win32.AutoRun.tmp trojan

Hi, combofix log below:

ComboFix 11-10-20.05 - user 20/10/2011 18:47:41.3.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.44.1033.18.3199.1381 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\user\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"d:\programme setup files\Easeus ToDo v2.5 backup.exe"
"d:\programme setup files\FreeRecorderSetup.exe"
"d:\programme setup files\FreeWAVMP3ConverterSetup.exe"
"d:\programme setup files\FreeWMAMP3ConverterSetup.exe"
"d:\programme setup files\pdf_converter.exe"
"d:\programme setup files\Recent Folders Setup 1.0.1.zip"
"d:\programme setup files\Setup_FreeVideoConverter.exe"
"d:\programme setup files\Softonic Downloader_for_free-youtube-download.exe"
"d:\programme setup files\Softonic Downloader_for_free-youtube-to-mp3-converter.exe"
"d:\programme setup files\Softonic Downloader_for_wavosaur.exe"
"d:\programme setup files\Windows 7 Compatible Programmes\FreeRecorderSetup.exe"
"d:\programme setup files\Windows 7 Compatible Programmes\FreeWAVMP3ConverterSetup.exe"
"d:\programme setup files\Windows 7 Compatible Programmes\FreeWMAMP3ConverterSetup.exe"
"d:\programme setup files\Windows 7 Compatible Programmes\Setup_FreeVideoConverter.exe"
"l:\my documents\Security prog setup files\spy eraser plb.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
d:\programme setup files\Easeus ToDo v2.5 backup.exe
d:\programme setup files\FreeRecorderSetup.exe
d:\programme setup files\FreeWAVMP3ConverterSetup.exe
d:\programme setup files\FreeWMAMP3ConverterSetup.exe
d:\programme setup files\pdf_converter.exe
d:\programme setup files\Recent Folders Setup 1.0.1.zip
d:\programme setup files\Setup_FreeVideoConverter.exe
d:\programme setup files\Softonic Downloader_for_free-youtube-download.exe
d:\programme setup files\Softonic Downloader_for_free-youtube-to-mp3-converter.exe
d:\programme setup files\Softonic Downloader_for_wavosaur.exe
d:\programme setup files\Windows 7 Compatible Programmes\FreeRecorderSetup.exe
d:\programme setup files\Windows 7 Compatible Programmes\FreeWAVMP3ConverterSetup.exe
d:\programme setup files\Windows 7 Compatible Programmes\FreeWMAMP3ConverterSetup.exe
d:\programme setup files\Windows 7 Compatible Programmes\Setup_FreeVideoConverter.exe
l:\my documents\Security prog setup files\spy eraser plb.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-09-20 to 2011-10-20 )))))))))))))))))))))))))))))))
.
.
2011-10-20 17:55 . 2011-10-20 17:55 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp
2011-10-20 17:55 . 2011-10-20 17:55 ——– d—–w- c:\users\DefaultAppPool\AppData\Local\temp
2011-10-20 17:55 . 2011-10-20 17:55 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-10-20 17:55 . 2011-10-20 17:55 ——– d—–w- c:\users\Administrator\AppData\Local\temp
2011-10-20 17:38 . 2011-10-20 17:38 56200 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FB49410E-2836-4A7D-9998-1021C3DB89B7}\offreg.dll
2011-10-20 17:37 . 2011-10-07 03:48 6668624 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FB49410E-2836-4A7D-9998-1021C3DB89B7}\mpengine.dll
2011-10-18 13:54 . 2011-10-18 13:54 ——– d—–w- c:\program files\ESET
2011-10-17 13:43 . 2011-10-20 17:55 ——– d—–w- c:\users\user\AppData\Local\temp
2011-10-13 20:47 . 2011-08-17 04:19 75776 —-a-w- c:\windows\system32\psisrndr.ax
2011-10-13 20:47 . 2011-08-17 04:24 465408 —-a-w- c:\windows\system32\psisdecd.dll
2011-10-13 20:47 . 2011-08-27 04:26 571904 —-a-w- c:\windows\system32\oleaut32.dll
2011-10-13 20:47 . 2011-08-27 04:26 233472 —-a-w- c:\windows\system32\oleacc.dll
2011-10-13 20:47 . 2011-09-06 02:28 2334720 —-a-w- c:\windows\system32\win32k.sys
2011-10-13 20:47 . 2011-08-20 04:31 981504 —-a-w- c:\windows\system32\wininet.dll
2011-10-13 20:47 . 2011-08-20 04:26 860672 —-a-w- c:\program files\Internet Explorer\iedvtool.dll
2011-10-13 20:46 . 2011-10-01 02:42 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-10-13 20:46 . 2011-08-20 04:26 163328 —-a-w- c:\program files\Internet Explorer\ieproxy.dll
2011-10-12 18:31 . 2011-10-12 18:31 ——– d—–w- c:\users\user\AppData\Local\4kdownload.com
