Spyware / Malware / Virus Removal
Search redirects and random new tabs to testendonline.com
26 min read
Page 1 of 2
Next →
This thread's last reply is from October 17, 2011, 4:06 PM UTC . Advice, software, and links
below may be out of date — treat specific steps and download links with caution.
Looking for the outcome? ✨ Ask AI
Been having some issues recently. I had the fake OpenCloud scanner and got rid of that last week, then got AVgaurd yesterday and also got rid of that. But I'm still having my searches redirected and occasionally new tabs will open to sites like testendonline.com telling me I won something. I followed the process of running ATF Cleaner, Gooredfix, and tdsskiller to no avail. Logs are below. Thank you in advance for your help!!
GooredFix by jpshortstuff (03.07.10.1)
Log created at 21:56 on 06/10/2011 (Alex)
Firefox version 6.0.2 (en-US)
========== GooredScan ==========
(none)
========== GooredLog ==========
C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [05:08 23/07/2011]
{AB2CE124-6272-4b12-94A9-7303C7397BD1} [14:01 12/10/2010]
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [03:55 19/11/2010]
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [20:39 14/09/2011]
C:\Users\Alex\Application Data\Mozilla\Firefox\Profiles\j3kpu51f.default\extensions\
(none)
[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{ABDE892B-13A8-4d1b-88E6-365A6E755758}"="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext" [14:18 01/12/2010]
———- Old Logs ———-
GooredFix[01.56.05_07-10-2011].txt
GooredFix[02.44.44_06-10-2011].txt
GooredFix[02.54.33_06-10-2011].txt
GooredFix[21.33.06_06-10-2011].txt
GooredFix[21.33.19_06-10-2011].txt
-=E.O.F=-
——————————————————————————————————————————————————————————————-
21:57:38.0577 5792 TDSS rootkit removing tool [removed] Oct 5 2011 20:52:46
21:57:38.0858 5792 ============================================================
21:57:38.0858 5792 Current date / time: 2011/10/06 21:57:38.0858
21:57:38.0858 5792 SystemInfo:
21:57:38.0858 5792
21:57:38.0858 5792 OS Version: 6.1.7600 ServicePack: 0.0
21:57:38.0858 5792 Product type: Workstation
21:57:38.0858 5792 ComputerName: LAPTOP
21:57:38.0858 5792 UserName: Alex
21:57:38.0858 5792 Windows directory: C:\windows
21:57:38.0858 5792 System windows directory: C:\windows
21:57:38.0858 5792 Running under WOW64
21:57:38.0858 5792 Processor architecture: Intel x64
21:57:38.0858 5792 Number of processors: 4
21:57:38.0858 5792 Page size: 0x1000
21:57:38.0858 5792 Boot type: Normal boot
21:57:38.0858 5792 ============================================================
21:57:39.0217 5792 Initialize success
21:57:40.0169 7628 ============================================================
21:57:40.0169 7628 Scan started
21:57:40.0169 7628 Mode: Manual;
21:57:40.0169 7628 ============================================================
21:57:41.0323 7628 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\windows\system32\DRIVERS\1394ohci.sys
21:57:41.0323 7628 1394ohci - ok
21:57:41.0370 7628 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\windows\system32\DRIVERS\ACPI.sys
21:57:41.0370 7628 ACPI - ok
21:57:41.0417 7628 acpials (12c5274cd87449a2a37a607cdb321922) C:\windows\system32\DRIVERS\acpials.sys
21:57:41.0417 7628 acpials - ok
21:57:41.0448 7628 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\windows\system32\DRIVERS\acpipmi.sys
21:57:41.0448 7628 AcpiPmi - ok
21:57:41.0495 7628 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\windows\system32\DRIVERS\adp94xx.sys
21:57:41.0495 7628 adp94xx - ok
21:57:41.0541 7628 adpahci (597f78224ee9224ea1a13d6350ced962) C:\windows\system32\DRIVERS\adpahci.sys
21:57:41.0541 7628 adpahci - ok
21:57:41.0557 7628 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\windows\system32\DRIVERS\adpu320.sys
21:57:41.0557 7628 adpu320 - ok
21:57:41.0635 7628 AFD (6ef20ddf3172e97d69f596fb90602f29) C:\windows\system32\drivers\afd.sys
21:57:41.0635 7628 AFD - ok
21:57:41.0666 7628 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\windows\system32\DRIVERS\agp440.sys
21:57:41.0666 7628 agp440 - ok
21:57:41.0697 7628 aliide (5812713a477a3ad7363c7438ca2ee038) C:\windows\system32\DRIVERS\aliide.sys
21:57:41.0697 7628 aliide - ok
21:57:41.0729 7628 amdide (1ff8b4431c353ce385c875f194924c0c) C:\windows\system32\DRIVERS\amdide.sys
21:57:41.0729 7628 amdide - ok
21:57:41.0760 7628 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\windows\system32\DRIVERS\amdk8.sys
21:57:41.0760 7628 AmdK8 - ok
21:57:41.0791 7628 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\windows\system32\DRIVERS\amdppm.sys
21:57:41.0791 7628 AmdPPM - ok
21:57:41.0853 7628 amdsata (ec7ebab00a4d8448bab68d1e49b4beb9) C:\windows\system32\drivers\amdsata.sys
21:57:41.0853 7628 amdsata - ok
21:57:41.0885 7628 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\windows\system32\DRIVERS\amdsbs.sys
21:57:41.0900 7628 amdsbs - ok
21:57:41.0931 7628 amdxata (db27766102c7bf7e95140a2aa81d042e) C:\windows\system32\drivers\amdxata.sys
21:57:41.0931 7628 amdxata - ok
21:57:41.0994 7628 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\windows\system32\drivers\appid.sys
21:57:41.0994 7628 AppID - ok
21:57:42.0056 7628 arc (c484f8ceb1717c540242531db7845c4e) C:\windows\system32\DRIVERS\arc.sys
21:57:42.0056 7628 arc - ok
21:57:42.0087 7628 arcsas (019af6924aefe7839f61c830227fe79c) C:\windows\system32\DRIVERS\arcsas.sys
21:57:42.0087 7628 arcsas - ok
21:57:42.0134 7628 AsyncMac (769765ce2cc62867468cea93969b2242) C:\windows\system32\DRIVERS\asyncmac.sys
21:57:42.0134 7628 AsyncMac - ok
21:57:42.0165 7628 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\windows\system32\DRIVERS\atapi.sys
21:57:42.0165 7628 atapi - ok
21:57:42.0228 7628 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\windows\system32\DRIVERS\bxvbda.sys
21:57:42.0243 7628 b06bdrv - ok
21:57:42.0290 7628 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\windows\system32\DRIVERS\b57nd60a.sys
21:57:42.0290 7628 b57nd60a - ok
21:57:42.0337 7628 Beep (16a47ce2decc9b099349a5f840654746) C:\windows\system32\drivers\Beep.sys
21:57:42.0337 7628 Beep - ok
21:57:42.0384 7628 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\windows\system32\DRIVERS\blbdrive.sys
21:57:42.0399 7628 blbdrive - ok
21:57:42.0462 7628 bowser (19d20159708e152267e53b66677a4995) C:\windows\system32\DRIVERS\bowser.sys
21:57:42.0462 7628 bowser - ok
21:57:42.0509 7628 bpenum (16996e94bb4be60b45f332e9252e0336) C:\windows\system32\DRIVERS\bpenum.sys
21:57:42.0509 7628 bpenum - ok
21:57:42.0571 7628 bpmp (1ccf172b405948aeb04588517fe84947) C:\windows\system32\DRIVERS\bpmp.sys
21:57:42.0587 7628 bpmp - ok
21:57:42.0633 7628 bpusb (ae29d95f2fda67b48577bea6c9b83c17) C:\windows\system32\Drivers\bpusb.sys
21:57:42.0633 7628 bpusb - ok
21:57:42.0680 7628 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\windows\system32\DRIVERS\BrFiltLo.sys
21:57:42.0680 7628 BrFiltLo - ok
21:57:42.0711 7628 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\windows\system32\DRIVERS\BrFiltUp.sys
21:57:42.0711 7628 BrFiltUp - ok
21:57:42.0774 7628 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\windows\System32\Drivers\Brserid.sys
21:57:42.0774 7628 Brserid - ok
21:57:42.0836 7628 BrSerIf (34f6c504b150f99dae69d7073d2a4df4) C:\windows\system32\DRIVERS\BrSerIf.sys
21:57:42.0836 7628 BrSerIf - ok
21:57:42.0867 7628 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\windows\System32\Drivers\BrSerWdm.sys
21:57:42.0867 7628 BrSerWdm - ok
21:57:42.0899 7628 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\windows\System32\Drivers\BrUsbMdm.sys
21:57:42.0899 7628 BrUsbMdm - ok
21:57:42.0961 7628 BrUsbSer (601cb966fffebc6806626dc8e7aa0ef2) C:\windows\system32\DRIVERS\BrUsbSer.sys
21:57:42.0961 7628 BrUsbSer - ok
21:57:43.0008 7628 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\windows\system32\DRIVERS\bthmodem.sys
21:57:43.0008 7628 BTHMODEM - ok
21:57:43.0148 7628 catchme - ok
21:57:43.0211 7628 cdfs (b8bd2bb284668c84865658c77574381a) C:\windows\system32\DRIVERS\cdfs.sys
21:57:43.0211 7628 cdfs - ok
21:57:43.0273 7628 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\windows\system32\DRIVERS\cdrom.sys
21:57:43.0273 7628 cdrom - ok
21:57:43.0320 7628 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\windows\system32\DRIVERS\circlass.sys
21:57:43.0320 7628 circlass - ok
21:57:43.0367 7628 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\windows\system32\CLFS.sys
21:57:43.0367 7628 CLFS - ok
21:57:43.0413 7628 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\windows\system32\DRIVERS\CmBatt.sys
21:57:43.0413 7628 CmBatt - ok
21:57:43.0429 7628 cmdide (e19d3f095812725d88f9001985b94edd) C:\windows\system32\DRIVERS\cmdide.sys
21:57:43.0429 7628 cmdide - ok
21:57:43.0460 7628 CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\windows\system32\Drivers\cng.sys
21:57:43.0460 7628 CNG - ok
21:57:43.0491 7628 Compbatt (102de219c3f61415f964c88e9085ad14) C:\windows\system32\DRIVERS\compbatt.sys
21:57:43.0507 7628 Compbatt - ok
21:57:43.0523 7628 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\windows\system32\DRIVERS\CompositeBus.sys
21:57:43.0523 7628 CompositeBus - ok
21:57:43.0554 7628 crcdisk (1c827878a998c18847245fe1f34ee597) C:\windows\system32\DRIVERS\crcdisk.sys
21:57:43.0554 7628 crcdisk - ok
21:57:43.0616 7628 dc3d (76e02db615a03801d698199a2bc4a06a) C:\windows\system32\DRIVERS\dc3d.sys
21:57:43.0616 7628 dc3d - ok
21:57:43.0679 7628 DCamUSBEMPIA (b1c55a95006d621d04fe4a23f86c0a54) C:\windows\system32\DRIVERS\emDevice64.sys
21:57:43.0679 7628 DCamUSBEMPIA - ok
21:57:43.0725 7628 DfsC (9c253ce7311ca60fc11c774692a13208) C:\windows\system32\Drivers\dfsc.sys
21:57:43.0725 7628 DfsC - ok
21:57:43.0772 7628 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\windows\system32\drivers\discache.sys
21:57:43.0772 7628 discache - ok
21:57:43.0803 7628 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\windows\system32\DRIVERS\disk.sys
21:57:43.0803 7628 Disk - ok
21:57:43.0881 7628 drmkaud (9b19f34400d24df84c858a421c205754) C:\windows\system32\drivers\drmkaud.sys
21:57:43.0881 7628 drmkaud - ok
21:57:44.0084 7628 DXGKrnl (24ce1ecf9d0ae0301775b07f5fea175b) C:\windows\System32\drivers\dxgkrnl.sys
21:57:44.0084 7628 DXGKrnl - ok
21:57:44.0162 7628 easytether (1d69a83033930c20583d608c622ca56b) C:\windows\system32\DRIVERS\easytthr.sys
21:57:44.0162 7628 easytether - ok
21:57:44.0240 7628 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\windows\system32\DRIVERS\evbda.sys
21:57:44.0271 7628 ebdrv - ok
21:57:44.0334 7628 elxstor (0e5da5369a0fcaea12456dd852545184) C:\windows\system32\DRIVERS\elxstor.sys
21:57:44.0349 7628 elxstor - ok
21:57:44.0396 7628 emAudio (8543bb84cd5872cd1619183f5cbbe3f9) C:\windows\system32\drivers\emAudio64.sys
21:57:44.0396 7628 emAudio - ok
21:57:44.0443 7628 ErrDev (34a3c54752046e79a126e15c51db409b) C:\windows\system32\DRIVERS\errdev.sys
21:57:44.0443 7628 ErrDev - ok
21:57:44.0490 7628 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\windows\system32\drivers\exfat.sys
21:57:44.0490 7628 exfat - ok
21:57:44.0521 7628 fastfat (0adc83218b66a6db380c330836f3e36d) C:\windows\system32\drivers\fastfat.sys
21:57:44.0537 7628 fastfat - ok
21:57:44.0568 7628 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\windows\system32\DRIVERS\fdc.sys
21:57:44.0568 7628 fdc - ok
21:57:44.0630 7628 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\windows\system32\drivers\fileinfo.sys
21:57:44.0630 7628 FileInfo - ok
21:57:44.0661 7628 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\windows\system32\drivers\filetrace.sys
21:57:44.0661 7628 Filetrace - ok
21:57:44.0724 7628 FiltUSBEMPIA (73fbb50c4d92adc30a9d57a269489a0b) C:\windows\system32\DRIVERS\emFilter64.sys
21:57:44.0724 7628 FiltUSBEMPIA - ok
21:57:44.0739 7628 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\windows\system32\DRIVERS\flpydisk.sys
21:57:44.0739 7628 flpydisk - ok
21:57:44.0771 7628 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\windows\system32\drivers\fltmgr.sys
21:57:44.0771 7628 FltMgr - ok
21:57:44.0817 7628 FsDepends (d43703496149971890703b4b1b723eac) C:\windows\system32\drivers\FsDepends.sys
21:57:44.0817 7628 FsDepends - ok
21:57:44.0880 7628 fssfltr (6c06701bf1db05405804d7eb610991ce) C:\windows\system32\DRIVERS\fssfltr.sys
21:57:44.0880 7628 fssfltr - ok
21:57:44.0911 7628 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\windows\system32\drivers\Fs_Rec.sys
21:57:44.0911 7628 Fs_Rec - ok
21:57:44.0973 7628 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\windows\system32\DRIVERS\fvevol.sys
21:57:44.0973 7628 fvevol - ok
21:57:45.0005 7628 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\windows\system32\DRIVERS\gagp30kx.sys
21:57:45.0020 7628 gagp30kx - ok
21:57:45.0176 7628 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\windows\system32\DRIVERS\GEARAspiWDM.sys
21:57:45.0176 7628 GEARAspiWDM - ok
21:57:45.0285 7628 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\windows\system32\drivers\hcw85cir.sys
21:57:45.0301 7628 hcw85cir - ok
21:57:45.0332 7628 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\windows\system32\drivers\HdAudio.sys
21:57:45.0348 7628 HdAudAddService - ok
21:57:45.0379 7628 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\windows\system32\DRIVERS\HDAudBus.sys
21:57:45.0379 7628 HDAudBus - ok
21:57:45.0441 7628 HECIx64 (b6ac71aaa2b10848f57fc49d55a651af) C:\windows\system32\DRIVERS\HECIx64.sys
21:57:45.0441 7628 HECIx64 - ok
21:57:45.0457 7628 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\windows\system32\DRIVERS\HidBatt.sys
21:57:45.0457 7628 HidBatt - ok
21:57:45.0488 7628 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\windows\system32\DRIVERS\hidbth.sys
21:57:45.0488 7628 HidBth - ok
21:57:45.0519 7628 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\windows\system32\DRIVERS\hidir.sys
21:57:45.0519 7628 HidIr - ok
21:57:45.0566 7628 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\windows\system32\DRIVERS\hidusb.sys
21:57:45.0566 7628 HidUsb - ok
21:57:45.0613 7628 HpSAMD (0886d440058f203eba0e1825e4355914) C:\windows\system32\DRIVERS\HpSAMD.sys
21:57:45.0613 7628 HpSAMD - ok
21:57:45.0660 7628 HtcUsbMdmV64 (7c7c986776d00e575bfbde5dcbdc615d) C:\windows\system32\DRIVERS\HtcUsbMdmV64.sys
21:57:45.0660 7628 HtcUsbMdmV64 - ok
21:57:45.0707 7628 HtcVCom32 (7c7c986776d00e575bfbde5dcbdc615d) C:\windows\system32\DRIVERS\HtcVComV64.sys
21:57:45.0707 7628 HtcVCom32 - ok
21:57:45.0753 7628 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\windows\system32\drivers\HTTP.sys
21:57:45.0753 7628 HTTP - ok
21:57:45.0800 7628 hwpolicy (f17766a19145f111856378df337a5d79) C:\windows\system32\drivers\hwpolicy.sys
21:57:45.0800 7628 hwpolicy - ok
21:57:45.0831 7628 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\windows\system32\DRIVERS\i8042prt.sys
21:57:45.0831 7628 i8042prt - ok
21:57:45.0894 7628 iaStor (85977cd13fc16069ce0af7943a811775) C:\windows\system32\DRIVERS\iaStor.sys
21:57:45.0909 7628 iaStor - ok
21:57:45.0972 7628 iaStorV (b75e45c564e944a2657167d197ab29da) C:\windows\system32\drivers\iaStorV.sys
21:57:45.0972 7628 iaStorV - ok
21:57:46.0190 7628 igfx (2a22ab054f4630d2ef4bab2853f6d5f6) C:\windows\system32\DRIVERS\igdkmd64.sys
21:57:46.0237 7628 igfx - ok
21:57:46.0299 7628 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\windows\system32\DRIVERS\iirsp.sys
21:57:46.0299 7628 iirsp - ok
21:57:46.0362 7628 Impcd (dd587a55390ed2295bce6d36ad567da9) C:\windows\system32\DRIVERS\Impcd.sys
21:57:46.0362 7628 Impcd - ok
21:57:46.0471 7628 IntcAzAudAddService (490947a9aff7ca31ef2e08f5776105eb) C:\windows\system32\drivers\RTKVHD64.sys
21:57:46.0487 7628 IntcAzAudAddService - ok
21:57:46.0549 7628 IntcDAud (58cf58dee26c909bd6f977b61d246295) C:\windows\system32\DRIVERS\IntcDAud.sys
21:57:46.0565 7628 IntcDAud - ok
21:57:46.0596 7628 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\windows\system32\DRIVERS\intelide.sys
21:57:46.0596 7628 intelide - ok
21:57:46.0627 7628 intelppm (ada036632c664caa754079041cf1f8c1) C:\windows\system32\DRIVERS\intelppm.sys
21:57:46.0627 7628 intelppm - ok
21:57:46.0658 7628 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\windows\system32\DRIVERS\ipfltdrv.sys
21:57:46.0658 7628 IpFilterDriver - ok
21:57:46.0689 7628 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\windows\system32\DRIVERS\IPMIDrv.sys
21:57:46.0689 7628 IPMIDRV - ok
21:57:46.0721 7628 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\windows\system32\drivers\ipnat.sys
21:57:46.0721 7628 IPNAT - ok
21:57:46.0783 7628 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\windows\system32\drivers\irenum.sys
21:57:46.0783 7628 IRENUM - ok
21:57:46.0799 7628 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\windows\system32\DRIVERS\isapnp.sys
21:57:46.0799 7628 isapnp - ok
21:57:46.0861 7628 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\windows\system32\DRIVERS\msiscsi.sys
21:57:46.0861 7628 iScsiPrt - ok
21:57:46.0923 7628 JMCR (19496fe93696c929392f1595ed1f8bb3) C:\windows\system32\DRIVERS\jmcr.sys
21:57:46.0923 7628 JMCR - ok
21:57:46.0955 7628 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\windows\system32\DRIVERS\kbdclass.sys
21:57:46.0955 7628 kbdclass - ok
21:57:47.0001 7628 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\windows\system32\DRIVERS\kbdhid.sys
21:57:47.0001 7628 kbdhid - ok
21:57:47.0033 7628 KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\windows\system32\Drivers\ksecdd.sys
21:57:47.0033 7628 KSecDD - ok
21:57:47.0079 7628 KSecPkg (a8c63880ef6f4d3fec7b616b9c060215) C:\windows\system32\Drivers\ksecpkg.sys
21:57:47.0079 7628 KSecPkg - ok
21:57:47.0111 7628 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\windows\system32\drivers\ksthunk.sys
21:57:47.0111 7628 ksthunk - ok
21:57:47.0173 7628 lltdio (1538831cf8ad2979a04c423779465827) C:\windows\system32\DRIVERS\lltdio.sys
21:57:47.0173 7628 lltdio - ok
21:57:47.0267 7628 LPCFilter (41e122f6d1448c94cc05196bc41d6bfb) C:\windows\system32\DRIVERS\LPCFilter.sys
21:57:47.0267 7628 LPCFilter - ok
21:57:47.0313 7628 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\windows\system32\DRIVERS\lsi_fc.sys
21:57:47.0313 7628 LSI_FC - ok
21:57:47.0360 7628 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\windows\system32\DRIVERS\lsi_sas.sys
21:57:47.0360 7628 LSI_SAS - ok
21:57:47.0391 7628 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\windows\system32\DRIVERS\lsi_sas2.sys
21:57:47.0391 7628 LSI_SAS2 - ok
21:57:47.0423 7628 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\windows\system32\DRIVERS\lsi_scsi.sys
21:57:47.0423 7628 LSI_SCSI - ok
21:57:47.0469 7628 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\windows\system32\drivers\luafv.sys
21:57:47.0469 7628 luafv - ok
21:57:47.0532 7628 MarvinBus (024da28053d57e9e32bee52600576bbb) C:\windows\system32\DRIVERS\MarvinBus64.sys
21:57:47.0532 7628 MarvinBus - ok
21:57:47.0579 7628 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\windows\system32\DRIVERS\megasas.sys
21:57:47.0579 7628 megasas - ok
21:57:47.0610 7628 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\windows\system32\DRIVERS\MegaSR.sys
21:57:47.0610 7628 MegaSR - ok
21:57:47.0641 7628 Modem (800ba92f7010378b09f9ed9270f07137) C:\windows\system32\drivers\modem.sys
21:57:47.0641 7628 Modem - ok
21:57:47.0688 7628 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\windows\system32\DRIVERS\monitor.sys
21:57:47.0688 7628 monitor - ok
21:57:47.0719 7628 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\windows\system32\DRIVERS\mouclass.sys
21:57:47.0719 7628 mouclass - ok
21:57:47.0781 7628 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\windows\system32\DRIVERS\mouhid.sys
21:57:47.0781 7628 mouhid - ok
21:57:47.0813 7628 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\windows\system32\drivers\mountmgr.sys
21:57:47.0813 7628 mountmgr - ok
21:57:47.0844 7628 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\windows\system32\DRIVERS\mpio.sys
21:57:47.0844 7628 mpio - ok
21:57:47.0875 7628 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\windows\system32\drivers\mpsdrv.sys
21:57:47.0875 7628 mpsdrv - ok
21:57:47.0922 7628 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\windows\system32\drivers\mrxdav.sys
21:57:47.0922 7628 MRxDAV - ok
21:57:47.0969 7628 mrxsmb (040d62a9d8ad28922632137acdd984f2) C:\windows\system32\DRIVERS\mrxsmb.sys
21:57:47.0969 7628 mrxsmb - ok
21:57:48.0031 7628 mrxsmb10 (f0067552f8f9b33d7c59403ab808a3cb) C:\windows\system32\DRIVERS\mrxsmb10.sys
21:57:48.0031 7628 mrxsmb10 - ok
21:57:48.0062 7628 mrxsmb20 (3c142d31de9f2f193218a53fe2632051) C:\windows\system32\DRIVERS\mrxsmb20.sys
21:57:48.0062 7628 mrxsmb20 - ok
21:57:48.0093 7628 msahci (5c37497276e3b3a5488b23a326a754b7) C:\windows\system32\DRIVERS\msahci.sys
21:57:48.0093 7628 msahci - ok
21:57:48.0109 7628 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\windows\system32\DRIVERS\msdsm.sys
21:57:48.0109 7628 msdsm - ok
