () – C:\Users\Esy\Desktop\Minecraft.lnk
[2011/09/11 19:19:23 | 004,194,322 | —- | C] () – C:\memory_map.tga
[2011/09/11 05:07:26 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2011/09/11 05:07:26 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2011/09/11 05:07:26 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/09/11 05:07:26 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/09/11 05:07:26 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/09/11 03:35:51 | 000,000,512 | —- | C] () – C:\Users\Esy\Desktop\MBR.dat
[2011/09/10 15:12:29 | 000,002,169 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War Teutonic.lnk
[2011/09/10 15:07:15 | 000,002,169 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War Crusades.lnk
[2011/09/10 15:03:14 | 000,002,179 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War Britannia.lnk
[2011/09/10 14:59:20 | 000,002,169 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War Americas.lnk
[2011/09/10 12:55:05 | 000,000,219 | —- | C] () – C:\Users\Esy\Desktop\Day of Defeat Source.url
[2011/09/10 12:31:59 | 000,002,111 | —- | C] () – C:\Users\Public\Desktop\Medieval II Total War.lnk
[2011/09/09 14:54:35 | 000,002,965 | —- | C] () – C:\Users\Esy\Desktop\HiJackThis.lnk
[2011/09/09 04:32:18 | 000,001,109 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/09/08 22:46:53 | 000,001,171 | —- | C] () – C:\Users\Public\Desktop\World of Warcraft.lnk
[2011/09/08 21:50:14 | 000,002,334 | —- | C] () – C:\Users\Public\Desktop\Norton PC Checkup.LNK
[2011/09/08 21:49:39 | 000,000,172 | —- | C] () – C:\Windows\SysNative\drivers\NortonPCCheckupx64\02000C0.01B\isolate.ini
[2011/09/08 20:00:10 | 000,002,272 | —- | C] () – C:\Users\Esy\Desktop\Men of War. Assault Squad.lnk
[2011/09/08 19:12:05 | 000,001,186 | —- | C] () – C:\Users\Esy\Desktop\Empire Total War.lnk
[2011/09/08 19:11:46 | 000,001,457 | —- | C] () – C:\Users\Esy\Desktop\MoW Red Tide.lnk
[2011/09/08 17:38:54 | 000,000,921 | —- | C] () – C:\Users\Public\Desktop\Steam.lnk
[2011/09/08 17:32:32 | 000,002,477 | —- | C] () – C:\Users\Public\Desktop\Driver Detective.lnk
[2011/09/08 17:27:44 | 000,001,162 | —- | C] () – C:\Users\Public\Desktop\Install Microsoft IntelliPoint.lnk
[2011/09/08 17:27:23 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01009.Wdf
[2011/09/07 22:14:08 | 000,096,520 | RH– | C] () – C:\Windows\SysNative\bFireWallDart.exe
[2011/09/07 22:14:07 | 001,369,088 | RH– | C] () – C:\Windows\SysNative\7z.dll
[2011/09/07 22:14:07 | 000,256,000 | RH– | C] () – C:\Windows\SysNative\SevenZipSharp.dll
[2011/09/07 22:14:07 | 000,200,704 | R— | C] () – C:\Windows\SysNative\ICSharpCode.SharpZipLib.dll
[2011/09/07 22:14:06 | 002,493,192 | RH– | C] () – C:\Windows\SysNative\bwinLogonUser.exe
[2011/09/07 22:14:06 | 000,061,704 | RH– | C] () – C:\Windows\SysNative\bmessagePop.exe
[2011/09/07 22:14:05 | 002,493,192 | RH– | C] () – C:\Windows\SysNative\bwinLogonSystem.exe
[2011/09/07 22:10:00 | 000,405,504 | RHS- | C] () – C:\Windows\SysNative\vshadow.exe
[2011/09/07 22:10:00 | 000,364,032 | RHS- | C] () – C:\Windows\SysNative\vshadowamd64.exe
[2011/09/07 22:10:00 | 000,352,256 | RHS- | C] () – C:\Windows\SysNative\vshadowXP.exe
[2011/09/07 22:09:57 | 008,865,032 | RH– | C] () – C:\Windows\SysNative\bKernelMain.exe
[2011/09/07 22:09:49 | 009,029,384 | RH– | C] () – C:\Windows\SysNative\bSecurityCrypt.exe
[2011/09/07 22:09:41 | 009,034,504 | RH– | C] () – C:\Windows\SysNative\bKernelSecurity.exe
[2011/09/07 22:09:30 | 000,019,592 | —- | C] () – C:\Windows\SysNative\drivers\bapcmci64.sys
[2011/09/07 22:09:30 | 000,016,520 | —- | C] () – C:\Windows\SysNative\drivers\bpcrasys64.sys