21:57:48.0140 7628 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\windows\system32\drivers\Msfs.sys
21:57:48.0140 7628 Msfs - ok
21:57:48.0187 7628 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\windows\System32\drivers\mshidkmdf.sys
21:57:48.0187 7628 mshidkmdf - ok
21:57:48.0203 7628 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\windows\system32\DRIVERS\msisadrv.sys
21:57:48.0218 7628 msisadrv - ok
21:57:48.0265 7628 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\windows\system32\drivers\MSKSSRV.sys
21:57:48.0265 7628 MSKSSRV - ok
21:57:48.0296 7628 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\windows\system32\drivers\MSPCLOCK.sys
21:57:48.0296 7628 MSPCLOCK - ok
21:57:48.0327 7628 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\windows\system32\drivers\MSPQM.sys
21:57:48.0327 7628 MSPQM - ok
21:57:48.0359 7628 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\windows\system32\drivers\MsRPC.sys
21:57:48.0359 7628 MsRPC - ok
21:57:48.0390 7628 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\windows\system32\DRIVERS\mssmbios.sys
21:57:48.0390 7628 mssmbios - ok
21:57:48.0421 7628 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\windows\system32\drivers\MSTEE.sys
21:57:48.0421 7628 MSTEE - ok
21:57:48.0452 7628 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\windows\system32\DRIVERS\MTConfig.sys
21:57:48.0452 7628 MTConfig - ok
21:57:48.0483 7628 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\windows\system32\Drivers\mup.sys
21:57:48.0483 7628 Mup - ok
21:57:48.0546 7628 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\windows\system32\DRIVERS\nwifi.sys
21:57:48.0546 7628 NativeWifiP - ok
21:57:48.0593 7628 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\windows\system32\drivers\ndis.sys
21:57:48.0608 7628 NDIS - ok
21:57:48.0639 7628 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\windows\system32\DRIVERS\ndiscap.sys
21:57:48.0639 7628 NdisCap - ok
21:57:48.0686 7628 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\windows\system32\DRIVERS\ndistapi.sys
21:57:48.0686 7628 NdisTapi - ok
21:57:48.0702 7628 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\windows\system32\DRIVERS\ndisuio.sys
21:57:48.0702 7628 Ndisuio - ok
21:57:48.0733 7628 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\windows\system32\DRIVERS\ndiswan.sys
21:57:48.0733 7628 NdisWan - ok
21:57:48.0764 7628 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\windows\system32\drivers\NDProxy.sys
21:57:48.0780 7628 NDProxy - ok
21:57:48.0795 7628 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\windows\system32\DRIVERS\netbios.sys
21:57:48.0795 7628 NetBIOS - ok
21:57:48.0842 7628 NetBT (9162b273a44ab9dce5b44362731d062a) C:\windows\system32\DRIVERS\netbt.sys
21:57:48.0842 7628 NetBT - ok
21:57:49.0029 7628 NETw5s64 (39ede676d17f37af4573c2b33ec28aca) C:\windows\system32\DRIVERS\NETw5s64.sys
21:57:49.0061 7628 NETw5s64 - ok
21:57:49.0107 7628 nfrd960 (77889813be4d166cdab78ddba990da92) C:\windows\system32\DRIVERS\nfrd960.sys
21:57:49.0107 7628 nfrd960 - ok
21:57:49.0154 7628 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\windows\system32\drivers\Npfs.sys
21:57:49.0154 7628 Npfs - ok
21:57:49.0185 7628 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\windows\system32\drivers\nsiproxy.sys
21:57:49.0185 7628 nsiproxy - ok
21:57:49.0263 7628 Ntfs (378e0e0dfea67d98ae6ea53adbbd76bc) C:\windows\system32\drivers\Ntfs.sys
21:57:49.0279 7628 Ntfs - ok
21:57:49.0341 7628 Null (9899284589f75fa8724ff3d16aed75c1) C:\windows\system32\drivers\Null.sys
21:57:49.0341 7628 Null - ok
21:57:49.0560 7628 nvlddmkm (56743d7b668a19bd83bcdfb1f2136738) C:\windows\system32\DRIVERS\nvlddmkm.sys
21:57:49.0622 7628 nvlddmkm - ok
21:57:49.0700 7628 nvraid (a4d9c9a608a97f59307c2f2600edc6a4) C:\windows\system32\drivers\nvraid.sys
21:57:49.0700 7628 nvraid - ok
21:57:49.0731 7628 nvstor (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\windows\system32\drivers\nvstor.sys
21:57:49.0731 7628 nvstor - ok
21:57:49.0763 7628 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\windows\system32\DRIVERS\nv_agp.sys
21:57:49.0763 7628 nv_agp - ok
21:57:49.0794 7628 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\windows\system32\DRIVERS\ohci1394.sys
21:57:49.0794 7628 ohci1394 - ok
21:57:49.0841 7628 Parport (0086431c29c35be1dbc43f52cc273887) C:\windows\system32\DRIVERS\parport.sys
21:57:49.0841 7628 Parport - ok
21:57:49.0872 7628 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\windows\system32\drivers\partmgr.sys
21:57:49.0872 7628 partmgr - ok
21:57:49.0903 7628 pci (5aab2b170536885de70a6cba8d7ce52b) C:\windows\system32\DRIVERS\pci.sys
21:57:49.0903 7628 pci - ok
21:57:49.0934 7628 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\windows\system32\DRIVERS\pciide.sys
21:57:49.0934 7628 pciide - ok
21:57:49.0981 7628 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\windows\system32\DRIVERS\pcmcia.sys
21:57:49.0981 7628 pcmcia - ok
21:57:50.0012 7628 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\windows\system32\drivers\pcw.sys
21:57:50.0012 7628 pcw - ok
21:57:50.0043 7628 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\windows\system32\drivers\peauth.sys
21:57:50.0043 7628 PEAUTH - ok
21:57:50.0106 7628 PGEffect (663962900e7fea522126ba287715bb4a) C:\windows\system32\DRIVERS\pgeffect.sys
21:57:50.0106 7628 PGEffect - ok
21:57:50.0184 7628 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\windows\system32\DRIVERS\raspptp.sys
21:57:50.0184 7628 PptpMiniport - ok
21:57:50.0215 7628 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\windows\system32\DRIVERS\processr.sys
21:57:50.0215 7628 Processor - ok
21:57:50.0277 7628 Psched (ee992183bd8eaefd9973f352e587a299) C:\windows\system32\DRIVERS\pacer.sys
21:57:50.0277 7628 Psched - ok
21:57:50.0324 7628 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\windows\system32\DRIVERS\ql2300.sys
21:57:50.0340 7628 ql2300 - ok
21:57:50.0402 7628 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\windows\system32\DRIVERS\ql40xx.sys
21:57:50.0402 7628 ql40xx - ok
21:57:50.0449 7628 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\windows\system32\drivers\qwavedrv.sys
21:57:50.0449 7628 QWAVEdrv - ok
21:57:50.0496 7628 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\windows\system32\DRIVERS\rasacd.sys
21:57:50.0496 7628 RasAcd - ok
21:57:50.0543 7628 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\windows\system32\DRIVERS\AgileVpn.sys
21:57:50.0543 7628 RasAgileVpn - ok
21:57:50.0589 7628 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\windows\system32\DRIVERS\rasl2tp.sys
21:57:50.0589 7628 Rasl2tp - ok
21:57:50.0621 7628 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\windows\system32\DRIVERS\raspppoe.sys
21:57:50.0621 7628 RasPppoe - ok
21:57:50.0667 7628 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\windows\system32\DRIVERS\rassstp.sys
21:57:50.0667 7628 RasSstp - ok
21:57:50.0699 7628 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\windows\system32\DRIVERS\rdbss.sys
21:57:50.0699 7628 rdbss - ok
21:57:50.0730 7628 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\windows\system32\DRIVERS\rdpbus.sys
21:57:50.0730 7628 rdpbus - ok
21:57:50.0745 7628 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\windows\system32\DRIVERS\RDPCDD.sys
21:57:50.0745 7628 RDPCDD - ok
21:57:50.0792 7628 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\windows\system32\drivers\rdpencdd.sys
21:57:50.0792 7628 RDPENCDD - ok
21:57:50.0823 7628 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\windows\system32\drivers\rdprefmp.sys
21:57:50.0823 7628 RDPREFMP - ok
21:57:50.0870 7628 RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\windows\system32\drivers\RDPWD.sys
21:57:50.0870 7628 RDPWD - ok
21:57:50.0901 7628 rdyboost (634b9a2181d98f15941236886164ec8b) C:\windows\system32\drivers\rdyboost.sys
21:57:50.0901 7628 rdyboost - ok
21:57:50.0948 7628 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\windows\system32\DRIVERS\rspndr.sys
21:57:50.0948 7628 rspndr - ok
21:57:51.0011 7628 RTL8167 (ba3e57c89e6f63808d3f2b11e1a2ad3c) C:\windows\system32\DRIVERS\Rt64win7.sys
21:57:51.0011 7628 RTL8167 - ok
21:57:51.0073 7628 SASDIFSV (99df79c258b3342b6c8a5f802998de56) C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS
21:57:51.0073 7628 SASDIFSV - ok
21:57:51.0104 7628 SASKUTIL (2859c35c0651e8eb0d86d48e740388f2) C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS
21:57:51.0104 7628 SASKUTIL - ok
21:57:51.0135 7628 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\windows\system32\DRIVERS\sbp2port.sys
21:57:51.0135 7628 sbp2port - ok
21:57:51.0182 7628 ScanUSBEMPIA (eecbbf7d76300e5558d316983961ffc1) C:\windows\system32\DRIVERS\emScan64.sys
21:57:51.0182 7628 ScanUSBEMPIA - ok
21:57:51.0213 7628 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\windows\system32\DRIVERS\scfilter.sys
21:57:51.0213 7628 scfilter - ok
21:57:51.0260 7628 sdbus (2c8d162efaf73abd36d8bcbb6340cae7) C:\windows\system32\DRIVERS\sdbus.sys
21:57:51.0260 7628 sdbus - ok
21:57:51.0307 7628 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\windows\system32\drivers\secdrv.sys
21:57:51.0307 7628 secdrv - ok
21:57:51.0338 7628 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\windows\system32\DRIVERS\serenum.sys
21:57:51.0338 7628 Serenum - ok
21:57:51.0369 7628 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\windows\system32\DRIVERS\serial.sys
21:57:51.0369 7628 Serial - ok
21:57:51.0401 7628 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\windows\system32\DRIVERS\sermouse.sys
21:57:51.0401 7628 sermouse - ok
21:57:51.0447 7628 sffdisk (a554811bcd09279536440c964ae35bbf) C:\windows\system32\DRIVERS\sffdisk.sys
21:57:51.0447 7628 sffdisk - ok
21:57:51.0479 7628 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\windows\system32\DRIVERS\sffp_mmc.sys
21:57:51.0479 7628 sffp_mmc - ok
21:57:51.0494 7628 sffp_sd (178298f767fe638c9fedcbdef58bb5e4) C:\windows\system32\DRIVERS\sffp_sd.sys
21:57:51.0494 7628 sffp_sd - ok
21:57:51.0525 7628 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\windows\system32\DRIVERS\sfloppy.sys
21:57:51.0525 7628 sfloppy - ok
21:57:51.0572 7628 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\windows\system32\DRIVERS\SiSRaid2.sys
21:57:51.0572 7628 SiSRaid2 - ok
21:57:51.0603 7628 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\windows\system32\DRIVERS\sisraid4.sys
21:57:51.0603 7628 SiSRaid4 - ok
21:57:51.0635 7628 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\windows\system32\DRIVERS\smb.sys
21:57:51.0635 7628 Smb - ok
21:57:51.0681 7628 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\windows\system32\drivers\spldr.sys
21:57:51.0681 7628 spldr - ok
21:57:51.0759 7628 srv (2408c0366d96bcdf63e8f1c78e4a29c5) C:\windows\system32\DRIVERS\srv.sys
21:57:51.0759 7628 srv - ok
21:57:51.0791 7628 srv2 (76548f7b818881b47d8d1ae1be9c11f8) C:\windows\system32\DRIVERS\srv2.sys
21:57:51.0806 7628 srv2 - ok
21:57:51.0837 7628 srvnet (0af6e19d39c70844c5caa8fb0183c36e) C:\windows\system32\DRIVERS\srvnet.sys
21:57:51.0837 7628 srvnet - ok
21:57:51.0884 7628 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\windows\system32\DRIVERS\stexstor.sys
21:57:51.0884 7628 stexstor - ok
21:57:51.0931 7628 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\windows\system32\DRIVERS\swenum.sys
21:57:51.0947 7628 swenum - ok
21:57:52.0009 7628 SynTP (470c47daba9ca3966f0ab3f835d7d135) C:\windows\system32\DRIVERS\SynTP.sys
21:57:52.0009 7628 SynTP - ok
21:57:52.0103 7628 Tcpip (b9d87c7707f058ac652a398cd28de14b) C:\windows\system32\drivers\tcpip.sys
21:57:52.0118 7628 Tcpip - ok
21:57:52.0181 7628 TCPIP6 (b9d87c7707f058ac652a398cd28de14b) C:\windows\system32\DRIVERS\tcpip.sys
21:57:52.0196 7628 TCPIP6 - ok
21:57:52.0243 7628 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\windows\system32\drivers\tcpipreg.sys
21:57:52.0259 7628 tcpipreg - ok
21:57:52.0305 7628 tdcmdpst (fd542b661bd22fa69ca789ad0ac58c29) C:\windows\system32\DRIVERS\tdcmdpst.sys
21:57:52.0305 7628 tdcmdpst - ok
21:57:52.0337 7628 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\windows\system32\drivers\tdpipe.sys
21:57:52.0337 7628 TDPIPE - ok
21:57:52.0368 7628 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\windows\system32\drivers\tdtcp.sys
21:57:52.0368 7628 TDTCP - ok
21:57:52.0415 7628 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\windows\system32\DRIVERS\tdx.sys
21:57:52.0415 7628 tdx - ok
21:57:52.0446 7628 TermDD (c448651339196c0e869a355171875522) C:\windows\system32\DRIVERS\termdd.sys
21:57:52.0446 7628 TermDD - ok
21:57:52.0508 7628 Thpdrv (c013f6acaa9761f571bd28dada7c157d) C:\windows\system32\DRIVERS\thpdrv.sys
21:57:52.0508 7628 Thpdrv - ok
21:57:52.0555 7628 Thpevm (b4e609047434ed948af7bdef2fa66e38) C:\windows\system32\DRIVERS\Thpevm.SYS
21:57:52.0555 7628 Thpevm - ok
21:57:52.0633 7628 tos_sps64 (09ff7b0b1b5c3d225495cb6f5a9b39f8) C:\windows\system32\DRIVERS\tos_sps64.sys
21:57:52.0633 7628 tos_sps64 - ok
21:57:52.0695 7628 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\windows\system32\DRIVERS\tssecsrv.sys
21:57:52.0695 7628 tssecsrv - ok
21:57:52.0727 7628 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\windows\system32\DRIVERS\tunnel.sys
21:57:52.0727 7628 tunnel - ok
21:57:52.0789 7628 TVALZ (550b567f9364d8f7684c3fb3ea665a72) C:\windows\system32\DRIVERS\TVALZ_O.SYS
21:57:52.0789 7628 TVALZ - ok
21:57:52.0836 7628 TVALZFL (9c7191f4b2e49bff47a6c1144b5923fa) C:\windows\system32\DRIVERS\TVALZFL.sys
21:57:52.0836 7628 TVALZFL - ok
21:57:52.0867 7628 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\windows\system32\DRIVERS\uagp35.sys
21:57:52.0867 7628 uagp35 - ok
21:57:52.0914 7628 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\windows\system32\DRIVERS\udfs.sys
21:57:52.0914 7628 udfs - ok
21:57:52.0945 7628 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\windows\system32\DRIVERS\uliagpkx.sys
21:57:52.0945 7628 uliagpkx - ok
21:57:52.0992 7628 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\windows\system32\DRIVERS\umbus.sys
21:57:52.0992 7628 umbus - ok
21:57:53.0023 7628 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\windows\system32\DRIVERS\umpass.sys
21:57:53.0023 7628 UmPass - ok
21:57:53.0101 7628 usbccgp (537a4e03d7103c12d42dfd8ffdb5bdc9) C:\windows\system32\DRIVERS\usbccgp.sys
21:57:53.0101 7628 usbccgp - ok
21:57:53.0117 7628 usbcir (af0892a803fdda7492f595368e3b68e7) C:\windows\system32\DRIVERS\usbcir.sys
21:57:53.0117 7628 usbcir - ok
21:57:53.0163 7628 usbehci (fbb21ebe49f6d560db37ac25fbc68e66) C:\windows\system32\drivers\usbehci.sys
21:57:53.0163 7628 usbehci - ok
21:57:53.0210 7628 usbhub (6b7a8a99c4a459e73c286a6763ea24cc) C:\windows\system32\DRIVERS\usbhub.sys
21:57:53.0226 7628 usbhub - ok
21:57:53.0257 7628 usbohci (8c88aa7617b4cbc2e4bed61d26b33a27) C:\windows\system32\drivers\usbohci.sys
21:57:53.0257 7628 usbohci - ok
21:57:53.0304 7628 usbprint (73188f58fb384e75c4063d29413cee3d) C:\windows\system32\DRIVERS\usbprint.sys
21:57:53.0304 7628 usbprint - ok
21:57:53.0335 7628 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\windows\system32\DRIVERS\usbscan.sys
21:57:53.0351 7628 usbscan - ok
21:57:53.0382 7628 USBSTOR (f39983647bc1f3e6100778ddfe9dce29) C:\windows\system32\DRIVERS\USBSTOR.SYS
21:57:53.0382 7628 USBSTOR - ok
21:57:53.0444 7628 usbuhci (0b5b3b2df3fd1709618acfa50b8392b0) C:\windows\system32\drivers\usbuhci.sys
21:57:53.0444 7628 usbuhci - ok
21:57:53.0491 7628 usbvideo (7cb8c573c6e4a2714402cc0a36eab4fe) C:\windows\System32\Drivers\usbvideo.sys
21:57:53.0491 7628 usbvideo - ok
21:57:53.0553 7628 usb_rndisx (70d05ee263568a742d14e1876df80532) C:\windows\system32\DRIVERS\usb8023x.sys
21:57:53.0553 7628 usb_rndisx - ok
21:57:53.0616 7628 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\windows\system32\DRIVERS\vdrvroot.sys
21:57:53.0616 7628 vdrvroot - ok
21:57:53.0647 7628 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\windows\system32\DRIVERS\vgapnp.sys
21:57:53.0647 7628 vga - ok
21:57:53.0678 7628 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\windows\System32\drivers\vga.sys
21:57:53.0678 7628 VgaSave - ok
21:57:53.0709 7628 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\windows\system32\DRIVERS\vhdmp.sys
21:57:53.0709 7628 vhdmp - ok
21:57:53.0741 7628 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\windows\system32\DRIVERS\viaide.sys
21:57:53.0741 7628 viaide - ok
21:57:53.0772 7628 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\windows\system32\DRIVERS\volmgr.sys
21:57:53.0772 7628 volmgr - ok
21:57:53.0819 7628 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\windows\system32\drivers\volmgrx.sys
21:57:53.0819 7628 volmgrx - ok
21:57:53.0865 7628 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\windows\system32\DRIVERS\volsnap.sys
21:57:53.0865 7628 volsnap - ok
21:57:53.0912 7628 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\windows\system32\DRIVERS\vsmraid.sys
21:57:53.0912 7628 vsmraid - ok
21:57:53.0959 7628 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\windows\system32\DRIVERS\vwifibus.sys
21:57:53.0959 7628 vwifibus - ok
21:57:54.0006 7628 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\windows\system32\DRIVERS\vwififlt.sys
21:57:54.0006 7628 vwififlt - ok
21:57:54.0037 7628 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\windows\system32\DRIVERS\vwifimp.sys
21:57:54.0037 7628 vwifimp - ok
21:57:54.0068 7628 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\windows\system32\DRIVERS\wacompen.sys
21:57:54.0068 7628 WacomPen - ok
21:57:54.0115 7628 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\windows\system32\DRIVERS\wanarp.sys
21:57:54.0115 7628 WANARP - ok
21:57:54.0131 7628 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\windows\system32\DRIVERS\wanarp.sys
21:57:54.0131 7628 Wanarpv6 - ok
21:57:54.0193 7628 Wd (72889e16ff12ba0f235467d6091b17dc) C:\windows\system32\DRIVERS\wd.sys
21:57:54.0193 7628 Wd - ok
21:57:54.0240 7628 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\windows\system32\drivers\Wdf01000.sys
21:57:54.0240 7628 Wdf01000 - ok
21:57:54.0302 7628 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\windows\system32\DRIVERS\wfplwf.sys
21:57:54.0302 7628 WfpLwf - ok
21:57:54.0333 7628 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\windows\system32\drivers\wimmount.sys
21:57:54.0333 7628 WIMMount - ok
21:57:54.0427 7628 WinUsb (817eaff5d38674edd7713b9dfb8e9791) C:\windows\system32\DRIVERS\WinUsb.sys
21:57:54.0427 7628 WinUsb - ok
21:57:54.0474 7628 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\windows\system32\DRIVERS\wmiacpi.sys
21:57:54.0474 7628 WmiAcpi - ok
21:57:54.0521 7628 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\windows\system32\drivers\ws2ifsl.sys
21:57:54.0521 7628 ws2ifsl - ok
21:57:54.0567 7628 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\windows\system32\drivers\WudfPf.sys
21:57:54.0567 7628 WudfPf - ok
21:57:54.0599 7628 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\windows\system32\DRIVERS\WUDFRd.sys
21:57:54.0599 7628 WUDFRd - ok
21:57:54.0661 7628 MBR (0x1B8) (5b5e648d12fcadc244c1ec30318e1eb9) \Device\Harddisk0\DR0
21:57:54.0677 7628 \Device\Harddisk0\DR0 - ok
21:57:54.0692 7628 Boot (0x1200) (8ec2fe3fe560682812c8cc5cecb048a8) \Device\Harddisk0\DR0\Partition0
21:57:54.0692 7628 \Device\Harddisk0\DR0\Partition0 - ok
21:57:54.0692 7628 ============================================================
21:57:54.0692 7628 Scan finished
21:57:54.0692 7628 ============================================================
21:57:54.0692 7792 Detected object count: 0
21:57:54.0692 7792 Actual detected object count: 0
Hello
blackrx and welcome to the
WTT forum.
My name is
Satchfan and I would be glad to help you with your computer problem.
Please read the following guidelines which will help to make cleaning your machine easier: please follow all instructions in the order posted please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear all logs/reports, etc. must be posted in Notepad . Please ensure that word wrap is un checked . In Notepad click Format , uncheck Word wrap if it is checked if you don't understand something, please don't hesitate to ask for clarification before proceeding the fixes are specific to your problem and should only be used for this issue on this machine. please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed! IMPORTANT :
Please
DO NOT install/uninstall any programs unless asked to.
Please
DO NOT run any scans other than those requested
===================================================
Run DDS
Please download DDS by sUBs from one of the following links and save it to your desktop.
DDS.scr DDS.pif
• disable any script blocking protection (
How to Disable your Security Programs )
• double click
DDS icon to run the tool (may take up to 3 minutes to run)
• when done, DDS.txt will open.
• after a few moments, attach.txt will open in a second window.
• save both reports to your desktop.
•
Post the contents of the
DDS.txt and
Attach.txt reports in your next reply
===================================================
Run aswMBR download aswMBR.exe to your desktop. double click the aswMBR.exe to run it if asked, accept the AVAST virus definition download click the "Scan" button to start scan on completion of the scan click Save log , save it to your desktop and post in your next reply Logs to include with next post :
DDS.txt
Thanks
Satchfan
Hi Satchfan, thank you for your help. Here are the logs below:
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_26
Run by [removed] at 7:29:38 on 2011-10-07
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3891.913 [GMT -4:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\windows\system32\wininit.exe
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\nvvsvc.exe
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\system32\WLANExt.exe
C:\windows\system32\conhost.exe
C:\windows\system32\nvvsvc.exe
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\windows\system32\taskhost.exe
C:\windows\system32\Dwm.exe
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\windows\Explorer.EXE
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\windows\system32\svchost.exe -k imgsvc
C:\windows\system32\ThpSrv.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
C:\Program Files\TOSHIBA\TECO\TecoService.exe
C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\windows\system32\SearchIndexer.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\windows\system32\igfxsrvc.exe
C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\ThpSrv.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\Program Files\TOSHIBA\TECO\Teco.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe
C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
C:\Windows\WindowsMobile\wmdcBase.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Mobile Stream\EasyTether\easytthr.exe
C:\windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
C:\Program Files\TOSHIBA\FlashCards\Hotkey\TcrdKBB.exe
C:\windows\system32\igfxext.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
C:\windows\system32\wbem\unsecapp.exe
C:\windows\system32\svchost.exe -k WindowsMobile
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\windows\System32\svchost.exe -k secsvcs
C:\windows\system32\wuauclt.exe
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\windows\SysWOW64\ping.exe
C:\windows\system32\conhost.exe
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\windows\SysWOW64\TSTheme.exe
C:\windows\system32\taskeng.exe
C:\windows\system32\taskeng.exe
C:\windows\system32\SearchProtocolHost.exe
C:\windows\system32\SearchFilterHost.exe
C:\windows\system32\taskhost.exe
C:\windows\system32\DllHost.exe
C:\windows\system32\DllHost.exe
C:\windows\SysWOW64\cmd.exe
C:\windows\system32\conhost.exe
C:\windows\SysWOW64\cscript.exe
C:\windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.bungie.net/
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: TOSHIBA Media Controller Plug-in: {f3c88694-effa-4d78-b409-54b7b2535b14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll
TB: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
uRun: [EasyTether] "C:\Program Files (x86)\Mobile Stream\EasyTether\easytthr.exe"
uRun: [Userinit] C:\Users\Alex\AppData\Roaming\appconf32.exe
mRun: [KeNotify] C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
mRun: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
mRun: [SVPWUTIL] C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
mRun: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
mRun: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
mRun: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
StartupFolder: C:\Users\Alex\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
LSP: mswsock.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{6B8C2D29-B44F-4361-B5CE-A7E30A65C8A6} : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{6B8C2D29-B44F-4361-B5CE-A7E30A65C8A6}\455746F627 : DhcpNameServer = [removed] [removed]
TCP: Interfaces\{6B8C2D29-B44F-4361-B5CE-A7E30A65C8A6}\7716272756E6 : DhcpNameServer = [removed] [removed]
TCP: Interfaces\{6B8C2D29-B44F-4361-B5CE-A7E30A65C8A6}\C696E6B6379737 : DhcpNameServer = [removed] [removed]
TCP: Interfaces\{6B8C2D29-B44F-4361-B5CE-A7E30A65C8A6}\F4265627C696E634C65726 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{6B8C2D29-B44F-4361-B5CE-A7E30A65C8A6}\F4345414E4024455E4543502530333 : DhcpNameServer = [removed] [removed] [removed]
TCP: Interfaces\{9088D95F-7CFB-4D62-B6DC-B0C0F6297B23} : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{FEE10982-CD82-4968-A69E-22DA35780DA4} : DhcpNameServer = 8.8.8.8 8.8.4.4
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll
SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2 sxssrv,4
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO-X64: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO-X64: TOSHIBA Media Controller Plug-in: {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll
TB-X64: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File
mRun-x64: [KeNotify] C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
mRun-x64: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
mRun-x64: [SVPWUTIL] C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
mRun-x64: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
mRun-x64: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
mRun-x64: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
AppInit_DLLs-X64: C:\Windows\SysWOW64\nvinit.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\j3kpu51f.default\
FF - prefs.js: browser.startup.homepage - news.google.com
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?btnI=I%27m+Feeling+Lucky&q=
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.71\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: C:\Users\Alex\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll
FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R0 Thpdrv;TOSHIBA HDD Protection Driver;C:\windows\system32\DRIVERS\thpdrv.sys –> C:\windows\system32\DRIVERS\thpdrv.sys [?]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;C:\windows\system32\DRIVERS\Thpevm.SYS –> C:\windows\system32\DRIVERS\Thpevm.SYS [?]
R0 tos_sps64;TOSHIBA tos_sps64 Service;C:\windows\system32\DRIVERS\tos_sps64.sys –> C:\windows\system32\DRIVERS\tos_sps64.sys [?]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2010-2-17 14920]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2010-2-17 12360]
R1 vwififlt;Virtual WiFi Filter Driver;C:\windows\system32\DRIVERS\vwififlt.sys –> C:\windows\system32\DRIVERS\vwififlt.sys [?]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2010-6-29 128752]
R2 DMAgent;Intel® PROSet/Wireless WiMAX Red Bend Device Management Service;C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe [2009-12-29 404992]
R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2010-7-16 1604200]
R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;C:\Program Files\TOSHIBA\TECO\TecoService.exe [2010-4-6 258928]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;C:\windows\system32\DRIVERS\TVALZFL.sys –> C:\windows\system32\DRIVERS\TVALZFL.sys [?]
R2 UNS;Intel® Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-7-16 2320920]
R2 WiMAXAppSrv;Intel® PROSet/Wireless WiMAX Service;C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe [2009-12-29 911360]
R3 bpenum;bpenum;C:\windows\system32\DRIVERS\bpenum.sys –> C:\windows\system32\DRIVERS\bpenum.sys [?]
R3 bpmp;bpmp;C:\windows\system32\DRIVERS\bpmp.sys –> C:\windows\system32\DRIVERS\bpmp.sys [?]
R3 bpusb;bpusb;C:\windows\system32\Drivers\bpusb.sys –> C:\windows\system32\Drivers\bpusb.sys [?]
R3 easytether;easytether;C:\windows\system32\DRIVERS\easytthr.sys –> C:\windows\system32\DRIVERS\easytthr.sys [?]
R3 HECIx64;Intel® Management Engine Interface;C:\windows\system32\DRIVERS\HECIx64.sys –> C:\windows\system32\DRIVERS\HECIx64.sys [?]
R3 Impcd;Impcd;C:\windows\system32\DRIVERS\Impcd.sys –> C:\windows\system32\DRIVERS\Impcd.sys [?]
R3 IntcDAud;Intel® Display Audio;C:\windows\system32\DRIVERS\IntcDAud.sys –> C:\windows\system32\DRIVERS\IntcDAud.sys [?]
R3 JMCR;JMCR;C:\windows\system32\DRIVERS\jmcr.sys –> C:\windows\system32\DRIVERS\jmcr.sys [?]
R3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\windows\system32\DRIVERS\NETw5s64.sys –> C:\windows\system32\DRIVERS\NETw5s64.sys [?]
R3 PGEffect;Pangu effect driver;C:\windows\system32\DRIVERS\pgeffect.sys –> C:\windows\system32\DRIVERS\pgeffect.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\windows\system32\DRIVERS\Rt64win7.sys –> C:\windows\system32\DRIVERS\Rt64win7.sys [?]
R3 TMachInfo;TMachInfo;C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2010-7-16 51512]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-2-5 137560]
R3 TPCHSrv;TPCH Service;C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [2010-2-23 835952]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-10-8 135664]
S3 acpials;ALS Sensor Filter;C:\windows\system32\DRIVERS\acpials.sys –> C:\windows\system32\DRIVERS\acpials.sys [?]
S3 fssfltr;fssfltr;C:\windows\system32\DRIVERS\fssfltr.sys –> C:\windows\system32\DRIVERS\fssfltr.sys [?]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-10-8 135664]
S3 HtcUsbMdmV64;HTC Proprietary USB Driver;C:\windows\system32\DRIVERS\HtcUsbMdmV64.sys –> C:\windows\system32\DRIVERS\HtcUsbMdmV64.sys [?]
S3 HtcVCom32;HTC Diagnostic Port;C:\windows\system32\DRIVERS\HtcVComV64.sys –> C:\windows\system32\DRIVERS\HtcVComV64.sys [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2010-1-19 315664]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\windows\system32\DRIVERS\vwifimp.sys –> C:\windows\system32\DRIVERS\vwifimp.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\system32\Wat\WatAdminSvc.exe –> C:\windows\system32\Wat\WatAdminSvc.exe [?]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2011-10-07 11:26:51 ——– d—–w- C:\Users\Alex\AppData\Roaming\5031
2011-10-07 11:26:37 ——– d—–w- C:\Users\Alex\AppData\Roaming\UAs
2011-10-07 03:27:21 277456 —-a-w- C:\Users\Alex\AppData\Roaming\AcroIEHelpe.dll
2011-10-07 03:27:19 ——– d—–w- C:\Users\Alex\AppData\Roaming\5030
2011-10-07 03:27:12 136 —-a-w- C:\Users\Alex\AppData\Roaming\srvblck2.tmp
2011-10-07 03:27:05 ——– d—–w- C:\Users\Alex\AppData\Roaming\xmldm
2011-10-07 03:26:59 ——– d—–w- C:\Users\Alex\AppData\Roaming\kock
2011-10-07 03:26:39 ——– d—–w- C:\Users\Alex\AppData\Local\Adobe
2011-10-06 21:38:24 69000 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A35B5273-174D-4C20-963A-B8C61404F213}\offreg.dll
2011-10-06 01:05:33 ——– d-s—w- C:\ComboFix
2011-10-06 00:36:38 98816 —-a-w- C:\windows\sed.exe
2011-10-06 00:36:38 518144 —-a-w- C:\windows\SWREG.exe
2011-10-06 00:36:38 256000 —-a-w- C:\windows\PEV.exe
2011-10-06 00:36:38 208896 —-a-w- C:\windows\MBR.exe
2011-10-05 23:15:22 ——– d-sh–w- C:\$RECYCLE.BIN
2011-10-05 23:05:21 ——– d—–w- C:\Users\Alex\AppData\Roaming\TCCeelIBrzPNyAu
2011-10-05 23:05:20 ——– d—–w- C:\Users\Alex\AppData\Roaming\jdddEKK8fRZhTXj
2011-10-05 23:05:14 ——– d—–w- C:\Users\Alex\AppData\Roaming\xZZZqhhYCwkVrOB
2011-10-05 23:05:14 ——– d—–w- C:\Users\Alex\AppData\Roaming\lnFF44amH5sW7dL
2011-10-05 23:00:48 ——– d—–we C:\windows\system64
2011-10-04 21:28:32 9049936 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A35B5273-174D-4C20-963A-B8C61404F213}\mpengine.dll
2011-09-27 20:31:36 ——– d—–w- C:\Users\Alex\AppData\Roaming\JsWK7fEL9TqY
2011-09-27 20:31:36 ——– d—–w- C:\Users\Alex\AppData\Roaming\cNtxA0ucSiDpGaH
2011-09-27 18:25:00 ——– d—–w- C:\Users\Alex\AppData\Roaming\XBttzzP0ycA1vDo
2011-09-27 18:24:59 ——– d—–w- C:\Users\Alex\AppData\Roaming\CRRZZqhhYXkUVl
2011-09-27 14:22:38 ——– d—–w- C:\Users\Alex\AppData\Roaming\TEEKK8ggRZ9YXjU
2011-09-27 14:22:38 ——– d—–w- C:\Users\Alex\AppData\Roaming\h222onnF4pmHsQ7
2011-09-27 14:22:33 ——– d—–w- C:\Users\Alex\AppData\Roaming\vhhhYXXwjUVeIBz
2011-09-27 14:22:33 ——– d—–w- C:\Users\Alex\AppData\Roaming\ADDD2oonF4pm5sJ
2011-09-14 20:38:11 404640 —-a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
.
==================== Find3M ====================
.
2011-08-31 21:00:50 25416 —-a-w- C:\windows\System32\drivers\mbam.sys
2011-07-22 05:35:08 1638912 —-a-w- C:\windows\System32\mshtml.tlb
2011-07-22 04:56:17 1638912 —-a-w- C:\windows\SysWow64\mshtml.tlb
2011-07-16 05:26:54 362496 —-a-w- C:\windows\System32\wow64win.dll
2011-07-16 05:26:53 243200 —-a-w- C:\windows\System32\wow64.dll
2011-07-16 05:26:53 13312 —-a-w- C:\windows\System32\wow64cpu.dll
2011-07-16 05:26:18 214528 —-a-w- C:\windows\System32\winsrv.dll
2011-07-16 05:24:09 16384 —-a-w- C:\windows\System32\ntvdm64.dll
2011-07-16 05:21:32 422400 —-a-w- C:\windows\System32\KernelBase.dll
2011-07-16 05:17:46 338432 —-a-w- C:\windows\System32\conhost.exe
2011-07-16 04:36:09 14336 —-a-w- C:\windows\SysWow64\ntvdm64.dll
2011-07-16 04:32:14 44032 —-a-w- C:\windows\apppatch\acwow64.dll
2011-07-16 04:31:50 25600 —-a-w- C:\windows\SysWow64\setup16.exe
2011-07-16 04:30:29 5120 —-a-w- C:\windows\SysWow64\wow32.dll
2011-07-16 04:30:27 272384 —-a-w- C:\windows\SysWow64\KernelBase.dll
2011-07-16 02:26:12 7680 —-a-w- C:\windows\SysWow64\instnm.exe
2011-07-16 02:26:11 2048 —-a-w- C:\windows\SysWow64\user.exe
2011-07-16 02:21:47 6144 —ha-w- C:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2011-07-16 02:21:47 4608 —ha-w- C:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-16 02:21:47 3584 —ha-w- C:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2011-07-16 02:21:47 3072 —ha-w- C:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
2006-05-02 23:00:00 163328 –sh–r- C:\windows\SysWOW64\flvDX.dll
2007-02-20 23:00:00 31232 –sh–r- C:\windows\SysWOW64\msfDX.dll
2008-03-15 23:00:00 216064 –sh–r- C:\windows\SysWOW64\nbDX.dll
.
============= FINISH: 7:30:34.27 ===============
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 10/8/2010 3:26:54 AM
System Uptime: 10/7/2011 4:28:10 AM (3 hours ago)
.
Motherboard: TOSHIBA | | NBQAA
Processor: Intel® Core™ i5 CPU M 450 @ 2.40GHz | CPU | 2400/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 454 GiB total, 180.936 GiB free.
D: is CDROM (UDF)
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft Virtual WiFi Miniport Adapter
Device ID: {5D624F94-8850-40C3-A3FA-A4FD2080BAF3}\VWIFIMP\5&C96D958&0&02
Manufacturer: Microsoft
Name: Microsoft Virtual WiFi Miniport Adapter #2
PNP Device ID: {5D624F94-8850-40C3-A3FA-A4FD2080BAF3}\VWIFIMP\5&C96D958&0&02
Service: vwifimp
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: Windows Firewall Authorization Driver
Device ID: ROOT\LEGACY_MPSDRV\0000
Manufacturer:
Name: Windows Firewall Authorization Driver
PNP Device ID: ROOT\LEGACY_MPSDRV\0000
Service: mpsdrv
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft Virtual WiFi Miniport Adapter
Device ID: {5D624F94-8850-40C3-A3FA-A4FD2080BAF3}\VWIFIMP\5&C96D958&0&01
Manufacturer: Microsoft
Name: Microsoft Virtual WiFi Miniport Adapter
PNP Device ID: {5D624F94-8850-40C3-A3FA-A4FD2080BAF3}\VWIFIMP\5&C96D958&0&01
Service: vwifimp
.
==== System Restore Points ===================
.
RP174: 9/19/2011 7:44:59 AM - Windows Update
RP175: 9/20/2011 7:38:00 PM - Windows Update
RP176: 9/23/2011 6:13:03 PM - Windows Update
RP177: 9/28/2011 9:07:19 AM - ComboFix created restore point
RP178: 9/28/2011 9:56:27 AM - Windows Update
RP179: 9/30/2011 7:25:01 PM - Windows Update
RP180: 10/4/2011 5:28:10 PM - Windows Update
.
==== Installed Programs ======================
.
7-Zip 4.65
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.3
Apple Application Support
Apple Software Update
Battlefield 1942
Best Buy Software Installer
Brother MFL-Pro Suite MFC-490CW
CamStudio
D3DX10
DVDFab 8.0.7.3 (29/01/2011)
eFax Messenger
Google Chrome
Google Update Helper
Intel® Graphics Media Accelerator Driver
Intel® Management Engine Components
Intel® Rapid Storage Technology
Java Auto Updater
Java™ 6 Update 26
JMicron Flash Media Controller Driver
Junk Mail filter update
Label@Once 1.0
Malwarebytes' Anti-Malware version 1.51.2.1300
McAfee Security Scan Plus
Mesh Runtime
Messenger Companion
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Suite Activation Assistant
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works
Mozilla Firefox 6.0.2 (x86 en-US)
MSVCRT
MSVCRT_amd64
NVIDIA PhysX
NVIDIA Updatus
OpenOffice.org 3.2
Pinnacle Instant DVD Recorder
Power Rangers Super Legends
QuickTime
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
Realtek Ethernet Controller Driver For Windows 7
Realtek High Definition Audio Driver
RealUpgrade 1.1
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Skype Toolbars
Skype™ 4.2
Spybot - Search & Destroy
StreamTransport version: 1.0.2.2171
SUPER © Version 2010.bld.38 (May 2, 2010)
TOSHIBA Application Installer
TOSHIBA Assist
TOSHIBA Bulletin Board
TOSHIBA DVD PLAYER
TOSHIBA eco Utility
TOSHIBA Face Recognition
TOSHIBA Flash Cards Support Utility
TOSHIBA Hardware Setup
TOSHIBA HDD/SSD Alert
TOSHIBA Media Controller
TOSHIBA Media Controller Plug-in
TOSHIBA Quality Application
TOSHIBA ReelTime
TOSHIBA Service Station
TOSHIBA Sleep Utility
TOSHIBA Supervisor Password
TOSHIBA Value Added Package
TOSHIBA Web Camera Application
ToshibaRegistration
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Utility Common Driver
VLC media player 1.1.4
Vuze
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WModem Driver Installer
.
==== Event Viewer Messages From Past Week ========
.
10/7/2011 7:26:45 AM, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file.
10/6/2011 5:36:20 PM, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143.
10/6/2011 5:35:50 PM, Error: Service Control Manager [7001] - The Windows Firewall service depends on the Windows Firewall Authorization Driver service which failed to start because of the following error: Cannot create a file when that file already exists.
10/6/2011 5:35:50 PM, Error: Service Control Manager [7000] - The Windows Firewall Authorization Driver service failed to start due to the following error: Cannot create a file when that file already exists.
10/5/2011 8:36:40 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service VSS with arguments "" in order to run the server: {E579AB5F-1CC4-44B4-BED9-DE0991FF0623}
10/5/2011 8:34:12 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
10/5/2011 8:34:07 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\windows\System32\IWMSSvc.dll Error Code: 21
10/5/2011 8:34:03 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
10/5/2011 8:34:03 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
10/5/2011 8:34:00 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
10/5/2011 8:33:51 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
10/5/2011 8:33:49 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache SASDIFSV SASKUTIL spldr Wanarpv6
10/5/2011 8:32:08 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
10/5/2011 8:32:06 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
10/5/2011 8:32:06 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
10/5/2011 8:31:52 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache NetBIOS NetBT nsiproxy Psched rdbss SASDIFSV SASKUTIL spldr tdx vwififlt Wanarpv6 WfpLwf
10/5/2011 8:31:51 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
10/5/2011 8:31:51 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
10/5/2011 8:31:51 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
10/5/2011 8:31:51 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
10/5/2011 8:31:51 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
10/5/2011 8:31:51 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
10/5/2011 8:31:51 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
10/5/2011 8:31:51 PM, Error: Service Control Manager [7001] - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
10/5/2011 8:31:51 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
10/5/2011 8:31:51 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
10/5/2011 8:31:51 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
10/5/2011 8:28:35 PM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error: An instance of the service is already running.
10/5/2011 8:28:05 PM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
10/5/2011 8:28:04 PM, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error %%-1073473535.
10/5/2011 10:25:13 PM, Error: ACPI [13] - : The embedded controller (EC) did not respond within the specified timeout period. This may indicate that there is an error in the EC hardware or firmware or that the BIOS is accessing the EC incorrectly. You should check with your computer manufacturer for an upgraded BIOS. In some situations, this error may cause the computer to function incorrectly.
.
==== End Of File ===========================
aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-10-07 07:33:35
—————————–
07:33:35.762 OS Version: Windows x64 6.1.7600
07:33:35.762 Number of processors: 4 586 0x2505
07:33:35.763 ComputerName: LAPTOP UserName: Alex
07:33:37.651 Initialize success
07:35:32.440 AVAST engine defs: 11100700
07:35:42.107 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
07:35:42.112 Disk 0 Vendor: ST950042 0001 Size: 476940MB BusType: 3
07:35:42.138 Disk 0 MBR read successfully
07:35:42.140 Disk 0 MBR scan
07:35:42.144 Disk 0 Windows VISTA default MBR code
07:35:42.146 Service scanning
07:35:43.176 Modules scanning
07:35:43.179 Disk 0 trace - called modules:
07:35:43.184 ntoskrnl.exe CLASSPNP.SYS disk.sys thpdrv.sys iaStor.sys hal.dll
07:35:43.186 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8005299060]
07:35:43.189 3 CLASSPNP.SYS[fffff88001a5143f] -> nt!IofCallDriver -> \Device\THPDRV1[0xfffffa8005298060]
07:35:43.193 5 thpdrv.sys[fffff88001b94cc0] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004fb8050]
07:35:45.047 AVAST engine scan C:\windows
07:35:47.344 AVAST engine scan C:\windows\system32
07:37:25.928 AVAST engine scan C:\windows\system32\drivers
07:37:35.682 AVAST engine scan C:\Users\Alex
07:50:13.763 AVAST engine scan C:\ProgramData
07:51:13.300 Scan finished successfully
07:53:09.580 Disk 0 MBR has been saved successfully to "C:\Users\Alex\Desktop\MBR.dat"
07:53:09.585 The log file has been saved successfully to "C:\Users\Alex\Desktop\aswMBR.txt"
blackrxP2P P2P software, (Vuze Perils of P2P File Sharing Control Panel, Programs , and then Programs and Features .not recommended . ComboFix is a VERY powerful tool that can reduce a computer to a useless piece of metal without expert guidance.c:\combofix.txt , older logs are at c:\qoobox\combofix2.txt , c:\qoobox\ComboFix3.txt etc
Satchfan,
I read about the foolishness of running Combofix without guidance after I had run it…Hopefully, it hasn't affected much. As far as Vuze goes, I've had that for ages, but haven't used it in months. I suppose I might as well remove it. Thank you again for all your help.
ComboFix 11-09-28.01 - Alex 09/28/2011 9:08.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3891.1117 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\programdata\xp
c:\programdata\xp\EBLib.dll
c:\programdata\xp\TPwSav.sys
c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\j3kpu51f.default\extensions\{3611ddde-01c8-4933-9b8a-7ed0c2a303a7}
c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\j3kpu51f.default\extensions\{3611ddde-01c8-4933-9b8a-7ed0c2a303a7}\chrome.manifest
c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\j3kpu51f.default\extensions\{3611ddde-01c8-4933-9b8a-7ed0c2a303a7}\chrome\xulcache.jar
c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\j3kpu51f.default\extensions\{3611ddde-01c8-4933-9b8a-7ed0c2a303a7}\defaults\preferences\xulcache.js
c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\j3kpu51f.default\extensions\{3611ddde-01c8-4933-9b8a-7ed0c2a303a7}\install.rdf
c:\windows\system32\consrv.dll
c:\windows\System64
.