[2011/09/07 22:09:29 | 000,020,616 | —- | C] () – C:\Windows\SysNative\drivers\bakerneldrv64.sys
[2011/09/07 16:39:57 | 000,000,023 | —- | C] () – C:\Windows\BlendSettings.ini
[2011/09/07 15:13:51 | 000,000,032 | —- | C] () – C:\Windows\CD_Start.INI
[2011/09/07 15:12:58 | 000,002,164 | —- | C] () – C:\Users\Public\Desktop\Oblivion.lnk
[2011/09/07 14:31:35 | 000,001,007 | —- | C] () – C:\Users\Public\Desktop\PowerISO.lnk
[2011/09/07 08:06:27 | 000,007,601 | —- | C] () – C:\Users\Esy\AppData\Local\resmon.resmoncfg
[2011/09/07 07:05:25 | 142,219,065 | —- | C] () – C:\Windows\MEMORY.DMP
[2011/09/07 04:00:00 | 000,000,039 | RHS- | C] () – C:\Windows\SysNative\masteracl.enu
[2011/09/06 22:37:09 | 000,001,150 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011/09/06 22:37:09 | 000,001,138 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/09/06 22:30:25 | 000,001,437 | —- | C] () – C:\Users\Esy\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/09/06 22:23:50 | 001,056,768 | —- | C] () – C:\Windows\SysWow64\defltbase.sdb
[2011/09/06 22:21:36 | 2210,578,432 | -HS- | C] () – C:\hiberfil.sys
[2011/09/06 21:41:04 | 000,002,319 | —- | C] () – C:\Users\Public\Desktop\WinZip.lnk
[2011/09/06 21:39:38 | 000,001,848 | —- | C] () – C:\Users\Public\Desktop\Vuze.lnk
[2011/09/06 21:39:38 | 000,001,848 | —- | C] () – C:\Users\Esy\Application Data\Microsoft\Internet Explorer\Quick Launch\Vuze.lnk
[2011/09/06 21:39:38 | 000,001,848 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vuze.lnk
[2011/09/06 21:38:31 | 000,000,898 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/09/06 21:38:29 | 000,000,894 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/03/12 12:54:28 | 000,738,602 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/03/10 12:23:10 | 000,632,056 | —- | C] () – C:\Windows\Image.dll
[2011/03/10 12:23:10 | 000,206,208 | —- | C] () – C:\Windows\PLFSetI.exe
[2011/03/10 12:23:10 | 000,025,848 | —- | C] () – C:\Windows\USB_VIDEO_REG.exe
[2011/03/10 12:23:10 | 000,000,637 | —- | C] () – C:\Windows\AutoSetFrequency.ini
[2011/03/10 12:23:10 | 000,000,378 | —- | C] () – C:\Windows\PidList.ini
[2011/03/10 08:47:04 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2010/05/28 04:51:36 | 000,002,093 | —- | C] () – C:\Windows\SysWow64\atipblag.dat
[2009/07/13 23:38:36 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/13 20:35:50 | 000,000,741 | —- | C] () – C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 20:34:42 | 000,215,943 | —- | C] () – C:\Windows\SysWow64\dssec.dat
[2009/07/13 18:10:28 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 17:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 15:03:58 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 15:26:10 | 000,673,088 | —- | C] () – C:\Windows\SysWow64\mlang.dat

< End of report >

this is what the microsoft security essentials said. i also have a different virus in the mse quarantine, should i delete it?

Category: Trojan

Description: This program is dangerous and executes commands from an attacker.

Recommended action: Remove this software immediately.

Security Essentials detected programs that may compromise your privacy or damage your computer. You can still access the files that these programs use without removing them (not recommended). To access these files, select the Allow action and click Apply actions. If this option is not available, log on as administrator or ask the security administrator for help.

Items:
file:C:\Users\Esy\Desktop\MBR.dat

Get more information about this item online. (it recommended that i remove it so i clicked remove)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

3 different trojans and PING.exe process using 100% CPU

✨ Ask AI

Ask AI