.
((((((((((((((((((((((((( Files Created from 2011-08-28 to 2011-09-28 )))))))))))))))))))))))))))))))
.
.
2011-09-28 13:13 . 2011-09-28 13:13 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp
2011-09-28 13:13 . 2011-09-28 13:13 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-09-27 22:23 . 2011-09-27 23:40 69000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{09B03C1D-E321-4481-88C4-AA801189B26C}\offreg.dll
2011-09-27 20:31 . 2011-09-27 20:31 ——– d—–w- c:\users\Alex\AppData\Roaming\JsWK7fEL9TqY
2011-09-27 20:31 . 2011-09-27 20:31 ——– d—–w- c:\users\Alex\AppData\Roaming\cNtxA0ucSiDpGaH
2011-09-27 18:25 . 2011-09-27 18:25 ——– d—–w- c:\users\Alex\AppData\Roaming\XBttzzP0ycA1vDo
2011-09-27 18:24 . 2011-09-27 18:24 ——– d—–w- c:\users\Alex\AppData\Roaming\CRRZZqhhYXkUVl
2011-09-27 14:36 . 2011-09-27 14:36 ——– d—–w- c:\windows\Sun
2011-09-27 14:22 . 2011-09-27 14:25 ——– d—–w- c:\users\Alex\AppData\Roaming\TEEKK8ggRZ9YXjU
2011-09-27 14:22 . 2011-09-27 14:22 ——– d—–w- c:\users\Alex\AppData\Roaming\h222onnF4pmHsQ7
2011-09-27 14:22 . 2011-09-27 22:19 ——– d—–w- c:\users\Alex\AppData\Roaming\vhhhYXXwjUVeIBz
2011-09-27 14:22 . 2011-09-27 14:22 ——– d—–w- c:\users\Alex\AppData\Roaming\ADDD2oonF4pm5sJ
2011-09-23 22:13 . 2011-09-13 00:26 9049936 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{09B03C1D-E321-4481-88C4-AA801189B26C}\mpengine.dll
2011-09-14 20:39 . 2011-09-14 20:39 ——– d—–w- c:\program files (x86)\Common Files\Java
2011-09-14 20:38 . 2011-09-14 20:38 404640 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-31 21:00 . 2010-10-08 20:59 25416 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-07-22 05:35 . 2011-08-09 22:33 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-07-22 04:56 . 2011-08-09 22:33 1638912 —-a-w- c:\windows\SysWow64\mshtml.tlb
2011-07-16 05:26 . 2011-08-09 22:34 362496 —-a-w- c:\windows\system32\wow64win.dll
2011-07-16 05:26 . 2011-08-09 22:34 243200 —-a-w- c:\windows\system32\wow64.dll
2011-07-16 05:26 . 2011-08-09 22:34 13312 —-a-w- c:\windows\system32\wow64cpu.dll
2011-07-16 05:26 . 2011-08-09 22:34 214528 —-a-w- c:\windows\system32\winsrv.dll
2011-07-16 05:24 . 2011-08-09 22:34 16384 —-a-w- c:\windows\system32\ntvdm64.dll
2011-07-16 05:21 . 2011-08-09 22:34 422400 —-a-w- c:\windows\system32\KernelBase.dll
2011-07-16 05:17 . 2011-08-09 22:34 338432 —-a-w- c:\windows\system32\conhost.exe
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4608 —ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4608 —ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 6144 —ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 5120 —ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-07-16 04:36 . 2011-08-09 22:34 14336 —-a-w- c:\windows\SysWow64\ntvdm64.dll
2011-07-16 04:32 . 2011-08-09 22:34 44032 —-a-w- c:\windows\apppatch\acwow64.dll
2011-07-16 04:31 . 2011-08-09 22:34 25600 —-a-w- c:\windows\SysWow64\setup16.exe
2011-07-16 04:30 . 2011-08-09 22:34 5120 —-a-w- c:\windows\SysWow64\wow32.dll
2011-07-16 04:30 . 2011-08-09 22:34 272384 —-a-w- c:\windows\SysWow64\KernelBase.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4608 —ha-w- c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 5120 —ha-w- c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
2011-07-16 02:26 . 2011-08-09 22:34 7680 —-a-w- c:\windows\SysWow64\instnm.exe
2011-07-16 02:26 . 2011-08-09 22:33 2048 —-a-w- c:\windows\SysWow64\user.exe
2011-07-16 02:21 . 2011-08-09 22:34 6144 —ha-w- c:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2011-07-16 02:21 . 2011-08-09 22:34 4608 —ha-w- c:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-16 02:21 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2011-07-16 02:21 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
2011-07-09 05:14 . 2011-08-24 11:17 2048 —-a-w- c:\windows\system32\tzres.dll
2011-07-09 04:30 . 2011-08-24 11:17 2048 —-a-w- c:\windows\SysWow64\tzres.dll
2011-07-09 02:44 . 2011-08-09 22:34 287744 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys
2006-05-02 23:00 163328 –sh–r- c:\windows\SysWOW64\flvDX.dll
2007-02-20 23:00 31232 –sh–r- c:\windows\SysWOW64\msfDX.dll
2008-03-15 23:00 216064 –sh–r- c:\windows\SysWOW64\nbDX.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2010-09-02 13351304]
"EasyTether"="c:\program files (x86)\Mobile Stream\EasyTether\easytthr.exe" [2010-12-19 48456]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"KeNotify"="c:\program files (x86)\TOSHIBA\Utilities\KeNotify.exe" [2009-12-25 34160]
"HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2010-03-04 423936]
"SVPWUTIL"="c:\program files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe" [2010-02-23 352256]
"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2009-10-06 1294136]
"TWebCamera"="c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2010-02-24 2454840]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2011-05-25 273544]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
c:\users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Best Buy Software Installer.lnk - c:\program files\Best Buy Software Installer\Best Buy Software Installer.exe [2010-2-15 1135560]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 135664]
R3 acpials;ALS Sensor Filter;c:\windows\system32\DRIVERS\acpials.sys [x]
R3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 135664]
R3 HtcUsbMdmV64;HTC Proprietary USB Driver;c:\windows\system32\DRIVERS\HtcUsbMdmV64.sys [x]
R3 HtcVCom32;HTC Diagnostic Port;c:\windows\system32\DRIVERS\HtcVComV64.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-01-20 315664]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-10-06 51512]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys [x]
S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS [x]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2010-06-29 128752]
S2 DMAgent;Intel® PROSet/Wireless WiMAX Red Bend Device Management Service;c:\program files\Intel\WiMAX\Bin\DMAgent.exe [2009-12-29 404992]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2010-05-05 1604200]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2010-04-06 258928]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [x]
S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-03-03 2320920]
S2 WiMAXAppSrv;Intel® PROSet/Wireless WiMAX Service;c:\program files\Intel\WiMAX\Bin\AppSrv.exe [2009-12-29 911360]
S3 bpenum;bpenum;c:\windows\system32\DRIVERS\bpenum.sys [x]
S3 bpmp;bpmp;c:\windows\system32\DRIVERS\bpmp.sys [x]
S3 bpusb;bpusb;c:\windows\system32\Drivers\bpusb.sys [x]
S3 easytether;easytether;c:\windows\system32\DRIVERS\easytthr.sys [x]
S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]
S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-02-06 137560]
S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2010-02-24 835952]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-09-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 19:43]
.
2011-09-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 19:43]
.
2011-09-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-691481713-2458775474-3661280945-1001Core.job
- c:\users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-25 02:49]
.
2011-09-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-691481713-2458775474-3661280945-1001UA.job
- c:\users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-25 02:49]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-26 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-26 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-26 413208]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-05-05 17412200]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-03-22 10134560]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-03-22 896032]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-01-20 1926928]
"IntelWirelessWiMAX"="c:\program files\Intel\WiMAX\Bin\WiMAXCU.exe" [2010-01-27 1445888]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-02-06 709976]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdcBase.exe" [2007-05-31 660360]
"combofix"="c:\combofix\CF15347.3XE" [2009-07-14 344576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.bungie.net/
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
TCP: DhcpNameServer = [removed] [removed] [removed]
FF - ProfilePath - c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\j3kpu51f.default\
FF - prefs.js: browser.startup.homepage - news.google.com
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?btnI=I%27m+Feeling+Lucky&q=
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{ba14329e-9550-4989-b3f2-9732e92d17cc} - (no file)
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-TSleepSrv - %ProgramFiles(x86)%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe
Toolbar-Locked - (no file)
WebBrowser-{BA14329E-9550-4989-B3F2-9732E92D17CC} - (no file)
HKLM-Run-(Default) - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
HKLM-Run-HSON - c:\program files (x86)\TOSHIBA\TBS\HSON.exe
HKLM-Run-SmoothView - c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe
HKLM-Run-00TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe
HKLM-Run-Teco - c:\program files (x86)\TOSHIBA\TECO\Teco.exe
HKLM-Run-TosWaitSrv - c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe
HKLM-Run-SmartFaceVWatcher - c:\program files (x86)\Toshiba\SmartFaceV\SmartFaceVWatcher.exe
HKLM-Run-TosNC - c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe
HKLM-Run-TosReelTimeMonitor - c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-691481713-2458775474-3661280945-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-691481713-2458775474-3661280945-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DbgagD\1*]
"value"="?\07\00\1f\0f\13'?"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
———————— Other Running Processes ————————
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
c:\program files (x86)\OpenOffice.org 3\program\soffice.exe
c:\program files (x86)\OpenOffice.org 3\program\soffice.bin
.
**************************************************************************
.
Completion time: 2011-09-28 09:58:02 - machine was rebooted
ComboFix-quarantined-files.txt 2011-09-28 13:58
.
Pre-Run: 197,454,434,304 bytes free
Post-Run: 196,771,962,880 bytes free
.
- - End Of File - - 0F2C26EF7746ACE83A0C5DA327C1F334
blackrx
Run ComboFix
I’d like a look with a fresh version so please delete the version of ComboFix you have on your desktop and download a new one from one of the following locations:
Link 1
Link 2
**Note: It is important that it is saved directly to your desktop**
——————————————————————–
IMPORTANT -
Disable your antimalware applications , usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link
here
Windows defender was running the last time you ran ComboFix: we need to disable its Real-time Protection as it may interfere with the fixes that we may need to make:
open Windows Defender click on Tools, General Settings scroll down and uncheck Turn on real-time protection (recommended) when you have unchecked this, click on the Save button and close Windows Defender.
You can re-enable it when your computer is clean; I will let you know!
——————————————————————–
Double click on
ComboFix.exe & follow the prompts.
when finished, it will produce a report for you. please post the C:\ComboFix.txt in your next post.
Thanks
Satchfan
I didnt even realize I had windows defender. Is that even worth running?
ComboFix 11-10-08.01 - Alex 10/08/2011 11:56:11.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3891.1427 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Alex\AppData\Local\Temp\winupd.exe
c:\users\Alex\AppData\Roaming\AcROiehelpe.dll
c:\users\Alex\AppData\Roaming\AcroIEHelpe.txt
c:\users\Alex\AppData\Roaming\srvblck2.tmp
c:\users\Alex\AppData\Roaming\TCCeelIBrzPNyAuAV Guard Online.ico
c:\windows\assembly\tmp\U
c:\windows\assembly\tmp\U\00000001.@
c:\windows\assembly\tmp\U\00000002.@
c:\windows\assembly\tmp\U\000000c0.@
c:\windows\assembly\tmp\U\000000cb.@
c:\windows\assembly\tmp\U\000000cf.@
c:\windows\assembly\tmp\U\80000000.@
c:\windows\assembly\tmp\U\80000032.@
c:\windows\assembly\tmp\U\80000064.@
c:\windows\assembly\tmp\U\800000c0.@
c:\windows\assembly\tmp\U\800000cb.@
c:\windows\assembly\tmp\U\800000cf.@
c:\windows\system32\consrv.dll
c:\windows\System64
.
.
((((((((((((((((((((((((( Files Created from 2011-09-08 to 2011-10-08 )))))))))))))))))))))))))))))))
.
.
2011-10-08 16:00 . 2011-10-08 16:04 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp
2011-10-08 16:00 . 2011-10-08 16:00 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-10-08 15:52 . 2011-10-08 15:52 ——– d—–w- c:\users\Alex\AppData\Local\PackageAware
2011-10-07 21:30 . 2011-09-13 00:26 9049936 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6B29CF59-E967-4D05-8206-E063994AE40D}\mpengine.dll
2011-10-07 11:26 . 2011-10-07 11:26 ——– d—–w- c:\users\Alex\AppData\Roaming\5031
2011-10-07 11:26 . 2011-10-07 11:26 ——– d—–w- c:\users\Alex\AppData\Roaming\UAs
2011-10-07 03:27 . 2011-10-07 03:27 ——– d—–w- c:\users\Alex\AppData\Roaming\5030
2011-10-07 03:27 . 2011-10-08 15:51 ——– d—–w- c:\users\Alex\AppData\Roaming\xmldm
2011-10-07 03:26 . 2011-10-07 03:26 ——– d—–w- c:\users\Alex\AppData\Roaming\kock
2011-10-07 03:26 . 2011-10-07 03:26 ——– d—–w- c:\users\Alex\AppData\Local\Adobe
2011-09-27 20:31 . 2011-09-27 20:31 ——– d—–w- c:\users\Alex\AppData\Roaming\JsWK7fEL9TqY
2011-09-27 20:31 . 2011-09-27 20:31 ——– d—–w- c:\users\Alex\AppData\Roaming\cNtxA0ucSiDpGaH
2011-09-27 18:25 . 2011-09-27 18:25 ——– d—–w- c:\users\Alex\AppData\Roaming\XBttzzP0ycA1vDo
2011-09-27 18:24 . 2011-09-27 18:24 ——– d—–w- c:\users\Alex\AppData\Roaming\CRRZZqhhYXkUVl
2011-09-27 14:36 . 2011-09-27 14:36 ——– d—–w- c:\windows\Sun
2011-09-27 14:22 . 2011-10-05 23:42 ——– d—–w- c:\users\Alex\AppData\Roaming\TEEKK8ggRZ9YXjU
2011-09-27 14:22 . 2011-09-27 14:22 ——– d—–w- c:\users\Alex\AppData\Roaming\h222onnF4pmHsQ7
2011-09-27 14:22 . 2011-09-27 22:19 ——– d—–w- c:\users\Alex\AppData\Roaming\vhhhYXXwjUVeIBz
2011-09-27 14:22 . 2011-09-27 14:22 ——– d—–w- c:\users\Alex\AppData\Roaming\ADDD2oonF4pm5sJ
2011-09-14 20:39 . 2011-09-14 20:39 ——– d—–w- c:\program files (x86)\Common Files\Java
2011-09-14 20:38 . 2011-09-14 20:38 404640 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-31 21:00 . 2010-10-08 20:59 25416 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-07-22 05:35 . 2011-08-09 22:33 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-07-22 04:56 . 2011-08-09 22:33 1638912 —-a-w- c:\windows\SysWow64\mshtml.tlb
2011-07-16 05:26 . 2011-08-09 22:34 362496 —-a-w- c:\windows\system32\wow64win.dll
2011-07-16 05:26 . 2011-08-09 22:34 243200 —-a-w- c:\windows\system32\wow64.dll
2011-07-16 05:26 . 2011-08-09 22:34 13312 —-a-w- c:\windows\system32\wow64cpu.dll
2011-07-16 05:26 . 2011-08-09 22:34 214528 —-a-w- c:\windows\system32\winsrv.dll
2011-07-16 05:24 . 2011-08-09 22:34 16384 —-a-w- c:\windows\system32\ntvdm64.dll
2011-07-16 05:21 . 2011-08-09 22:34 422400 —-a-w- c:\windows\system32\KernelBase.dll
2011-07-16 05:17 . 2011-08-09 22:34 338432 —-a-w- c:\windows\system32\conhost.exe
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4608 —ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4608 —ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 6144 —ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 5120 —ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-07-16 04:36 . 2011-08-09 22:34 14336 —-a-w- c:\windows\SysWow64\ntvdm64.dll
2011-07-16 04:32 . 2011-08-09 22:34 44032 —-a-w- c:\windows\apppatch\acwow64.dll
2011-07-16 04:31 . 2011-08-09 22:34 25600 —-a-w- c:\windows\SysWow64\setup16.exe
2011-07-16 04:30 . 2011-08-09 22:34 5120 —-a-w- c:\windows\SysWow64\wow32.dll
2011-07-16 04:30 . 2011-08-09 22:34 272384 —-a-w- c:\windows\SysWow64\KernelBase.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4608 —ha-w- c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 5120 —ha-w- c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
2011-07-16 02:26 . 2011-08-09 22:34 7680 —-a-w- c:\windows\SysWow64\instnm.exe
2011-07-16 02:26 . 2011-08-09 22:33 2048 —-a-w- c:\windows\SysWow64\user.exe
2011-07-16 02:21 . 2011-08-09 22:34 6144 —ha-w- c:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2011-07-16 02:21 . 2011-08-09 22:34 4608 —ha-w- c:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-16 02:21 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2011-07-16 02:21 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
2006-05-02 23:00 163328 –sh–r- c:\windows\SysWOW64\flvDX.dll
2007-02-20 23:00 31232 –sh–r- c:\windows\SysWOW64\msfDX.dll
2008-03-15 23:00 216064 –sh–r- c:\windows\SysWOW64\nbDX.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-09-28_13.52.04 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-10-08 00:01 . 2011-10-08 00:01 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\index.dat
- 2011-07-17 23:23 . 2011-09-28 01:20 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2011-07-17 23:23 . 2011-10-08 15:32 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2011-09-27 15:09 . 2011-10-07 21:24 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\index.dat
- 2011-09-27 15:09 . 2011-09-27 23:48 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\index.dat
+ 2011-10-08 13:42 . 2011-10-08 15:32 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012011100820111009\index.dat
+ 2011-10-07 21:20 . 2011-10-08 01:59 65536 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012011100720111008\index.dat
+ 2011-10-06 11:31 . 2011-10-07 02:37 65536 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012011100620111007\index.dat
+ 2011-10-05 23:34 . 2011-10-06 02:18 65536 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012011100520111006\index.dat
+ 2011-10-05 23:34 . 2011-10-05 23:33 65536 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012011092620111003\index.dat
+ 2011-10-08 00:01 . 2011-10-08 00:01 14848 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B4BF56F1-F140-11E0-8FEF-88AE1D50321A}.dat
+ 2011-09-27 14:32 . 2011-10-08 15:32 65536 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.dat
+ 2010-07-16 05:45 . 2011-10-06 02:50 42750 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2011-09-28 13:53 45760 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-10-08 13:32 45760 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2010-07-16 05:42 . 2011-09-28 13:51 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-07-16 05:42 . 2011-10-08 16:03 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-07-16 05:42 . 2011-09-28 13:51 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-07-16 05:42 . 2011-10-08 16:03 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-09-28 13:51 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-10-08 16:03 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-10-08 20:00 . 2011-10-08 16:04 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-10-08 20:00 . 2011-09-27 23:40 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-10-08 20:00 . 2011-09-27 23:40 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-10-08 20:00 . 2011-10-08 16:04 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-10-08 20:00 . 2011-09-27 23:40 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-10-08 20:00 . 2011-10-08 16:04 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-10-08 07:33 . 2011-09-27 23:38 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-10-08 07:33 . 2011-10-08 16:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-10-08 07:33 . 2011-09-27 23:38 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-10-08 07:33 . 2011-10-08 16:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-10-08 15:54 . 2011-10-08 15:54 2687 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6T547OFV\spike[2].com
+ 2011-10-08 00:01 . 2011-10-08 00:01 5120 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B4BF56EF-F140-11E0-8FEF-88AE1D50321A}.dat
+ 2011-10-08 00:01 . 2011-10-08 00:01 4096 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B4BF56F0-F140-11E0-8FEF-88AE1D50321A}.dat
- 2010-10-14 14:24 . 2011-09-14 16:16 3500 c:\windows\system32\wdi\ERCQueuedResolutions.dat
+ 2010-10-14 14:24 . 2011-10-08 16:02 3500 c:\windows\system32\wdi\ERCQueuedResolutions.dat
+ 2010-10-08 07:28 . 2011-10-08 13:32 9268 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-691481713-2458775474-3661280945-1001_UserData.bin
- 2011-09-27 23:38 . 2011-09-28 13:51 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-10-08 16:03 . 2011-10-08 16:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-09-27 23:38 . 2011-09-28 13:51 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-10-08 16:03 . 2011-10-08 16:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 04:54 . 2011-10-08 15:32 507904 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-10-09 03:02 . 2011-10-07 23:48 336306 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2009-07-14 05:12 . 2011-09-27 23:38 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 05:12 . 2011-10-08 13:29 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-07-14 05:01 . 2011-09-27 23:37 446536 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-10-08 16:02 446536 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-09-27 14:21 . 2011-10-08 13:29 208896 c:\windows\assembly\tmp\kwrd.dll
- 2011-09-27 14:21 . 2011-09-27 23:38 208896 c:\windows\assembly\tmp\kwrd.dll
+ 2009-07-14 04:54 . 2011-10-08 15:32 4931584 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-10-08 15:32 2424832 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-02-09 22:38 . 2011-10-08 16:02 1564284 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-691481713-2458775474-3661280945-1001-8192.dat
- 2011-02-09 22:38 . 2011-09-27 23:37 1564284 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-691481713-2458775474-3661280945-1001-8192.dat
+ 2009-07-14 02:34 . 2011-10-07 21:41 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
- 2009-07-14 02:34 . 2011-09-27 22:35 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2010-09-02 13351304]
"EasyTether"="c:\program files (x86)\Mobile Stream\EasyTether\easytthr.exe" [2010-12-19 48456]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"KeNotify"="c:\program files (x86)\TOSHIBA\Utilities\KeNotify.exe" [2009-12-25 34160]
"HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2010-03-04 423936]
"SVPWUTIL"="c:\program files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe" [2010-02-23 352256]
"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2009-10-06 1294136]
"TWebCamera"="c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2010-02-24 2454840]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2011-05-25 273544]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
c:\users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
winupd.lnk - c:\users\Alex\AppData\Local\Temp\winupd.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 135664]
R3 acpials;ALS Sensor Filter;c:\windows\system32\DRIVERS\acpials.sys [x]
R3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 135664]
R3 HtcUsbMdmV64;HTC Proprietary USB Driver;c:\windows\system32\DRIVERS\HtcUsbMdmV64.sys [x]
R3 HtcVCom32;HTC Diagnostic Port;c:\windows\system32\DRIVERS\HtcVComV64.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-01-20 315664]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-10-06 51512]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys [x]
S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS [x]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2010-06-29 128752]
S2 DMAgent;Intel® PROSet/Wireless WiMAX Red Bend Device Management Service;c:\program files\Intel\WiMAX\Bin\DMAgent.exe [2009-12-29 404992]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2010-05-05 1604200]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2010-04-06 258928]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [x]
S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-03-03 2320920]
S2 WiMAXAppSrv;Intel® PROSet/Wireless WiMAX Service;c:\program files\Intel\WiMAX\Bin\AppSrv.exe [2009-12-29 911360]
S3 bpenum;bpenum;c:\windows\system32\DRIVERS\bpenum.sys [x]
S3 bpmp;bpmp;c:\windows\system32\DRIVERS\bpmp.sys [x]
S3 bpusb;bpusb;c:\windows\system32\Drivers\bpusb.sys [x]
S3 easytether;easytether;c:\windows\system32\DRIVERS\easytthr.sys [x]
S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]
S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-02-06 137560]
S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2010-02-24 835952]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 19:43]
.
2011-10-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 19:43]
.
2011-10-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-691481713-2458775474-3661280945-1001Core.job
- c:\users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-25 02:49]
.
2011-10-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-691481713-2458775474-3661280945-1001UA.job
- c:\users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-25 02:49]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-26 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-26 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-26 413208]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-05-05 17412200]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-03-22 10134560]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-03-22 896032]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"TPwrMain"="c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE" [BU]
"HSON"="c:\program files (x86)\TOSHIBA\TBS\HSON.exe" [BU]
"SmoothView"="c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe" [BU]
"00TCrdMain"="c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe" [BU]
"Teco"="c:\program files (x86)\TOSHIBA\TECO\Teco.exe" [BU]
"TosWaitSrv"="c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe" [BU]
"SmartFaceVWatcher"="c:\program files (x86)\Toshiba\SmartFaceV\SmartFaceVWatcher.exe" [BU]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-01-20 1926928]
"IntelWirelessWiMAX"="c:\program files\Intel\WiMAX\Bin\WiMAXCU.exe" [2010-01-27 1445888]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-02-06 709976]
"TosNC"="c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe" [BU]
"TosReelTimeMonitor"="c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe" [BU]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdcBase.exe" [2007-05-31 660360]
"combofix"="c:\combofix\CF18729.3XE" [2009-07-14 344576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.bungie.net/
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\j3kpu51f.default\
FF - prefs.js: browser.startup.homepage - news.google.com
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?btnI=I%27m+Feeling+Lucky&q=
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
AddRemove-{FBBC4667-2521-4E78-B1BD-8706F774549B} - c:\programdata\{249B9E04-F0FC-434D-B0D8-12D3EDFF3B77}\Best Buy Software Installer Setup.exe
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-691481713-2458775474-3661280945-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-691481713-2458775474-3661280945-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DbgagD\1*]
"value"="?\07\00\1f\0f\13'?"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
———————— Other Running Processes ————————
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
c:\program files (x86)\OpenOffice.org 3\program\soffice.exe
c:\program files (x86)\OpenOffice.org 3\program\soffice.bin
c:\program files (x86)\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2011-10-08 12:08:22 - machine was rebooted
ComboFix-quarantined-files.txt 2011-10-08 16:08
ComboFix2.txt 2011-09-28 13:58
.
Pre-Run: 196,854,743,040 bytes free
Post-Run: 196,718,735,360 bytes free
.
- - End Of File - - 6088D558ECF68B0E8131D7895FEB9769
Hi blackrx
Open ComboFix Please do the following :
close any open browsers. close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix. open notepad and copy/paste the text in the codebox below into it: DirLook::
c:\users\Alex\AppData\Roaming\JsWK7fEL9TqY
c:\users\Alex\AppData\Roaming\cNtxA0ucSiDpGaH
c:\users\Alex\AppData\Roaming\XBttzzP0ycA1vDo
c:\users\Alex\AppData\Roaming\CRRZZqhhYXkUVl
c:\windows\Sun
c:\users\Alex\AppData\Roaming\TEEKK8ggRZ9YXjU
c:\users\Alex\AppData\Roaming\h222onnF4pmHsQ7
c:\users\Alex\AppData\Roaming\vhhhYXXwjUVeIBz
c:\users\Alex\AppData\Roaming\ADDD2oonF4pm5sJ
c:\users\Alex\AppData\Roaming\5031
c:\users\Alex\AppData\Roaming\UAs
c:\users\Alex\AppData\Roaming\5030
c:\users\Alex\AppData\Roaming\xmldm
c:\users\Alex\AppData\Roaming\kock
RegLockDel::
[HKEY_LOCAL_MACHINE\software\Microsoft\DbgagD]
Save this as
"CFScript.txt" , and as Type: All Files (*.*) in the same location as ComboFix.exe
[external image: Posted Image]
Referring to the picture above, drag CFScript into ComboFix.exe
When finished, it produces a log at
C:\ComboFix.txt . Post the contents of Combofix.txt in your next reply.
========================================================
Run Malwarebytes’ Anti-Malware
I noticed that you had MBAM on your system: if you no longer have it, you can download it from
here :
start Malwarebytes-Anti-Malware and update it, (“Update” tab} once it is updated, click on “Scanner” tab, select Perform quick scan , then click Scan . when the scan is complete, click OK , then Show Results to view the results. be sure that everything is checked, and click Remove Selected . when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below) the log is automatically saved and can be viewed by clicking the Logs tab in MBAM. copy and paste the contents of that report in your next reply and exit MBAM. NOTE : If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.
Please post both logs in your reply
Satchfan
After I ran Combofix with the command switches I accidentally exited out of the log before saving it. Before I closed it, however, I read that the "DbgagD" thing was deleted. I re-did the steps and saved the log this time, but there's no mention of the deletion. Hopefully because it was already deleted. Just wanted to let you know.
I cannot emphasize how much I appreciate your help. A donation will be on the way for sure.
ComboFix 11-10-08.05 - Alex 10/08/2011 22:38:29.4.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3891.2112 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Alex\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-09-09 to 2011-10-09 )))))))))))))))))))))))))))))))
.
.
2011-10-09 02:41 . 2011-10-09 02:41 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp
2011-10-09 02:41 . 2011-10-09 02:41 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-10-08 16:07 . 2011-10-08 16:07 69000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6B29CF59-E967-4D05-8206-E063994AE40D}\offreg.dll
2011-10-08 15:52 . 2011-10-08 15:52 ——– d—–w- c:\users\Alex\AppData\Local\PackageAware
2011-10-07 21:30 . 2011-09-13 00:26 9049936 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6B29CF59-E967-4D05-8206-E063994AE40D}\mpengine.dll
2011-10-07 11:26 . 2011-10-07 11:26 ——– d—–w- c:\users\Alex\AppData\Roaming\5031
2011-10-07 11:26 . 2011-10-07 11:26 ——– d—–w- c:\users\Alex\AppData\Roaming\UAs
2011-10-07 03:27 . 2011-10-07 03:27 ——– d—–w- c:\users\Alex\AppData\Roaming\5030
2011-10-07 03:27 . 2011-10-09 02:35 ——– d—–w- c:\users\Alex\AppData\Roaming\xmldm
2011-10-07 03:26 . 2011-10-07 03:26 ——– d—–w- c:\users\Alex\AppData\Roaming\kock
2011-10-07 03:26 . 2011-10-08 20:15 ——– d—–w- c:\users\Alex\AppData\Local\Adobe
2011-10-05 23:05 . 2011-10-05 23:05 ——– d—–w- c:\users\Alex\AppData\Roaming\TCCeelIBrzPNyAu
2011-10-05 23:05 . 2011-10-05 23:05 ——– d—–w- c:\users\Alex\AppData\Roaming\jdddEKK8fRZhTXj
2011-10-05 23:05 . 2011-10-05 23:19 ——– d—–w- c:\users\Alex\AppData\Roaming\lnFF44amH5sW7dL
2011-10-05 23:05 . 2011-10-05 23:05 ——– d—–w- c:\users\Alex\AppData\Roaming\xZZZqhhYCwkVrOB
2011-09-27 20:31 . 2011-09-27 20:31 ——– d—–w- c:\users\Alex\AppData\Roaming\JsWK7fEL9TqY
2011-09-27 20:31 . 2011-09-27 20:31 ——– d—–w- c:\users\Alex\AppData\Roaming\cNtxA0ucSiDpGaH
2011-09-27 18:25 . 2011-09-27 18:25 ——– d—–w- c:\users\Alex\AppData\Roaming\XBttzzP0ycA1vDo
2011-09-27 18:24 . 2011-09-27 18:24 ——– d—–w- c:\users\Alex\AppData\Roaming\CRRZZqhhYXkUVl
2011-09-27 14:36 . 2011-09-27 14:36 ——– d—–w- c:\windows\Sun
2011-09-27 14:22 . 2011-10-05 23:42 ——– d—–w- c:\users\Alex\AppData\Roaming\TEEKK8ggRZ9YXjU
2011-09-27 14:22 . 2011-09-27 14:22 ——– d—–w- c:\users\Alex\AppData\Roaming\h222onnF4pmHsQ7
2011-09-27 14:22 . 2011-09-27 22:19 ——– d—–w- c:\users\Alex\AppData\Roaming\vhhhYXXwjUVeIBz
2011-09-27 14:22 . 2011-09-27 14:22 ——– d—–w- c:\users\Alex\AppData\Roaming\ADDD2oonF4pm5sJ
2011-09-14 20:39 . 2011-09-14 20:39 ——– d—–w- c:\program files (x86)\Common Files\Java
2011-09-14 20:38 . 2011-09-14 20:38 404640 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-31 21:00 . 2010-10-08 20:59 25416 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-07-22 05:35 . 2011-08-09 22:33 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-07-22 04:56 . 2011-08-09 22:33 1638912 —-a-w- c:\windows\SysWow64\mshtml.tlb
2011-07-16 05:26 . 2011-08-09 22:34 362496 —-a-w- c:\windows\system32\wow64win.dll
2011-07-16 05:26 . 2011-08-09 22:34 243200 —-a-w- c:\windows\system32\wow64.dll
2011-07-16 05:26 . 2011-08-09 22:34 13312 —-a-w- c:\windows\system32\wow64cpu.dll
2011-07-16 05:26 . 2011-08-09 22:34 214528 —-a-w- c:\windows\system32\winsrv.dll
2011-07-16 05:24 . 2011-08-09 22:34 16384 —-a-w- c:\windows\system32\ntvdm64.dll
2011-07-16 05:21 . 2011-08-09 22:34 422400 —-a-w- c:\windows\system32\KernelBase.dll
2011-07-16 05:17 . 2011-08-09 22:34 338432 —-a-w- c:\windows\system32\conhost.exe
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4608 —ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4608 —ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 6144 —ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 5120 —ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-07-16 04:36 . 2011-08-09 22:34 14336 —-a-w- c:\windows\SysWow64\ntvdm64.dll
2011-07-16 04:32 . 2011-08-09 22:34 44032 —-a-w- c:\windows\apppatch\acwow64.dll
2011-07-16 04:31 . 2011-08-09 22:34 25600 —-a-w- c:\windows\SysWow64\setup16.exe
2011-07-16 04:30 . 2011-08-09 22:34 5120 —-a-w- c:\windows\SysWow64\wow32.dll
2011-07-16 04:30 . 2011-08-09 22:34 272384 —-a-w- c:\windows\SysWow64\KernelBase.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4608 —ha-w- c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 5120 —ha-w- c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
2011-07-16 02:26 . 2011-08-09 22:34 7680 —-a-w- c:\windows\SysWow64\instnm.exe
2011-07-16 02:26 . 2011-08-09 22:33 2048 —-a-w- c:\windows\SysWow64\user.exe
2011-07-16 02:21 . 2011-08-09 22:34 6144 —ha-w- c:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2011-07-16 02:21 . 2011-08-09 22:34 4608 —ha-w- c:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-16 02:21 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2011-07-16 02:21 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
2006-05-02 23:00 163328 –sh–r- c:\windows\SysWOW64\flvDX.dll
2007-02-20 23:00 31232 –sh–r- c:\windows\SysWOW64\msfDX.dll
2008-03-15 23:00 216064 –sh–r- c:\windows\SysWOW64\nbDX.dll
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—- Directory of c:\users\Alex\AppData\Roaming\5030 —-
.
2011-10-07 03:27 . 2011-10-07 03:27 143360 —-a-w- c:\users\Alex\AppData\Roaming\5030\components\AcroFF6.dll
2011-10-07 03:27 . 2011-10-07 03:27 151552 —-a-w- c:\users\Alex\AppData\Roaming\5030\components\AcroFF7.dll
2011-10-07 03:27 . 2011-10-07 03:27 295 —-a-w- c:\users\Alex\AppData\Roaming\5030\chrome.manifest
2011-10-07 03:27 . 2011-10-07 03:27 539 —-a-w- c:\users\Alex\AppData\Roaming\5030\install.rdf
2011-10-07 03:27 . 2011-10-07 03:27 147456 —-a-w- c:\users\Alex\AppData\Roaming\5030\components\AcroFF5.dll
2011-10-07 03:27 . 2011-10-07 03:27 77 —-a-w- c:\users\Alex\AppData\Roaming\5030\components\AcroFF.txt
.
—- Directory of c:\users\Alex\AppData\Roaming\5031 —-
.
2011-10-07 11:26 . 2011-10-07 11:26 155648 —-a-w- c:\users\Alex\AppData\Roaming\5031\components\AcroFF0317.dll
2011-10-07 11:26 . 2011-10-07 11:26 143360 —-a-w- c:\users\Alex\AppData\Roaming\5031\components\AcroFF0316.dll
2011-10-07 11:26 . 2011-10-07 11:26 307 —-a-w- c:\users\Alex\AppData\Roaming\5031\chrome.manifest
2011-10-07 11:26 . 2011-10-07 11:26 143360 —-a-w- c:\users\Alex\AppData\Roaming\5031\components\AcroFF0315.dll
2011-10-07 11:26 . 2011-10-07 11:26 539 —-a-w- c:\users\Alex\AppData\Roaming\5031\install.rdf
2011-10-07 11:26 . 2011-10-07 11:26 605136 —-a-w- c:\users\Alex\AppData\Roaming\5031\components\AcroFF031.dll
2011-10-07 11:26 . 2011-10-07 11:26 77 —-a-w- c:\users\Alex\AppData\Roaming\5031\components\AcroFF.txt
.
—- Directory of c:\users\Alex\AppData\Roaming\ADDD2oonF4pm5sJ —-
.
.
—- Directory of c:\users\Alex\AppData\Roaming\cNtxA0ucSiDpGaH —-
.
.
—- Directory of c:\users\Alex\AppData\Roaming\CRRZZqhhYXkUVl —-
.
.
—- Directory of c:\users\Alex\AppData\Roaming\h222onnF4pmHsQ7 —-
.
.
—- Directory of c:\users\Alex\AppData\Roaming\JsWK7fEL9TqY —-
.
.
—- Directory of c:\users\Alex\AppData\Roaming\kock —-
.
.
—- Directory of c:\users\Alex\AppData\Roaming\TEEKK8ggRZ9YXjU —-
.
.
—- Directory of c:\users\Alex\AppData\Roaming\UAs —-
.
2011-10-07 11:26 . 2011-10-07 11:26 10 —-a-w- c:\users\Alex\AppData\Roaming\UAs\_UAs002.dat
2011-10-07 11:26 . 2011-10-07 11:26 10 —-a-w- c:\users\Alex\AppData\Roaming\UAs\_UAs001.dat
.
—- Directory of c:\users\Alex\AppData\Roaming\vhhhYXXwjUVeIBz —-
.
.
—- Directory of c:\users\Alex\AppData\Roaming\XBttzzP0ycA1vDo —-
.
.
—- Directory of c:\users\Alex\AppData\Roaming\xmldm —-
.
2011-10-09 02:35 . 2011-10-09 02:35 30516 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000340_ifrm.htm
2011-10-09 02:35 . 2011-10-09 02:35 147106 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000339_ifrm.htm
2011-10-09 02:35 . 2011-10-09 02:35 23489 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000338_ifrm.htm
2011-10-09 02:35 . 2011-10-09 02:35 17929 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000337_ifrm.htm
2011-10-09 02:35 . 2011-10-09 02:35 8366 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000336_ifrm.htm
2011-10-09 02:35 . 2011-10-09 02:35 13569 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000335_ifrm.htm
2011-10-09 02:35 . 2011-10-09 02:35 65876 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000334_ifrm.htm
2011-10-09 02:35 . 2011-10-09 02:35 13649 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000333_ifrm.htm
2011-10-09 02:35 . 2011-10-09 02:35 15086 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000332_ifrm.htm
2011-10-09 02:35 . 2011-10-09 02:35 30516 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000331_ifrm.htm
2011-10-09 02:35 . 2011-10-09 02:35 147106 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000330_ifrm.htm
2011-10-09 02:35 . 2011-10-09 02:35 11640 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000329_ifrm.htm
2011-10-09 02:35 . 2011-10-09 02:35 27644 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000328_ifrm.htm
2011-10-09 02:35 . 2011-10-09 02:35 11536 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000327_ifrm.htm
2011-10-09 02:35 . 2011-10-09 02:35 33941 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000326_ifrm.htm
2011-10-09 02:35 . 2011-10-09 02:35 7200 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000325_ifrm.htm
2011-10-09 02:35 . 2011-10-09 02:35 68046 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000324_ifrm.htm
2011-10-09 02:35 . 2011-10-09 02:35 10165 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000323_ifrm.htm
2011-10-08 22:33 . 2011-10-08 22:33 30516 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000322_ifrm.htm
2011-10-08 22:33 . 2011-10-08 22:33 147106 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000321_ifrm.htm
2011-10-08 22:33 . 2011-10-08 22:33 23489 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000320_ifrm.htm
2011-10-08 22:33 . 2011-10-08 22:33 17929 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000319_ifrm.htm
2011-10-08 22:33 . 2011-10-08 22:33 8366 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000318_ifrm.htm
2011-10-08 22:33 . 2011-10-08 22:33 11536 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000317_ifrm.htm
2011-10-08 22:33 . 2011-10-08 22:33 13649 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000316_ifrm.htm
2011-10-08 22:33 . 2011-10-08 22:33 15086 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000315_ifrm.htm
2011-10-08 22:33 . 2011-10-08 22:33 13569 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000314_ifrm.htm
2011-10-08 22:33 . 2011-10-08 22:33 147106 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000313_ifrm.htm
2011-10-08 22:33 . 2011-10-08 22:33 11640 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000312_ifrm.htm
2011-10-08 22:33 . 2011-10-08 22:33 30516 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000311_ifrm.htm
2011-10-08 22:33 . 2011-10-08 22:33 27644 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000310_ifrm.htm
2011-10-08 22:33 . 2011-10-08 22:33 7200 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000309_ifrm.htm
2011-10-08 22:33 . 2011-10-08 22:33 65876 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000308_ifrm.htm
2011-10-08 22:33 . 2011-10-08 22:33 10165 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000307_ifrm.htm
2011-10-08 22:33 . 2011-10-08 22:33 33941 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000306_ifrm.htm
2011-10-08 22:33 . 2011-10-08 22:33 68046 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000305_ifrm.htm
2011-10-08 22:32 . 2011-10-08 22:32 10788 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000304.htm
2011-10-08 22:32 . 2011-10-08 22:32 4938 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000303_ifrm.htm
2011-10-08 21:58 . 2011-10-08 21:58 30557 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000302_ifrm.htm
2011-10-08 21:58 . 2011-10-08 21:58 147147 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000301_ifrm.htm
2011-10-08 21:58 . 2011-10-08 21:58 23530 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000300_ifrm.htm
2011-10-08 21:58 . 2011-10-08 21:58 17970 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000299_ifrm.htm
2011-10-08 21:58 . 2011-10-08 21:58 8407 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000298_ifrm.htm
2011-10-08 21:58 . 2011-10-08 21:58 13610 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000297_ifrm.htm
2011-10-08 21:58 . 2011-10-08 21:58 13690 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000296_ifrm.htm
2011-10-08 21:58 . 2011-10-08 21:58 11681 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000295_ifrm.htm
2011-10-08 21:58 . 2011-10-08 21:58 11577 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000294_ifrm.htm
2011-10-08 21:58 . 2011-10-08 21:58 7241 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000293_ifrm.htm
2011-10-08 21:58 . 2011-10-08 21:58 30557 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000292_ifrm.htm
2011-10-08 21:58 . 2011-10-08 21:58 10206 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000291_ifrm.htm
2011-10-08 21:58 . 2011-10-08 21:58 68087 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000290_ifrm.htm
2011-10-08 21:58 . 2011-10-08 21:58 33982 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000289_ifrm.htm
2011-10-08 21:58 . 2011-10-08 21:58 15127 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000288_ifrm.htm
2011-10-08 21:58 . 2011-10-08 21:58 147147 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000287_ifrm.htm
2011-10-08 21:58 . 2011-10-08 21:58 27685 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000286_ifrm.htm
2011-10-08 21:58 . 2011-10-08 21:58 65917 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000285_ifrm.htm
2011-10-08 21:56 . 2011-10-08 21:56 10172 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000284_ifrm.htm
2011-10-08 21:56 . 2011-10-08 21:56 23496 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000283_ifrm.htm
2011-10-08 21:56 . 2011-10-08 21:56 17936 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000282_ifrm.htm
2011-10-08 21:56 . 2011-10-08 21:56 8373 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000281_ifrm.htm
2011-10-08 21:56 . 2011-10-08 21:56 30523 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000280_ifrm.htm
2011-10-08 21:56 . 2011-10-08 21:56 147113 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000279_ifrm.htm
2011-10-08 21:56 . 2011-10-08 21:56 65883 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000278_ifrm.htm
2011-10-08 21:56 . 2011-10-08 21:56 27651 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000277_ifrm.htm
2011-10-08 21:56 . 2011-10-08 21:56 147113 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000276_ifrm.htm
2011-10-08 21:56 . 2011-10-08 21:56 33948 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000275_ifrm.htm
2011-10-08 21:56 . 2011-10-08 21:56 11543 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000274_ifrm.htm
2011-10-08 21:56 . 2011-10-08 21:56 11647 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000273_ifrm.htm
2011-10-08 21:56 . 2011-10-08 21:56 30523 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000272_ifrm.htm
2011-10-08 21:56 . 2011-10-08 21:56 68053 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000271_ifrm.htm
2011-10-08 21:56 . 2011-10-08 21:56 7207 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000270_ifrm.htm
2011-10-08 21:56 . 2011-10-08 21:56 13656 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000269_ifrm.htm
2011-10-08 21:56 . 2011-10-08 21:56 13576 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000268_ifrm.htm
2011-10-08 21:56 . 2011-10-08 21:56 15093 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000267_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 468 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000266.frm
2011-10-08 21:54 . 2011-10-08 21:54 406 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000265.key
2011-10-08 21:54 . 2011-10-08 21:54 13603 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000264_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 27598 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000263_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 7154 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000262_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 11594 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000261_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 30470 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000260_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 68000 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000259_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 10119 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000258_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 65830 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000257_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 15040 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000256_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 33895 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000255_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 13523 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000254_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 147060 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000253_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 11490 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000252_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 13544 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000251_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 10708 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000250_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 15627 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000249_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 111724 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000248.htm
2011-10-08 21:54 . 2011-10-08 21:54 1542 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000247.pst
2011-10-08 21:54 . 2011-10-08 21:54 512 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000246.frm
2011-10-08 21:54 . 2011-10-08 21:54 364 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000245.key
2011-10-08 21:54 . 2011-10-08 21:54 11513 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000244_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 13567 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000243_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 10731 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000242_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 15650 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000241_ifrm.htm
2011-10-08 21:54 . 2011-10-08 21:54 115499 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000240.htm
2011-10-08 21:28 . 2011-10-08 21:28 922 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000239_ifrm.htm
2011-10-08 21:28 . 2011-10-08 21:28 1456 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000238_ifrm.htm
2011-10-08 21:28 . 2011-10-08 21:28 1456 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000237_ifrm.htm
2011-10-08 21:28 . 2011-10-08 21:28 1453 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000236_ifrm.htm
2011-10-08 21:28 . 2011-10-08 21:28 1450 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000235_ifrm.htm
2011-10-08 21:28 . 2011-10-08 21:28 1453 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000234_ifrm.htm
2011-10-08 21:28 . 2011-10-08 21:28 3277 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000233_ifrm.htm
2011-10-08 21:28 . 2011-10-08 21:28 45029 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000232.htm
2011-10-08 21:28 . 2011-10-08 21:29 550 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000231.key
2011-10-08 21:28 . 2011-10-08 21:28 1453 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000230_ifrm.htm
2011-10-08 21:28 . 2011-10-08 21:28 2383 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000229_ifrm.htm
2011-10-08 21:28 . 2011-10-08 21:28 280 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000228_ifrm.htm
2011-10-08 21:28 . 2011-10-08 21:28 280 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000227_ifrm.htm
2011-10-08 21:28 . 2011-10-08 21:28 280 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000226_ifrm.htm
2011-10-08 21:28 . 2011-10-08 21:28 280 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000225_ifrm.htm
2011-10-08 21:28 . 2011-10-08 21:28 280 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000224_ifrm.htm
2011-10-08 21:28 . 2011-10-08 21:28 283 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000223_ifrm.htm
2011-10-08 21:28 . 2011-10-08 21:28 510 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000222.key
2011-10-08 21:28 . 2011-10-08 21:28 3283 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000221_ifrm.htm
2011-10-08 21:28 . 2011-10-08 21:28 79861 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000220.htm
2011-10-08 21:28 . 2011-10-08 21:28 530 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000219.htm
2011-10-08 21:28 . 2011-10-08 21:28 384 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000218.pst
2011-10-08 21:28 . 2011-10-08 21:28 590 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000217.frm
2011-10-08 21:28 . 2011-10-08 21:28 554 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000216.frm
2011-10-08 21:28 . 2011-10-08 21:28 560 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000215.key
2011-10-08 21:28 . 2011-10-08 21:28 3283 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000214_ifrm.htm
2011-10-08 21:28 . 2011-10-08 21:28 36624 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000213.htm
2011-10-08 21:28 . 2011-10-08 21:28 432 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000212.pst
2011-10-08 21:28 . 2011-10-08 21:28 710 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000211.frm
2011-10-08 21:28 . 2011-10-08 21:28 730 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000210.key
2011-10-08 21:28 . 2011-10-08 21:28 3281 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000209_ifrm.htm
2011-10-08 21:28 . 2011-10-08 21:28 35956 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000208.htm
2011-10-08 21:02 . 2011-10-08 21:02 458 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000207.key
2011-10-08 21:02 . 2011-10-08 21:02 851 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000206_ifrm.htm
2011-10-08 21:02 . 2011-10-08 21:02 1678 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000205_ifrm.htm
2011-10-08 21:02 . 2011-10-08 21:02 249380 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000204.htm
2011-10-08 21:02 . 2011-10-08 21:02 355 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000203_ifrm.htm
2011-10-08 21:02 . 2011-10-08 21:02 355 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000202_ifrm.htm
2011-10-08 21:02 . 2011-10-08 21:02 355 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000201_ifrm.htm
2011-10-08 21:01 . 2011-10-08 22:03 506 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000200.key
2011-10-08 21:01 . 2011-10-08 21:01 24887 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000199.htm
2011-10-08 21:01 . 2011-10-08 21:01 24602 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000198_ifrm.htm
2011-10-08 21:01 . 2011-10-08 21:01 806 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000197_ifrm.htm
2011-10-08 20:59 . 2011-10-08 20:59 454 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000196.key
2011-10-08 20:59 . 2011-10-08 21:05 446 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000195.key
2011-10-08 20:58 . 2011-10-08 20:58 32332 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000194.htm
2011-10-08 20:58 . 2011-10-08 20:58 785 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000193_ifrm.htm
2011-10-08 20:58 . 2011-10-08 20:58 25536 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000192.htm
2011-10-08 20:58 . 2011-10-08 20:58 785 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000191_ifrm.htm
2011-10-08 20:58 . 2011-10-08 21:01 442 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000190.key
2011-10-08 20:58 . 2011-10-08 20:58 14812 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000189.htm
2011-10-08 20:58 . 2011-10-08 20:58 794 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000188_ifrm.htm
2011-10-08 20:58 . 2011-10-08 20:58 488 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000187.key
2011-10-08 20:58 . 2011-10-08 20:58 19529 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000186.htm
2011-10-08 20:58 . 2011-10-08 20:58 740 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000185_ifrm.htm
2011-10-08 20:58 . 2011-10-08 20:58 370 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000184.key
2011-10-08 20:58 . 2011-10-08 20:58 19576 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000183.htm
2011-10-08 20:58 . 2011-10-08 20:58 740 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000182_ifrm.htm
2011-10-08 20:58 . 2011-10-08 20:58 24603 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000181_ifrm.htm
2011-10-08 20:57 . 2011-10-08 20:57 26622 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000180_ifrm.htm
2011-10-08 20:57 . 2011-10-08 20:57 24593 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000179_ifrm.htm
2011-10-08 20:57 . 2011-10-08 20:58 482 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000178.key
2011-10-08 20:57 . 2011-10-08 20:57 37475 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000177.htm
2011-10-08 20:57 . 2011-10-08 20:57 786 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000176_ifrm.htm
2011-10-08 20:57 . 2011-10-08 20:57 276 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000175.key
2011-10-08 20:57 . 2011-10-08 20:57 19530 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000174.htm
2011-10-08 20:57 . 2011-10-08 20:57 741 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000173_ifrm.htm
2011-10-08 20:56 . 2011-10-08 20:56 550 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000172.key
2011-10-08 20:56 . 2011-10-08 20:56 26055 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000171.htm
2011-10-08 20:56 . 2011-10-08 20:56 550 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000170.key
2011-10-08 20:56 . 2011-10-08 20:56 24650 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000169.htm
2011-10-08 20:56 . 2011-10-08 20:56 1186 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000168.key
2011-10-08 20:55 . 2011-10-08 20:55 26669 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000167.htm
2011-10-08 20:55 . 2011-10-09 02:24 1486 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000166.key
2011-10-08 20:55 . 2011-10-08 20:55 66306 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000165.htm
2011-10-08 20:55 . 2011-10-08 20:55 683 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000164_ifrm.htm
2011-10-08 20:55 . 2011-10-08 20:55 900 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000163.key
2011-10-08 20:54 . 2011-10-08 20:54 79828 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000162.htm
2011-10-08 20:50 . 2011-10-08 20:50 14954 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000161.htm
2011-10-08 20:50 . 2011-10-08 20:50 644 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000160.frm
2011-10-08 20:50 . 2011-10-08 20:50 628 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000159.frm
2011-10-08 20:50 . 2011-10-08 20:50 626 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000158.frm
2011-10-08 20:50 . 2011-10-08 20:50 624 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000157.frm
2011-10-08 20:50 . 2011-10-08 20:50 622 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000156.frm
2011-10-08 20:50 . 2011-10-08 20:50 610 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000155.frm
2011-10-08 20:50 . 2011-10-08 20:50 584 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000154.frm
2011-10-08 20:50 . 2011-10-08 20:50 578 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000153.frm
2011-10-08 20:50 . 2011-10-08 20:50 560 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000152.frm
2011-10-08 20:50 . 2011-10-08 20:50 552 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000151.frm
2011-10-08 20:50 . 2011-10-08 20:50 544 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000150.frm
2011-10-08 20:50 . 2011-10-08 20:50 532 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000149.frm
2011-10-08 20:50 . 2011-10-08 20:50 524 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000148.frm
2011-10-08 20:50 . 2011-10-08 20:50 944 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000147.key
2011-10-08 20:50 . 2011-10-08 20:50 17455 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000146.htm
2011-10-08 20:49 . 2011-10-08 20:50 580 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000145.key
2011-10-08 20:49 . 2011-10-08 20:49 45144 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000144.htm
2011-10-08 20:49 . 2011-10-08 20:49 568 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000143.key
2011-10-08 20:49 . 2011-10-08 20:49 45526 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000142.htm
2011-10-08 20:49 . 2011-10-08 20:49 32929 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000141.htm
2011-10-08 20:49 . 2011-10-08 20:49 399 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000140.pst
2011-10-08 20:49 . 2011-10-08 20:49 410 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000139.key
2011-10-08 20:49 . 2011-10-08 20:49 32348 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000138.htm
2011-10-08 20:49 . 2011-10-08 20:49 503 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000137.pst
2011-10-08 20:49 . 2011-10-08 20:49 568 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000136.frm
2011-10-08 20:49 . 2011-10-08 20:49 524 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000135.key
2011-10-08 20:48 . 2011-10-08 20:48 32699 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000134.htm
2011-10-08 20:48 . 2011-10-08 20:48 484 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000133.pst
2011-10-08 20:48 . 2011-10-08 20:48 514 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000132.key
2011-10-08 20:48 . 2011-10-08 20:48 33505 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000131.htm
2011-10-08 20:48 . 2011-10-08 20:48 594 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000130.frm
2011-10-08 20:48 . 2011-10-08 20:48 594 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000129.key
2011-10-08 20:48 . 2011-10-08 20:48 33513 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000128.htm
2011-10-08 20:48 . 2011-10-08 20:48 578 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000127.pst
2011-10-08 20:48 . 2011-10-08 20:48 5862 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000126.htm
2011-10-08 20:48 . 2011-10-08 20:48 722 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000125.frm
2011-10-08 20:48 . 2011-10-08 20:48 736 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000124.key
2011-10-08 20:48 . 2011-10-08 20:48 33224 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000123.htm
2011-10-08 20:48 . 2011-10-08 20:48 806 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000122.frm
2011-10-08 20:48 . 2011-10-08 20:48 806 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000121.key
2011-10-08 20:48 . 2011-10-08 20:48 33415 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000120.htm
2011-10-08 20:48 . 2011-10-08 20:48 1004 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000119.key
2011-10-08 20:47 . 2011-10-08 20:47 60490 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000118.htm
2011-10-08 20:47 . 2011-10-08 20:47 1030 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000117.key
2011-10-08 20:47 . 2011-10-08 20:47 42291 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000116.htm
2011-10-08 20:47 . 2011-10-08 20:47 1088 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000115.key
2011-10-08 20:47 . 2011-10-08 20:47 59547 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000114.htm
2011-10-08 20:47 . 2011-10-08 20:47 1016 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000113.key
2011-10-08 20:46 . 2011-10-08 20:46 59479 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000112.htm
2011-10-08 20:46 . 2011-10-08 20:46 1064 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000111.key
2011-10-08 20:46 . 2011-10-08 20:46 60294 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000110.htm
2011-10-08 20:46 . 2011-10-08 20:46 1136 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000109.key
2011-10-08 20:46 . 2011-10-08 20:46 60222 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000108.htm
2011-10-08 20:46 . 2011-10-08 20:46 1104 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000107.key
2011-10-08 20:46 . 2011-10-08 20:46 61853 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000106.htm
2011-10-08 20:46 . 2011-10-08 20:46 1104 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000105.key
2011-10-08 20:46 . 2011-10-08 20:46 62454 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000104.htm
2011-10-08 20:46 . 2011-10-08 20:46 1104 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000103.key
2011-10-08 20:46 . 2011-10-08 20:46 62725 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000102.htm
2011-10-08 20:46 . 2011-10-08 20:46 1104 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000101.key
2011-10-08 20:46 . 2011-10-08 20:46 63215 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000100.htm
2011-10-08 20:46 . 2011-10-08 20:46 1104 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000099.key
2011-10-08 20:46 . 2011-10-08 20:46 63556 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000098.htm
2011-10-08 20:46 . 2011-10-08 20:46 1104 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000097.key
2011-10-08 20:46 . 2011-10-08 20:46 63482 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000096.htm
2011-10-08 20:46 . 2011-10-08 20:46 1104 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000095.key
2011-10-08 20:45 . 2011-10-08 20:45 63417 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000094.htm
2011-10-08 20:45 . 2011-10-08 20:45 1102 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000093.key
2011-10-08 20:45 . 2011-10-08 20:45 63523 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000092.htm
2011-10-08 20:45 . 2011-10-08 20:45 1102 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000091.key
2011-10-08 20:45 . 2011-10-08 20:45 63437 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000090.htm
2011-10-08 20:45 . 2011-10-08 20:45 1104 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000089.key
2011-10-08 20:45 . 2011-10-08 20:45 63560 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000088.htm
2011-10-08 20:45 . 2011-10-08 20:45 63515 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000087.htm
2011-10-08 20:45 . 2011-10-08 20:45 1118 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000086.key
2011-10-08 20:45 . 2011-10-08 20:45 63515 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000085.htm
2011-10-08 20:45 . 2011-10-08 20:45 1100 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000084.key
2011-10-08 20:45 . 2011-10-08 20:45 63163 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000083.htm
2011-10-08 20:45 . 2011-10-08 20:45 1054 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000082.key
2011-10-08 20:45 . 2011-10-08 20:45 62060 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000081.htm
2011-10-08 20:45 . 2011-10-08 20:45 998 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000080.key
2011-10-08 20:45 . 2011-10-08 20:45 59630 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000079.htm
2011-10-08 20:45 . 2011-10-08 20:45 998 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000078.key
2011-10-08 20:44 . 2011-10-08 20:44 60290 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000077.htm
2011-10-08 20:44 . 2011-10-08 20:44 1100 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000076.key
2011-10-08 20:44 . 2011-10-08 20:44 61042 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000075.htm
2011-10-08 20:44 . 2011-10-08 20:44 1160 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000074.key
2011-10-08 20:44 . 2011-10-08 20:44 58484 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000073.htm
2011-10-08 20:44 . 2011-10-08 20:44 1128 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000072.key
2011-10-08 20:44 . 2011-10-08 20:44 57987 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000071.htm
2011-10-08 20:44 . 2011-10-08 20:44 1128 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000070.key
2011-10-08 20:44 . 2011-10-08 20:44 57437 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000069.htm
2011-10-08 20:44 . 2011-10-08 20:44 1128 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000068.key
2011-10-08 20:44 . 2011-10-08 20:44 56949 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000067.htm
2011-10-08 20:44 . 2011-10-08 20:44 1020 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000066.key
2011-10-08 20:44 . 2011-10-08 20:44 55589 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000065.htm
2011-10-08 20:44 . 2011-10-08 20:44 912 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000064.key
2011-10-08 20:44 . 2011-10-08 20:44 54409 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000063.htm
2011-10-08 20:44 . 2011-10-08 20:44 912 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000062.key
2011-10-08 20:44 . 2011-10-08 20:44 53017 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000061.htm
2011-10-08 20:44 . 2011-10-08 20:44 912 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000060.key
2011-10-08 20:43 . 2011-10-08 20:43 52888 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000059.htm
2011-10-08 20:43 . 2011-10-08 20:43 922 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000058.key
2011-10-08 20:43 . 2011-10-08 20:43 59435 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000057.htm
2011-10-08 20:43 . 2011-10-08 20:43 650 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000056.key
2011-10-08 20:43 . 2011-10-08 20:43 40366 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000055.htm
2011-10-08 20:43 . 2011-10-08 20:43 576 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000054.key
2011-10-08 20:43 . 2011-10-08 20:43 34695 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000053.htm
2011-10-08 20:43 . 2011-10-08 20:43 572 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000052.pst
2011-10-08 20:43 . 2011-10-08 20:43 892 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000051.frm
2011-10-08 20:43 . 2011-10-08 20:43 922 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000050.key
2011-10-08 20:42 . 2011-10-08 20:42 34718 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000049.htm
2011-10-08 20:42 . 2011-10-08 20:42 954 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000048.key
2011-10-08 20:42 . 2011-10-08 20:42 45473 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000047.htm
2011-10-08 20:42 . 2011-10-08 20:42 674 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000046.frm
2011-10-08 20:42 . 2011-10-08 20:42 688 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000045.key
2011-10-08 20:42 . 2011-10-08 20:42 59141 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000044.htm
2011-10-08 20:42 . 2011-10-08 20:42 406 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000043.key
2011-10-08 20:42 . 2011-10-08 20:42 35139 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000042.htm
2011-10-08 20:42 . 2011-10-08 20:42 1086 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000041.htm
2011-10-08 20:42 . 2011-10-08 20:42 392 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000040.pst
2011-10-08 20:42 . 2011-10-08 20:49 558 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000039.key
2011-10-08 20:42 . 2011-10-08 20:42 28701 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000038.htm
2011-10-08 20:42 . 2011-10-08 20:42 542 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000037.key
2011-10-08 20:42 . 2011-10-08 20:42 44786 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000036.htm
2011-10-08 20:41 . 2011-10-08 20:41 542 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000035.key
2011-10-08 20:41 . 2011-10-08 20:41 28770 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000034.htm
2011-10-08 20:41 . 2011-10-08 20:41 538 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000033.key
2011-10-08 20:41 . 2011-10-08 20:41 44641 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000032.htm
2011-10-08 20:41 . 2011-10-08 20:41 7464 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000031.htm
2011-10-08 20:41 . 2011-10-08 20:41 964 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000030.htm
2011-10-08 20:41 . 2011-10-08 20:41 554 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000029.key
2011-10-08 20:41 . 2011-10-08 20:41 43553 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000028.htm
2011-10-08 20:41 . 2011-10-08 20:41 378 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000027.key
2011-10-08 20:41 . 2011-10-08 20:41 44616 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000026.htm
2011-10-08 20:41 . 2011-10-08 20:41 345 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000025.pst
2011-10-08 20:41 . 2011-10-08 20:41 314 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000024.frm
2011-10-08 20:41 . 2011-10-08 20:41 14144 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000023.htm
2011-10-08 20:41 . 2011-10-08 20:41 310 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000022.key
2011-10-08 20:41 . 2011-10-08 20:41 274 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000021.pst
2011-10-08 20:06 . 2011-10-08 20:06 286 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000020.key
2011-10-08 20:06 . 2011-10-08 20:06 22397 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000019.htm
2011-10-08 20:06 . 2011-10-08 20:06 598 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000018.key
2011-10-08 20:06 . 2011-10-08 20:06 22553 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000017.htm
2011-10-08 20:06 . 2011-10-08 20:06 1010 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000016.htm
2011-10-08 20:05 . 2011-10-08 20:05 46921 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000015_ifrm.htm
2011-10-08 20:05 . 2011-10-08 20:05 18350 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000014_ifrm.htm
2011-10-08 20:05 . 2011-10-08 20:05 18350 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000013_ifrm.htm
2011-10-08 20:05 . 2011-10-08 20:05 18351 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000012_ifrm.htm
2011-10-08 20:05 . 2011-10-08 20:05 18351 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000011_ifrm.htm
2011-10-08 20:05 . 2011-10-08 20:06 1092 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000010.key
2011-10-08 20:04 . 2011-10-08 20:04 22623 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000009.htm
2011-10-08 20:03 . 2011-10-08 20:03 428 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000008.pst
2011-10-08 20:00 . 2011-10-08 20:00 2190 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000007.pst
2011-10-08 20:00 . 2011-10-08 20:00 428 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000006.pst
2011-10-08 20:00 . 2011-10-08 20:00 74 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\firefox.exe_UAs5.dat
2011-10-08 19:50 . 2011-10-09 02:14 2596 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000004.key
2011-10-08 16:35 . 2011-10-08 16:35 24003 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000003_ifrm.htm
2011-10-08 16:30 . 2011-10-08 16:30 24003 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000002_ifrm.htm
2011-10-08 02:26 . 2010-10-08 07:29 0 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\FromJava01CC8561A7A0E8BE_00011384_rasphone.pbk
2011-10-08 02:25 . 2010-10-08 07:29 0 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\FromJava01CC856193B632C6_00011064_rasphone.pbk
2011-10-08 02:21 . 2010-10-08 07:29 0 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\FromJava01CC85610A25CC4F_00008096_rasphone.pbk
2011-10-08 02:16 . 2010-10-08 07:29 0 —-a-w- c:\users\Alex\AppData\Roaming\xmldm\FromJava01CC85604A74B593_00005916_rasphone.pbk
2011-09-14 20:39 . 2011-09-14 20:39 13369344 —-a-r- c:\users\Alex\AppData\Roaming\xmldm\FromJava01CC8561905E219D_00011064_classes.jsa
.
—- Directory of c:\windows\Sun —-
.
.
.
((((((((((((((((((((((((((((( SnapShot_2011-10-08_16.03.58 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 05:10 . 2011-10-08 13:32 45760 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-10-08 16:05 45760 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 04:46 . 2011-10-08 22:57 12368 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
- 2010-10-08 07:33 . 2011-10-08 16:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-10-08 07:33 . 2011-10-09 02:13 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-10-08 07:33 . 2011-10-08 16:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-10-08 07:33 . 2011-10-09 02:13 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-10-08 07:28 . 2011-10-08 16:05 9284 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-691481713-2458775474-3661280945-1001_UserData.bin
+ 2010-10-09 03:02 . 2011-10-08 19:45 336306 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2010-10-09 03:02 . 2011-10-07 23:48 336306 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2009-07-14 02:34 . 2011-10-07 21:41 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-07-14 02:34 . 2011-10-08 23:14 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2010-09-02 13351304]
"EasyTether"="c:\program files (x86)\Mobile Stream\EasyTether\easytthr.exe" [2010-12-19 48456]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"KeNotify"="c:\program files (x86)\TOSHIBA\Utilities\KeNotify.exe" [2009-12-25 34160]
"HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2010-03-04 423936]
"SVPWUTIL"="c:\program files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe" [2010-02-23 352256]
"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2009-10-06 1294136]
"TWebCamera"="c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2010-02-24 2454840]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2011-05-25 273544]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
c:\users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
winupd.lnk - c:\users\Alex\AppData\Local\Temp\winupd.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 135664]
R3 acpials;ALS Sensor Filter;c:\windows\system32\DRIVERS\acpials.sys [x]
R3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 135664]
R3 HtcUsbMdmV64;HTC Proprietary USB Driver;c:\windows\system32\DRIVERS\HtcUsbMdmV64.sys [x]
R3 HtcVCom32;HTC Diagnostic Port;c:\windows\system32\DRIVERS\HtcVComV64.sys [x]
R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-01-20 315664]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-10-06 51512]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys [x]
S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS [x]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2010-06-29 128752]
S2 DMAgent;Intel® PROSet/Wireless WiMAX Red Bend Device Management Service;c:\program files\Intel\WiMAX\Bin\DMAgent.exe [2009-12-29 404992]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2010-05-05 1604200]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2010-04-06 258928]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [x]
S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-03-03 2320920]
S2 WiMAXAppSrv;Intel® PROSet/Wireless WiMAX Service;c:\program files\Intel\WiMAX\Bin\AppSrv.exe [2009-12-29 911360]
S3 bpenum;bpenum;c:\windows\system32\DRIVERS\bpenum.sys [x]
S3 bpmp;bpmp;c:\windows\system32\DRIVERS\bpmp.sys [x]
S3 bpusb;bpusb;c:\windows\system32\Drivers\bpusb.sys [x]
S3 easytether;easytether;c:\windows\system32\DRIVERS\easytthr.sys [x]
S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-02-06 137560]
S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2010-02-24 835952]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 19:43]
.
2011-10-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 19:43]
.
2011-10-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-691481713-2458775474-3661280945-1001Core.job
- c:\users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-25 02:49]
.
2011-10-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-691481713-2458775474-3661280945-1001UA.job
- c:\users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-25 02:49]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-26 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-26 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-26 413208]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-05-05 17412200]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-03-22 10134560]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-03-22 896032]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"TPwrMain"="c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE" [BU]
"HSON"="c:\program files (x86)\TOSHIBA\TBS\HSON.exe" [BU]
"SmoothView"="c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe" [BU]
"00TCrdMain"="c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe" [BU]
"Teco"="c:\program files (x86)\TOSHIBA\TECO\Teco.exe" [BU]
"TosWaitSrv"="c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe" [BU]
"SmartFaceVWatcher"="c:\program files (x86)\Toshiba\SmartFaceV\SmartFaceVWatcher.exe" [BU]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-01-20 1926928]
"IntelWirelessWiMAX"="c:\program files\Intel\WiMAX\Bin\WiMAXCU.exe" [2010-01-27 1445888]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-02-06 709976]
"TosNC"="c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe" [BU]
"TosReelTimeMonitor"="c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe" [BU]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdcBase.exe" [2007-05-31 660360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.bungie.net/
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\j3kpu51f.default\
FF - prefs.js: browser.startup.homepage - news.google.com
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?btnI=I%27m+Feeling+Lucky&q=
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-691481713-2458775474-3661280945-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-691481713-2458775474-3661280945-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DbgagD\1*]
"value"="?\07\00\1f\0f\13'?"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-10-08 22:43:30
ComboFix-quarantined-files.txt 2011-10-09 02:43
ComboFix2.txt 2011-10-09 02:32
ComboFix3.txt 2011-10-08 16:08
ComboFix4.txt 2011-09-28 13:58
.
Pre-Run: 196,122,193,920 bytes free
Post-Run: 196,045,484,032 bytes free
.
- - End Of File - - 6081C608413A46A86CA2C227E8AB77AA
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Database version: 7882
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
10/8/2011 10:48:38 PM
mbam-log-2011-10-08 (22-48-38).txt
Scan type: Quick scan
Objects scanned: 195206
Time elapsed: 1 minute(s), 22 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C689C99E-3A8C-4c87-A79C-C80DC9C81632} (Trojan.Banker) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
Hi blackrx
Unfortunately your computer appears to have been infected by a
backdoor trojan . These programs have the ability to steal passwords and other information from your system.
There are also files that are keystroke records for sites that you.ve logged into since the infection.
If you use your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:
use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use. call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account. consider what other private information could possibly have been taken from your computer and take appropriate steps
This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.
If you wish to reformat then please let me know in your next response, I'll now continue with instructions for cleaning.
===================================================
Open ComboFix Please do the following :
close any open browsers. close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix. open notepad and copy/paste the text in the codebox below into it: Folder::
c:\users\Alex\AppData\Roaming\5030
c:\users\Alex\AppData\Roaming\5031
c:\users\Alex\AppData\Roaming\ADDD2oonF4pm5sJ
c:\users\Alex\AppData\Roaming\cNtxA0ucSiDpGaH
c:\users\Alex\AppData\Roaming\CRRZZqhhYXkUVl
c:\users\Alex\AppData\Roaming\h222onnF4pmHsQ7
c:\users\Alex\AppData\Roaming\JsWK7fEL9TqY
c:\users\Alex\AppData\Roaming\kock
c:\users\Alex\AppData\Roaming\TEEKK8ggRZ9YXjU
c:\users\Alex\AppData\Roaming\UAs
c:\users\Alex\AppData\Roaming\vhhhYXXwjUVeIBz
c:\users\Alex\AppData\Roaming\XBttzzP0ycA1vDo
c:\users\Alex\AppData\Roaming\xmldm
c:\windows\Sun
DirLook::
c:\users\Alex\AppData\Roaming\TCCeelIBrzPNyAu
c:\users\Alex\AppData\Roaming\jdddEKK8fRZhTXj
c:\users\Alex\AppData\Roaming\lnFF44amH5sW7dL
c:\users\Alex\AppData\Roaming\xZZZqhhYCwkVrOB
c:\users\Alex\AppData\Local\Adobe
RegLockDel::
[HKEY_LOCAL_MACHINE\software\Microsoft\DbgagD\1*]
Save this as
"CFScript.txt" , and as Type: All Files (*.*) in the same location as ComboFix.exe
[external image: Posted Image]
Referring to the picture above, drag CFScript into ComboFix.exe
When finished, it post the contents of Combofix.txt in your next reply.
===================================================
Scan With RootKitUnHooker Please Download Rootkit Unhooker Now double-click on RKUnhookerLE.exe to run it. Click the Report tab, then click Scan . Check (Tick) Drivers and Stealth Uncheck the rest. then click OK When prompted to Select Disks for Scan, make sure C:\ Wait till the scanner has finished and then click File > Save Report. Save the report somewhere where you can find it. Click Close. Copy the entire contents of the report and paste it in your next reply. Note** you may get this warning:
"Rootkit Unhooker has detected a parasite inside itself!
Just click
OK and continue.
Please post both logs and let me know if you want to continue or reformat
Thanks
Satchfan
I recently backed up my files about 3 weeks ago, so I am okay with reformatting. I don't remember receiving a Windows 7 disc when I purchased this computer from Best Buy, but I will look around. Did you see in my last post that I ran combofix twice because the first time I did not save the log? Would that have negatively affected anything?
Also, I ran RootKitUnhooker, but it gave me an error notification and closed. I re-downloaded it, but it still didn't work. The log of the error is posted below with Combofix's log following:
Exception code : 0xC0000005
Instruction address : 0x00402EAA
Attempt to read at address : 0xFFFFFFFF
ComboFix 11-10-08.05 - Alex 10/09/2011 8:53.5.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3891.2111 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Alex\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Alex\AppData\Roaming\5030
c:\users\Alex\AppData\Roaming\5030\chrome.manifest
c:\users\Alex\AppData\Roaming\5030\components\AcroFF.txt
c:\users\Alex\AppData\Roaming\5030\components\AcroFF5.dll
c:\users\Alex\AppData\Roaming\5030\components\AcroFF6.dll
c:\users\Alex\AppData\Roaming\5030\components\AcroFF7.dll
c:\users\Alex\AppData\Roaming\5030\install.rdf
c:\users\Alex\AppData\Roaming\5031
c:\users\Alex\AppData\Roaming\5031\chrome.manifest
c:\users\Alex\AppData\Roaming\5031\components\AcroFF.txt
c:\users\Alex\AppData\Roaming\5031\components\AcroFF031.dll
c:\users\Alex\AppData\Roaming\5031\components\AcroFF0315.dll
c:\users\Alex\AppData\Roaming\5031\components\AcroFF0316.dll
c:\users\Alex\AppData\Roaming\5031\components\AcroFF0317.dll
c:\users\Alex\AppData\Roaming\5031\install.rdf
c:\users\Alex\AppData\Roaming\ADDD2oonF4pm5sJ
c:\users\Alex\AppData\Roaming\cNtxA0ucSiDpGaH
c:\users\Alex\AppData\Roaming\CRRZZqhhYXkUVl
c:\users\Alex\AppData\Roaming\h222onnF4pmHsQ7
c:\users\Alex\AppData\Roaming\JsWK7fEL9TqY
c:\users\Alex\AppData\Roaming\kock
c:\users\Alex\AppData\Roaming\TEEKK8ggRZ9YXjU
c:\users\Alex\AppData\Roaming\UAs
c:\users\Alex\AppData\Roaming\UAs\_UAs001.dat
c:\users\Alex\AppData\Roaming\UAs\_UAs002.dat
c:\users\Alex\AppData\Roaming\vhhhYXXwjUVeIBz
c:\users\Alex\AppData\Roaming\XBttzzP0ycA1vDo
c:\users\Alex\AppData\Roaming\xmldm
c:\users\Alex\AppData\Roaming\xmldm\1900_FF_0000000341_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\1900_FF_0000000342_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\1900_FF_0000000343_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\1900_FF_0000000344_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\1900_FF_0000000345_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\1900_FF_0000000346_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\1900_FF_0000000347_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\1900_FF_0000000348_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\1900_FF_0000000349_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\1900_FF_0000000350_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\1900_FF_0000000351_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\1900_FF_0000000352_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\1900_FF_0000000353_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\1900_FF_0000000354_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\1900_FF_0000000355_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\1900_FF_0000000356_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\1900_FF_0000000357_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\1900_FF_0000000358_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000002_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000003_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000004.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000006.pst
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000007.pst
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000008.pst
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000009.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000010.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000011_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000012_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000013_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000014_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000015_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000016.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000017.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000018.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000019.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000020.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000021.pst
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000022.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000023.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000024.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000025.pst
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000026.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000027.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000028.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000029.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000030.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000031.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000032.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000033.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000034.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000035.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000036.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000037.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000038.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000039.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000040.pst
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000041.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000042.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000043.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000044.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000045.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000046.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000047.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000048.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000049.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000050.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000051.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000052.pst
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000053.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000054.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000055.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000056.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000057.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000058.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000059.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000060.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000061.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000062.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000063.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000064.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000065.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000066.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000067.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000068.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000069.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000070.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000071.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000072.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000073.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000074.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000075.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000076.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000077.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000078.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000079.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000080.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000081.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000082.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000083.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000084.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000085.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000086.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000087.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000088.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000089.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000090.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000091.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000092.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000093.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000094.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000095.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000096.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000097.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000098.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000099.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000100.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000101.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000102.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000103.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000104.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000105.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000106.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000107.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000108.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000109.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000110.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000111.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000112.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000113.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000114.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000115.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000116.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000117.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000118.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000119.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000120.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000121.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000122.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000123.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000124.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000125.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000126.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000127.pst
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000128.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000129.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000130.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000131.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000132.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000133.pst
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000134.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000135.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000136.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000137.pst
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000138.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000139.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000140.pst
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000141.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000142.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000143.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000144.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000145.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000146.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000147.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000148.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000149.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000150.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000151.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000152.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000153.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000154.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000155.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000156.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000157.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000158.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000159.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000160.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000161.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000162.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000163.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000164_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000165.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000166.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000167.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000168.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000169.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000170.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000171.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000172.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000173_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000174.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000175.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000176_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000177.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000178.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000179_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000180_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000181_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000182_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000183.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000184.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000185_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000186.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000187.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000188_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000189.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000190.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000191_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000192.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000193_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000194.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000195.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000196.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000197_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000198_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000199.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000200.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000201_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000202_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000203_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000204.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000205_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000206_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000207.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000208.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000209_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000210.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000211.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000212.pst
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000213.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000214_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000215.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000216.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000217.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000218.pst
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000219.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000220.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000221_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000222.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000223_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000224_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000225_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000226_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000227_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000228_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000229_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000230_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000231.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000232.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000233_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000234_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000235_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000236_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000237_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000238_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000239_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000240.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000241_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000242_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000243_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000244_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000245.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000246.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000247.pst
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000248.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000249_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000250_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000251_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000252_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000253_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000254_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000255_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000256_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000257_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000258_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000259_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000260_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000261_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000262_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000263_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000264_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000265.key
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000266.frm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000267_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000268_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000269_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000270_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000271_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000272_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000273_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000274_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000275_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000276_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000277_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000278_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000279_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000280_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000281_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000282_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000283_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000284_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000285_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000286_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000287_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000288_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000289_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000290_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000291_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000292_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000293_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000294_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000295_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000296_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000297_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000298_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000299_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000300_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000301_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000302_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000303_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000304.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000305_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000306_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000307_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000308_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000309_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000310_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000311_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000312_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000313_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000314_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000315_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000316_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000317_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000318_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000319_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000320_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000321_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\2876_FF_0000000322_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000323_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000324_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000325_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000326_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000327_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000328_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000329_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000330_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000331_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000332_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000333_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000334_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000335_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000336_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000337_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000338_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000339_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\6856_FF_0000000340_ifrm.htm
c:\users\Alex\AppData\Roaming\xmldm\firefox.exe_UAs5.dat
c:\users\Alex\AppData\Roaming\xmldm\FromJava01CC85604A74B593_00005916_rasphone.pbk
c:\users\Alex\AppData\Roaming\xmldm\FromJava01CC85610A25CC4F_00008096_rasphone.pbk
c:\users\Alex\AppData\Roaming\xmldm\FromJava01CC8561905E219D_00011064_classes.jsa
c:\users\Alex\AppData\Roaming\xmldm\FromJava01CC856193B632C6_00011064_rasphone.pbk
c:\users\Alex\AppData\Roaming\xmldm\FromJava01CC8561A7A0E8BE_00011384_rasphone.pbk
c:\windows\Sun
.
.
((((((((((((((((((((((((( Files Created from 2011-09-09 to 2011-10-09 )))))))))))))))))))))))))))))))
.
.
2011-10-09 12:57 . 2011-10-09 12:57 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp
2011-10-09 12:57 . 2011-10-09 12:57 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-10-08 16:07 . 2011-10-08 16:07 69000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6B29CF59-E967-4D05-8206-E063994AE40D}\offreg.dll
2011-10-08 15:52 . 2011-10-08 15:52 ——– d—–w- c:\users\Alex\AppData\Local\PackageAware
2011-10-07 21:30 . 2011-09-13 00:26 9049936 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6B29CF59-E967-4D05-8206-E063994AE40D}\mpengine.dll
2011-10-07 03:26 . 2011-10-08 20:15 ——– d—–w- c:\users\Alex\AppData\Local\Adobe
2011-10-05 23:05 . 2011-10-05 23:05 ——– d—–w- c:\users\Alex\AppData\Roaming\TCCeelIBrzPNyAu
2011-10-05 23:05 . 2011-10-05 23:05 ——– d—–w- c:\users\Alex\AppData\Roaming\jdddEKK8fRZhTXj
2011-10-05 23:05 . 2011-10-05 23:19 ——– d—–w- c:\users\Alex\AppData\Roaming\lnFF44amH5sW7dL
2011-10-05 23:05 . 2011-10-05 23:05 ——– d—–w- c:\users\Alex\AppData\Roaming\xZZZqhhYCwkVrOB
2011-09-14 20:39 . 2011-09-14 20:39 ——– d—–w- c:\program files (x86)\Common Files\Java
2011-09-14 20:38 . 2011-09-14 20:38 404640 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-31 21:00 . 2010-10-08 20:59 25416 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-07-22 05:35 . 2011-08-09 22:33 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-07-22 04:56 . 2011-08-09 22:33 1638912 —-a-w- c:\windows\SysWow64\mshtml.tlb
2011-07-16 05:26 . 2011-08-09 22:34 362496 —-a-w- c:\windows\system32\wow64win.dll
2011-07-16 05:26 . 2011-08-09 22:34 243200 —-a-w- c:\windows\system32\wow64.dll
2011-07-16 05:26 . 2011-08-09 22:34 13312 —-a-w- c:\windows\system32\wow64cpu.dll
2011-07-16 05:26 . 2011-08-09 22:34 214528 —-a-w- c:\windows\system32\winsrv.dll
2011-07-16 05:24 . 2011-08-09 22:34 16384 —-a-w- c:\windows\system32\ntvdm64.dll
2011-07-16 05:21 . 2011-08-09 22:34 422400 —-a-w- c:\windows\system32\KernelBase.dll
2011-07-16 05:17 . 2011-08-09 22:34 338432 —-a-w- c:\windows\system32\conhost.exe
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4608 —ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4608 —ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 6144 —ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 5120 —ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-07-16 04:36 . 2011-08-09 22:34 14336 —-a-w- c:\windows\SysWow64\ntvdm64.dll
2011-07-16 04:32 . 2011-08-09 22:34 44032 —-a-w- c:\windows\apppatch\acwow64.dll
2011-07-16 04:31 . 2011-08-09 22:34 25600 —-a-w- c:\windows\SysWow64\setup16.exe
2011-07-16 04:30 . 2011-08-09 22:34 5120 —-a-w- c:\windows\SysWow64\wow32.dll
2011-07-16 04:30 . 2011-08-09 22:34 272384 —-a-w- c:\windows\SysWow64\KernelBase.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4608 —ha-w- c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 5120 —ha-w- c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
2011-07-16 02:26 . 2011-08-09 22:34 7680 —-a-w- c:\windows\SysWow64\instnm.exe
2011-07-16 02:26 . 2011-08-09 22:33 2048 —-a-w- c:\windows\SysWow64\user.exe
2011-07-16 02:21 . 2011-08-09 22:34 6144 —ha-w- c:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2011-07-16 02:21 . 2011-08-09 22:34 4608 —ha-w- c:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-16 02:21 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2011-07-16 02:21 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
2006-05-02 23:00 163328 –sh–r- c:\windows\SysWOW64\flvDX.dll
2007-02-20 23:00 31232 –sh–r- c:\windows\SysWOW64\msfDX.dll
2008-03-15 23:00 216064 –sh–r- c:\windows\SysWOW64\nbDX.dll
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—- Directory of c:\users\Alex\AppData\Local\Adobe —-
.
2011-10-08 20:15 . 2011-10-08 20:15 8105 —-a-w- c:\users\Alex\AppData\Local\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst
.
—- Directory of c:\users\Alex\AppData\Roaming\jdddEKK8fRZhTXj —-
.
.
—- Directory of c:\users\Alex\AppData\Roaming\lnFF44amH5sW7dL —-
.
.
—- Directory of c:\users\Alex\AppData\Roaming\TCCeelIBrzPNyAu —-
.
.
—- Directory of c:\users\Alex\AppData\Roaming\xZZZqhhYCwkVrOB —-
.
.
.
((((((((((((((((((((((((((((( SnapShot_2011-10-08_16.03.58 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 05:10 . 2011-10-08 13:32 45760 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-10-08 16:05 45760 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 04:46 . 2011-10-08 22:57 12368 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
- 2010-10-08 07:33 . 2011-10-08 16:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-10-08 07:33 . 2011-10-09 12:45 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-10-08 07:33 . 2011-10-08 16:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-10-08 07:33 . 2011-10-09 12:45 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-10-08 07:28 . 2011-10-08 16:05 9284 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-691481713-2458775474-3661280945-1001_UserData.bin
+ 2010-10-09 03:02 . 2011-10-09 12:43 336314 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2009-07-14 02:34 . 2011-10-07 21:41 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-07-14 02:34 . 2011-10-08 23:14 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2010-09-02 13351304]
"EasyTether"="c:\program files (x86)\Mobile Stream\EasyTether\easytthr.exe" [2010-12-19 48456]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"KeNotify"="c:\program files (x86)\TOSHIBA\Utilities\KeNotify.exe" [2009-12-25 34160]
"HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2010-03-04 423936]
"SVPWUTIL"="c:\program files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe" [2010-02-23 352256]
"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2009-10-06 1294136]
"TWebCamera"="c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2010-02-24 2454840]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2011-05-25 273544]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
c:\users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
winupd.lnk - c:\users\Alex\AppData\Local\Temp\winupd.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 135664]
R3 acpials;ALS Sensor Filter;c:\windows\system32\DRIVERS\acpials.sys [x]
R3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 135664]
R3 HtcUsbMdmV64;HTC Proprietary USB Driver;c:\windows\system32\DRIVERS\HtcUsbMdmV64.sys [x]
R3 HtcVCom32;HTC Diagnostic Port;c:\windows\system32\DRIVERS\HtcVComV64.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-01-20 315664]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-10-06 51512]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys [x]
S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS [x]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2010-06-29 128752]
S2 DMAgent;Intel® PROSet/Wireless WiMAX Red Bend Device Management Service;c:\program files\Intel\WiMAX\Bin\DMAgent.exe [2009-12-29 404992]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2010-05-05 1604200]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2010-04-06 258928]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [x]
S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-03-03 2320920]
S2 WiMAXAppSrv;Intel® PROSet/Wireless WiMAX Service;c:\program files\Intel\WiMAX\Bin\AppSrv.exe [2009-12-29 911360]
S3 bpenum;bpenum;c:\windows\system32\DRIVERS\bpenum.sys [x]
S3 bpmp;bpmp;c:\windows\system32\DRIVERS\bpmp.sys [x]
S3 bpusb;bpusb;c:\windows\system32\Drivers\bpusb.sys [x]
S3 easytether;easytether;c:\windows\system32\DRIVERS\easytthr.sys [x]
S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]
S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-02-06 137560]
S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2010-02-24 835952]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 19:43]
.
2011-10-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 19:43]
.
2011-10-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-691481713-2458775474-3661280945-1001Core.job
- c:\users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-25 02:49]
.
2011-10-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-691481713-2458775474-3661280945-1001UA.job
- c:\users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-25 02:49]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-26 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-26 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-26 413208]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-05-05 17412200]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-03-22 10134560]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-03-22 896032]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"TPwrMain"="c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE" [BU]
"HSON"="c:\program files (x86)\TOSHIBA\TBS\HSON.exe" [BU]
"SmoothView"="c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe" [BU]
"00TCrdMain"="c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe" [BU]
"Teco"="c:\program files (x86)\TOSHIBA\TECO\Teco.exe" [BU]
"TosWaitSrv"="c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe" [BU]
"SmartFaceVWatcher"="c:\program files (x86)\Toshiba\SmartFaceV\SmartFaceVWatcher.exe" [BU]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-01-20 1926928]
"IntelWirelessWiMAX"="c:\program files\Intel\WiMAX\Bin\WiMAXCU.exe" [2010-01-27 1445888]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-02-06 709976]
"TosNC"="c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe" [BU]
"TosReelTimeMonitor"="c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe" [BU]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdcBase.exe" [2007-05-31 660360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.bungie.net/
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\j3kpu51f.default\
FF - prefs.js: browser.startup.homepage - news.google.com
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?btnI=I%27m+Feeling+Lucky&q=
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-691481713-2458775474-3661280945-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-691481713-2458775474-3661280945-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DbgagD\1*]
"value"="?\07\00\1f\0f\13'?"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-10-09 08:59:20
ComboFix-quarantined-files.txt 2011-10-09 12:59
ComboFix2.txt 2011-10-09 02:43
ComboFix3.txt 2011-10-09 02:32
ComboFix4.txt 2011-10-08 16:08
ComboFix5.txt 2011-10-09 12:52
.
Pre-Run: 196,229,550,080 bytes free
Post-Run: 195,921,510,400 bytes free
.
- - End Of File - - 1F27ECD6A98A78A04BCB30E43AEBFEE2
Did you see in my last post that I ran combofix twice because the first time I did not save the log? Would that have negatively affected anything?
Sorry for not replying to that but no, it should have made no difference.
================================
There is a stubborn file that won’t go away.
Please click
Start, run , type
notepad in the runbox and press enter.
Copy/paste the text in the codebox below in Notepad and save it as
export.bat to your desktop
@echo off
regedit /e "export.txt" "HKEY_LOCAL_MACHINE\software\Microsoft\DbgagD"
start export.txt
del %0
Exit Notepad and doubleclick on
export.bat to run it.
A textfile (export.txt) will open. Please post its contents in your next reply.
================================
Also, try running RootkitUnhooker in safe mode.
Satchfan
When I run export.bat, it says it can't find the export.txt file and closes. I tried running RootkitUnhooker in safemode, but I still received the same error message.
Open ComboFix Please do the following :
close any open browsers. close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix. open notepad and copy/paste the text in the codebox below into it: c:\users\Alex\AppData\Local\Adobe
c:\users\Alex\AppData\Roaming\jdddEKK8fRZhTXj
c:\users\Alex\AppData\Roaming\lnFF44amH5sW7dL
c:\users\Alex\AppData\Roaming\TCCeelIBrzPNyAu
c:\users\Alex\AppData\Roaming\xZZZqhhYCwkVrOB
RegNull::
[HKEY_LOCAL_MACHINE\software\Microsoft\DbgagD\1*]
Save this as
"CFScript.txt" , and as Type: All Files (*.*) in the same location as ComboFix.exe
[external image: Posted Image]
Referring to the picture above, drag CFScript into ComboFix.exe
When finished, it produces a log at
C:\ComboFix.txt . Post the contents of Combofix.txt in your next reply.
=================================================
Download and run MBRCheck
Please download
MBRCheck.exe to your desktop. Be sure to disable your security programs Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt) A window will open on your desktop if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter If nothing unusual is found just press Enter A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop. Please post the contents of that file.
Can you tell me how things are running now and what problems remain
Satchfan
I haven't had any search redirects or random tabs opening today. Export.bat and RootkitUnhooker still give the same error messages. Everything else seems to be fine. Just not sure about the possible backdoor trojan.
ComboFix 11-10-08.05 - Alex 10/10/2011 17:53:05.6.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3891.2220 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Alex\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2011-09-10 to 2011-10-10 )))))))))))))))))))))))))))))))
.
.
2011-10-10 21:57 . 2011-10-10 21:57 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp
2011-10-10 21:57 . 2011-10-10 21:57 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-10-09 14:17 . 2011-10-09 14:17 69000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6B29CF59-E967-4D05-8206-E063994AE40D}\offreg.dll
2011-10-09 13:11 . 2011-10-09 14:16 35712 —-a-w- c:\windows\SysWow64\drivers\BlackBox.sys
2011-10-08 15:52 . 2011-10-08 15:52 ——– d—–w- c:\users\Alex\AppData\Local\PackageAware
2011-10-07 21:30 . 2011-09-13 00:26 9049936 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6B29CF59-E967-4D05-8206-E063994AE40D}\mpengine.dll
2011-10-07 03:26 . 2011-10-08 20:15 ——– d—–w- c:\users\Alex\AppData\Local\Adobe
2011-10-05 23:05 . 2011-10-05 23:05 ——– d—–w- c:\users\Alex\AppData\Roaming\TCCeelIBrzPNyAu
2011-10-05 23:05 . 2011-10-05 23:05 ——– d—–w- c:\users\Alex\AppData\Roaming\jdddEKK8fRZhTXj
2011-10-05 23:05 . 2011-10-05 23:19 ——– d—–w- c:\users\Alex\AppData\Roaming\lnFF44amH5sW7dL
2011-10-05 23:05 . 2011-10-05 23:05 ——– d—–w- c:\users\Alex\AppData\Roaming\xZZZqhhYCwkVrOB
2011-09-14 20:39 . 2011-09-14 20:39 ——– d—–w- c:\program files (x86)\Common Files\Java
2011-09-14 20:38 . 2011-09-14 20:38 404640 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-31 21:00 . 2010-10-08 20:59 25416 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-07-22 05:35 . 2011-08-09 22:33 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-07-22 04:56 . 2011-08-09 22:33 1638912 —-a-w- c:\windows\SysWow64\mshtml.tlb
2011-07-16 05:26 . 2011-08-09 22:34 362496 —-a-w- c:\windows\system32\wow64win.dll
2011-07-16 05:26 . 2011-08-09 22:34 243200 —-a-w- c:\windows\system32\wow64.dll
2011-07-16 05:26 . 2011-08-09 22:34 13312 —-a-w- c:\windows\system32\wow64cpu.dll
2011-07-16 05:26 . 2011-08-09 22:34 214528 —-a-w- c:\windows\system32\winsrv.dll
2011-07-16 05:24 . 2011-08-09 22:34 16384 —-a-w- c:\windows\system32\ntvdm64.dll
2011-07-16 05:21 . 2011-08-09 22:34 422400 —-a-w- c:\windows\system32\KernelBase.dll
2011-07-16 05:17 . 2011-08-09 22:34 338432 —-a-w- c:\windows\system32\conhost.exe
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4608 —ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4608 —ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 6144 —ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 5120 —ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-07-16 05:04 . 2011-08-09 22:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-07-16 04:36 . 2011-08-09 22:34 14336 —-a-w- c:\windows\SysWow64\ntvdm64.dll
2011-07-16 04:32 . 2011-08-09 22:34 44032 —-a-w- c:\windows\apppatch\acwow64.dll
2011-07-16 04:31 . 2011-08-09 22:34 25600 —-a-w- c:\windows\SysWow64\setup16.exe
2011-07-16 04:30 . 2011-08-09 22:34 5120 —-a-w- c:\windows\SysWow64\wow32.dll
2011-07-16 04:30 . 2011-08-09 22:34 272384 —-a-w- c:\windows\SysWow64\KernelBase.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4608 —ha-w- c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 5120 —ha-w- c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
2011-07-16 04:19 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
2011-07-16 02:26 . 2011-08-09 22:34 7680 —-a-w- c:\windows\SysWow64\instnm.exe
2011-07-16 02:26 . 2011-08-09 22:33 2048 —-a-w- c:\windows\SysWow64\user.exe
2011-07-16 02:21 . 2011-08-09 22:34 6144 —ha-w- c:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2011-07-16 02:21 . 2011-08-09 22:34 4608 —ha-w- c:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-16 02:21 . 2011-08-09 22:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2011-07-16 02:21 . 2011-08-09 22:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
2006-05-02 23:00 163328 –sh–r- c:\windows\SysWOW64\flvDX.dll
2007-02-20 23:00 31232 –sh–r- c:\windows\SysWOW64\msfDX.dll
2008-03-15 23:00 216064 –sh–r- c:\windows\SysWOW64\nbDX.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2011-10-08_16.03.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-07-16 05:45 . 2011-10-09 14:16 42750 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
- 2010-07-16 05:45 . 2011-10-06 02:50 42750 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-10-09 14:16 45760 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2011-10-08 13:32 45760 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2010-07-16 05:42 . 2011-10-08 16:03 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-07-16 05:42 . 2011-10-09 14:15 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-07-16 05:42 . 2011-10-09 14:15 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-07-16 05:42 . 2011-10-08 16:03 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-10-09 14:15 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-10-08 16:03 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-10-08 20:00 . 2011-10-09 14:15 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-10-08 20:00 . 2011-10-08 16:04 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:46 . 2011-10-09 14:17 78720 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2010-10-08 20:00 . 2011-10-09 14:15 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-10-08 20:00 . 2011-10-08 16:04 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-10-08 20:00 . 2011-10-08 16:04 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-10-08 20:00 . 2011-10-09 14:15 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-10-08 07:33 . 2011-10-08 16:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-10-08 07:33 . 2011-10-10 21:41 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-10-08 07:33 . 2011-10-10 21:41 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-10-08 07:33 . 2011-10-08 16:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-10-08 07:28 . 2011-10-09 14:16 9292 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-691481713-2458775474-3661280945-1001_UserData.bin
- 2011-10-08 16:03 . 2011-10-08 16:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-10-09 14:15 . 2011-10-09 14:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-10-09 14:15 . 2011-10-09 14:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-10-08 16:03 . 2011-10-08 16:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-10-09 03:02 . 2011-10-10 21:38 336314 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2009-07-14 05:01 . 2011-10-09 14:08 446536 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2011-10-08 16:02 446536 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-02-09 22:38 . 2011-10-09 14:08 1564284 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-691481713-2458775474-3661280945-1001-8192.dat
- 2011-02-09 22:38 . 2011-10-08 16:02 1564284 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-691481713-2458775474-3661280945-1001-8192.dat
- 2009-07-14 02:34 . 2011-10-07 21:41 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-07-14 02:34 . 2011-10-09 14:28 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2010-09-02 13351304]
"EasyTether"="c:\program files (x86)\Mobile Stream\EasyTether\easytthr.exe" [2010-12-19 48456]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"KeNotify"="c:\program files (x86)\TOSHIBA\Utilities\KeNotify.exe" [2009-12-25 34160]
"HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2010-03-04 423936]
"SVPWUTIL"="c:\program files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe" [2010-02-23 352256]
"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2009-10-06 1294136]
"TWebCamera"="c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2010-02-24 2454840]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2011-05-25 273544]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
c:\users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
winupd.lnk - c:\users\Alex\AppData\Local\Temp\winupd.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 135664]
R3 acpials;ALS Sensor Filter;c:\windows\system32\DRIVERS\acpials.sys [x]
R3 BlackBox;BlackBox SR2; [x]
R3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 135664]
R3 HtcUsbMdmV64;HTC Proprietary USB Driver;c:\windows\system32\DRIVERS\HtcUsbMdmV64.sys [x]
R3 HtcVCom32;HTC Diagnostic Port;c:\windows\system32\DRIVERS\HtcVComV64.sys [x]
R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-01-20 315664]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys [x]
S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS [x]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2010-06-29 128752]
S2 DMAgent;Intel® PROSet/Wireless WiMAX Red Bend Device Management Service;c:\program files\Intel\WiMAX\Bin\DMAgent.exe [2009-12-29 404992]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2010-05-05 1604200]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2010-04-06 258928]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [x]
S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-03-03 2320920]
S2 WiMAXAppSrv;Intel® PROSet/Wireless WiMAX Service;c:\program files\Intel\WiMAX\Bin\AppSrv.exe [2009-12-29 911360]
S3 bpenum;bpenum;c:\windows\system32\DRIVERS\bpenum.sys [x]
S3 bpmp;bpmp;c:\windows\system32\DRIVERS\bpmp.sys [x]
S3 bpusb;bpusb;c:\windows\system32\Drivers\bpusb.sys [x]
S3 easytether;easytether;c:\windows\system32\DRIVERS\easytthr.sys [x]
S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-10-06 51512]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-02-06 137560]
S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2010-02-24 835952]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 19:43]
.
2011-10-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-08 19:43]
.
2011-10-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-691481713-2458775474-3661280945-1001Core.job
- c:\users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-25 02:49]
.
2011-10-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-691481713-2458775474-3661280945-1001UA.job
- c:\users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-25 02:49]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-26 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-26 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-26 413208]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-05-05 17412200]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-03-22 10134560]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-03-22 896032]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"TPwrMain"="c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE" [BU]
"HSON"="c:\program files (x86)\TOSHIBA\TBS\HSON.exe" [BU]
"SmoothView"="c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe" [BU]
"00TCrdMain"="c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe" [BU]
"Teco"="c:\program files (x86)\TOSHIBA\TECO\Teco.exe" [BU]
"TosWaitSrv"="c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe" [BU]
"SmartFaceVWatcher"="c:\program files (x86)\Toshiba\SmartFaceV\SmartFaceVWatcher.exe" [BU]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-01-20 1926928]
"IntelWirelessWiMAX"="c:\program files\Intel\WiMAX\Bin\WiMAXCU.exe" [2010-01-27 1445888]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-02-06 709976]
"TosNC"="c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe" [BU]
"TosReelTimeMonitor"="c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe" [BU]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdcBase.exe" [2007-05-31 660360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.bungie.net/
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\j3kpu51f.default\
FF - prefs.js: browser.startup.homepage - news.google.com
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?btnI=I%27m+Feeling+Lucky&q=
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-691481713-2458775474-3661280945-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-691481713-2458775474-3661280945-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-10-10 17:58:50
ComboFix-quarantined-files.txt 2011-10-10 21:58
ComboFix2.txt 2011-10-09 12:59
ComboFix3.txt 2011-10-09 02:43
ComboFix4.txt 2011-10-09 02:32
ComboFix5.txt 2011-10-10 21:51
.
Pre-Run: 195,941,806,080 bytes free
Post-Run: 195,870,326,784 bytes free
.
- - End Of File - - 4971D5615F4F05CEE82ABB6FB65F26EB
MBRCheck, version 1.2.3
© 2010, AD
Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: (build 7600), 64-bit
Base Board Manufacturer: TOSHIBA
BIOS Manufacturer: TOSHIBA
System Manufacturer: TOSHIBA
System Product Name: Satellite M645
Logical Drives Mask: 0x0000000c
Kernel Drivers (total 201):
0x0300A000 \SystemRoot\system32\ntoskrnl.exe
0x035E6000 \SystemRoot\system32\hal.dll
0x00B9C000 \SystemRoot\system32\kdcom.dll
0x00C79000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x00CBD000 \SystemRoot\system32\PSHED.dll
0x00CD1000 \SystemRoot\system32\CLFS.SYS
0x00D2F000 \SystemRoot\system32\CI.dll
0x00EAE000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00F52000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x00F61000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x00FB8000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x00FC1000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x00FCB000 \SystemRoot\system32\DRIVERS\pci.sys
0x00E00000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x00E0D000 \SystemRoot\system32\DRIVERS\LPCFilter.sys
0x00E1C000 \SystemRoot\System32\drivers\partmgr.sys
0x00E31000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x00E3A000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x00E46000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x00C00000 \SystemRoot\System32\drivers\volmgrx.sys
0x00E5B000 \SystemRoot\System32\drivers\mountmgr.sys
0x00E75000 \SystemRoot\system32\DRIVERS\pciide.sys
0x00E7C000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x01068000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x01270000 \SystemRoot\system32\DRIVERS\atapi.sys
0x01279000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x012A3000 \SystemRoot\system32\DRIVERS\msahci.sys
0x012AE000 \SystemRoot\system32\drivers\amdxata.sys
0x012B9000 \SystemRoot\system32\drivers\fltmgr.sys
0x01305000 \SystemRoot\system32\drivers\fileinfo.sys
0x0140E000 \SystemRoot\System32\Drivers\Ntfs.sys
0x01319000 \SystemRoot\System32\Drivers\msrpc.sys
0x015B0000 \SystemRoot\System32\Drivers\ksecdd.sys
0x01377000 \SystemRoot\System32\Drivers\cng.sys
0x015CA000 \SystemRoot\System32\drivers\pcw.sys
0x015DB000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x01643000 \SystemRoot\system32\drivers\ndis.sys
0x01735000 \SystemRoot\system32\drivers\NETIO.SYS
0x01795000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x01802000 \SystemRoot\System32\drivers\tcpip.sys
0x01000000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x01A03000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x01A4F000 \SystemRoot\system32\DRIVERS\TVALZ_O.SYS
0x01A54000 \SystemRoot\system32\DRIVERS\tos_sps64.sys
0x01ACE000 \SystemRoot\system32\DRIVERS\Thpevm.SYS
0x01AD0000 \SystemRoot\system32\DRIVERS\thpdrv.sys
0x01ADC000 \SystemRoot\System32\Drivers\spldr.sys
0x01AE4000 \SystemRoot\System32\drivers\rdyboost.sys
0x01B1E000 \SystemRoot\System32\Drivers\mup.sys
0x01B30000 \SystemRoot\System32\drivers\hwpolicy.sys
0x01B39000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x01B73000 \SystemRoot\system32\DRIVERS\disk.sys
0x01B89000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x04265000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x0428F000 \SystemRoot\System32\Drivers\Null.SYS
0x04298000 \SystemRoot\System32\Drivers\Beep.SYS
0x0429F000 \SystemRoot\System32\drivers\vga.sys
0x042AD000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x042D2000 \SystemRoot\System32\drivers\watchdog.sys
0x042E2000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x042EB000 \SystemRoot\system32\drivers\rdpencdd.sys
0x042F4000 \SystemRoot\system32\drivers\rdprefmp.sys
0x042FD000 \SystemRoot\System32\Drivers\Msfs.SYS
0x04308000 \SystemRoot\System32\Drivers\Npfs.SYS
0x04319000 \SystemRoot\system32\DRIVERS\tdx.sys
0x04337000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x04344000 \SystemRoot\system32\drivers\afd.sys
0x04000000 \SystemRoot\System32\DRIVERS\netbt.sys
0x043CD000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x043D6000 \SystemRoot\system32\DRIVERS\pacer.sys
0x01BC7000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x01BDD000 \SystemRoot\system32\DRIVERS\netbios.sys
0x017C0000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x01BEC000 \SystemRoot\system32\DRIVERS\termdd.sys
0x017DB000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS
0x017E5000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS
0x02E2D000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x02E7E000 \SystemRoot\system32\drivers\nsiproxy.sys
0x02E8A000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x02E95000 \SystemRoot\System32\drivers\discache.sys
0x02EA4000 \SystemRoot\System32\Drivers\dfsc.sys
0x02EC2000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x02ED3000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x02EF9000 \SystemRoot\system32\DRIVERS\easytthr.sys
0x04A7B000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x055B6000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
0x02F02000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x055B8000 \SystemRoot\System32\drivers\dxgmms1.sys
0x05811000 \SystemRoot\system32\DRIVERS\igdkmd64.sys
0x061EB000 \SystemRoot\system32\DRIVERS\HECIx64.sys
0x05800000 \SystemRoot\system32\drivers\usbehci.sys
0x04A00000 \SystemRoot\system32\drivers\USBPORT.SYS
0x04A56000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x044BF000 \SystemRoot\system32\DRIVERS\Rt64win7.sys
0x06603000 \SystemRoot\system32\DRIVERS\NETw5s64.sys
0x06D62000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x06D9B000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
0x06DCA000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x06DCF000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x06DED000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x04512000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x06DFC000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x04564000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x04573000 \SystemRoot\system32\DRIVERS\tdcmdpst.sys
0x0457D000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x0458A000 \SystemRoot\system32\DRIVERS\Impcd.sys
0x045B1000 \SystemRoot\system32\DRIVERS\TVALZFL.sys
0x045B8000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x045CE000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x045DE000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x04400000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x04424000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x04430000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x0445F000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x0447A000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x0449B000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x06DFE000 \SystemRoot\system32\DRIVERS\swenum.sys
0x01600000 \SystemRoot\system32\DRIVERS\ks.sys
0x04681000 \SystemRoot\system32\DRIVERS\MarvinBus64.sys
0x046C5000 \SystemRoot\system32\DRIVERS\umbus.sys
0x046D7000 \SystemRoot\system32\DRIVERS\bpenum.sys
0x0470E000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x04768000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x0861D000 \SystemRoot\system32\drivers\RTKVHD64.sys
0x0884D000 \SystemRoot\system32\drivers\portcls.sys
0x0888A000 \SystemRoot\system32\drivers\drmk.sys
0x088AC000 \SystemRoot\system32\drivers\ksthunk.sys
0x088B2000 \SystemRoot\system32\DRIVERS\IntcDAud.sys
0x00050000 \SystemRoot\System32\win32k.sys
0x088F9000 \SystemRoot\System32\drivers\Dxapi.sys
0x08905000 \SystemRoot\system32\DRIVERS\monitor.sys
0x08913000 \SystemRoot\system32\DRIVERS\udfs.sys
0x08967000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x08984000 \SystemRoot\System32\Drivers\usbvideo.sys
0x089B2000 \SystemRoot\system32\DRIVERS\pgeffect.sys
0x005F0000 \SystemRoot\System32\TSDDD.dll
0x007C0000 \SystemRoot\System32\cdd.dll
0x089B9000 \SystemRoot\System32\Drivers\bpusb.sys
0x0477D000 \SystemRoot\system32\DRIVERS\bpmp.sys
0x089D3000 \SystemRoot\System32\Drivers\crashdmp.sys
0x04045000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x089E1000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x047AF000 \SystemRoot\system32\drivers\luafv.sys
0x047D2000 \SystemRoot\system32\drivers\WudfPf.sys
0x08600000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x04600000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x04653000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x04666000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x03C2C000 \SystemRoot\system32\drivers\HTTP.sys
0x03CF4000 \SystemRoot\system32\DRIVERS\bowser.sys
0x03D12000 \SystemRoot\System32\drivers\mpsdrv.sys
0x03D2A000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x03D57000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x03DA5000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x09AD9000 \SystemRoot\system32\drivers\peauth.sys
0x09B7F000 \SystemRoot\System32\Drivers\secdrv.SYS
0x09B8A000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x09BB7000 \SystemRoot\System32\drivers\tcpipreg.sys
0x09A00000 \SystemRoot\System32\DRIVERS\srv2.sys
0x0CC5C000 \SystemRoot\System32\DRIVERS\srv.sys
0x0CD8E000 \??\C:\windows\system32\Drivers\PROCEXP113.SYS
0x77640000 \Windows\System32\ntdll.dll
0x481D0000 \Windows\System32\smss.exe
0xFF960000 \Windows\System32\apisetschema.dll
0xFFA40000 \Windows\System32\autochk.exe
0xFF8D0000 \Windows\System32\difxapi.dll
0xFF7C0000 \Windows\System32\msctf.dll
0xFF720000 \Windows\System32\clbcatq.dll
0xFF6F0000 \Windows\System32\imm32.dll
0xFF610000 \Windows\System32\advapi32.dll
0xFF400000 \Windows\System32\ole32.dll
0xFF2D0000 \Windows\System32\wininet.dll
0xFF070000 \Windows\System32\iertutil.dll
0xFF000000 \Windows\System32\gdi32.dll
0x77520000 \Windows\System32\kernel32.dll
0xFE270000 \Windows\System32\shell32.dll
0xFE140000 \Windows\System32\rpcrt4.dll
0xFE0F0000 \Windows\System32\ws2_32.dll
0x77420000 \Windows\System32\user32.dll
0xFE0A0000 \Windows\System32\Wldap32.dll
0x77810000 \Windows\System32\normaliz.dll
0xFE090000 \Windows\System32\nsi.dll
0xFE070000 \Windows\System32\imagehlp.dll
0xFDFF0000 \Windows\System32\shlwapi.dll
0xFDE10000 \Windows\System32\setupapi.dll
0xFDD40000 \Windows\System32\usp10.dll
0xFDD20000 \Windows\System32\sechost.dll
0xFDBA0000 \Windows\System32\urlmon.dll
0xFDB00000 \Windows\System32\comdlg32.dll
0xFDAF0000 \Windows\System32\lpk.dll
0x77800000 \Windows\System32\psapi.dll
0xFDA50000 \Windows\System32\msvcrt.dll
0xFD970000 \Windows\System32\oleaut32.dll
0xFD800000 \Windows\System32\crypt32.dll
0xFD790000 \Windows\System32\KernelBase.dll
0xFD770000 \Windows\System32\devobj.dll
0xFD730000 \Windows\System32\cfgmgr32.dll
0xFD690000 \Windows\System32\comctl32.dll
0xFD650000 \Windows\System32\wintrust.dll
0xFD640000 \Windows\System32\msasn1.dll
0x768A0000 \Windows\SysWOW64\normaliz.dll
Processes (total 95):
0 System Idle Process
4 System
324 C:\Windows\System32\smss.exe
496 csrss.exe
588 C:\Windows\System32\wininit.exe
612 csrss.exe
652 C:\Windows\System32\services.exe
676 C:\Windows\System32\lsass.exe
684 C:\Windows\System32\lsm.exe
780 C:\Windows\System32\svchost.exe
844 C:\Windows\System32\winlogon.exe
884 C:\Windows\System32\nvvsvc.exe
924 C:\Windows\System32\svchost.exe
1004 C:\Windows\System32\svchost.exe
116 C:\Windows\System32\svchost.exe
504 C:\Windows\System32\svchost.exe
796 C:\Windows\System32\svchost.exe
1124 C:\Windows\System32\svchost.exe
1236 C:\Windows\System32\wlanext.exe
1244 C:\Windows\System32\conhost.exe
1308 C:\Windows\System32\nvvsvc.exe
1376 C:\Windows\System32\spoolsv.exe
1412 C:\Windows\System32\svchost.exe
1560 C:\Windows\System32\taskhost.exe
1640 C:\Windows\System32\dwm.exe
1740 C:\Program Files\SUPERAntiSpyware\SASCore64.exe
1788 C:\Windows\explorer.exe
1800 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1904 C:\Program Files (x86)\Bonjour\mDNSResponder.exe
2024 C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
1980 C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
568 C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
1604 C:\Windows\System32\svchost.exe
2112 C:\Windows\System32\ThpSrv.exe
2136 C:\Windows\System32\TODDSrv.exe
2164 C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
2248 C:\Program Files\TOSHIBA\TECO\TecoService.exe
2304 C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe
2344 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
2424 C:\Windows\System32\SearchIndexer.exe
2560 C:\Windows\System32\igfxtray.exe
2572 C:\Windows\System32\hkcmd.exe
2584 C:\Windows\System32\igfxpers.exe
2768 C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
2800 C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe
2828 C:\Program Files\Intel\WiFi\bin\EvtEng.exe
2844 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
2904 C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
2928 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
2944 C:\Windows\System32\ThpSrv.exe
2960 C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
3036 C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
1520 C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
3336 C:\Program Files\TOSHIBA\TECO\Teco.exe
3364 WmiPrvSE.exe
3724 unsecapp.exe
3796 C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
3820 C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe
3888 C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
3904 C:\Windows\WindowsMobile\wmdcBase.exe
3676 C:\Windows\System32\svchost.exe
3080 C:\Windows\System32\svchost.exe
2536 C:\Windows\System32\svchost.exe
4276 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
4360 C:\Program Files (x86)\Skype\Phone\Skype.exe
4384 C:\Program Files (x86)\Mobile Stream\EasyTether\easytthr.exe
4408 C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
4444 C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
4496 C:\Program Files\TOSHIBA\FlashCards\Hotkey\TCrdKBB.exe
4596 C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
4684 C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
4792 C:\Windows\System32\igfxext.exe
4828 C:\Windows\System32\igfxsrvc.exe
4956 C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
5004 C:\Windows\System32\wbem\unsecapp.exe
4568 C:\Program Files\Windows Media Player\wmpnetwk.exe
4416 C:\Windows\System32\svchost.exe
1812 C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
5412 dllhost.exe
5700 C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
4680 C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
4820 C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
4312 C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
4576 C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
5584 C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
5956 C:\Windows\System32\svchost.exe
3868 C:\Windows\System32\wuauclt.exe
3768 C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
5832 C:\Windows\System32\SearchProtocolHost.exe
3988 C:\Windows\System32\SearchFilterHost.exe
3852 C:\Windows\System32\audiodg.exe
3720 dllhost.exe
3204 dllhost.exe
4260 C:\Users\Alex\Desktop\MBRCheck.exe
3284 C:\Windows\System32\conhost.exe
\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`5dd00000 (NTFS)
PhysicalDrive0 Model Number: ST9500420AS, Rev: 0001TSM1
Size Device Name MBR Status
——————————————–
465 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
SHA1: BBAD517F7EAC529451E4B9586C847AE190574F61
Done!