2011-10-12 18:21 . 2011-10-12 18:21 ——– d—–w- c:\program files\4kDownload
2011-10-12 18:02 . 2011-10-12 18:02 ——– d—–w- c:\program files\Kastor Free Video Converter
2011-10-12 18:02 . 2011-10-12 18:02 ——– d—–w- c:\users\user\AppData\Roaming\KastorVideoConverter
2011-10-12 16:04 . 2011-10-12 16:03 703824 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1257F976-61C2-4D01-942F-44A7F1580C11}\gapaengine.dll
2011-09-26 18:12 . 2011-10-12 15:51 ——– d—–w- c:\program files\WinTips, Inc
2011-09-22 16:19 . 2011-09-22 16:19 ——– d—–w- c:\users\user\AppData\Local\Taggtool
2011-09-22 14:44 . 2011-09-22 14:44 ——– d—–w- c:\program files\DVDVideoSoft
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-19 07:55 . 2011-06-11 07:14 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-07 03:48 . 2011-04-26 07:21 6668624 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-08-31 16:00 . 2011-06-15 17:41 22216 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-08-09 09:03 . 2011-08-09 09:04 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-08-04 14:50 . 2011-08-04 14:50 114 —-a-w- c:\windows\Printdir.bat
2011-08-03 11:50 . 2011-08-15 14:55 914024 —-a-w- c:\windows\system32\nvdispco32.dll
2011-08-03 11:50 . 2011-08-15 14:55 875112 —-a-w- c:\windows\system32\nvgenco32.dll
2011-08-03 11:50 . 2011-08-15 14:55 57960 —-a-w- c:\windows\system32\OpenCL.dll
2011-08-03 11:50 . 2011-08-15 14:55 5404776 —-a-w- c:\windows\system32\nvcuda.dll
2011-08-03 11:50 . 2011-08-15 14:55 2391656 —-a-w- c:\windows\system32\nvcuvid.dll
2011-08-03 11:50 . 2011-08-15 14:55 2090088 —-a-w- c:\windows\system32\nvcuvenc.dll
2011-08-03 11:50 . 2011-08-15 14:55 17193576 —-a-w- c:\windows\system32\nvcompiler.dll
2011-08-03 11:50 . 2011-08-15 14:55 16595560 —-a-w- c:\windows\system32\nvoglv32.dll
2011-08-03 11:50 . 2011-08-15 14:55 10304104 —-a-w- c:\windows\system32\drivers\nvlddmkm.sys
2011-08-03 11:50 . 2011-01-25 19:33 2412136 —-a-w- c:\windows\system32\nvapi.dll
2011-08-03 11:50 . 2011-01-07 21:06 600680 —-a-w- c:\windows\system32\easyUpdatusAPIU.dll
2011-08-03 11:50 . 2011-01-07 21:06 3730024 —-a-w- c:\windows\system32\nvcpl.dll
2011-08-03 11:50 . 2011-01-07 21:06 2558568 —-a-w- c:\windows\system32\nvsvc.dll
2011-08-03 11:50 . 2011-01-07 21:06 599144 —-a-w- c:\windows\system32\nvvsvc.exe
2011-08-03 11:50 . 2011-01-07 21:06 111208 —-a-w- c:\windows\system32\nvmctray.dll
2011-08-03 11:50 . 2010-07-09 16:37 66664 —-a-w- c:\windows\system32\nvshext.dll
2011-08-03 11:50 . 2009-06-10 21:19 12636776 —-a-w- c:\windows\system32\nvd3dum.dll
2011-07-27 07:49 . 2011-06-05 18:21 2301208 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2011-07-27 07:49 . 2011-06-05 18:21 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2011-07-27 07:49 . 2011-07-27 07:49 710976 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-10-17 4615552]
"DriverCure"="c:\program files\ParetoLogic\DriverCure\DriverCure.exe" [2009-08-07 3993368]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"Reader Library Launcher"="c:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe" [2010-07-13 906648]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-03-28 10029672]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallati...r=9.0.894" [?]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2011-1-25 303104]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 MpKslb99bc62c;MpKslb99bc62c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A9826131-DFD8-4AC1-B1DA-30E273132B5C}\MpKslb99bc62c.sys [x]
R1 MpKsldb37771b;MpKsldb37771b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3BE2F0D6-E0FF-4776-BC35-945C4A245E69}\MpKsldb37771b.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 appliand;Applian Network Service;c:\windows\system32\DRIVERS\appliand.sys [2010-06-24 28256]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]
R3 SWDUMon;SWDUMon;c:\windows\system32\DRIVERS\SWDUMon.sys [2011-04-27 11232]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-01-20 1343400]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2011-07-22 12880]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2011-07-12 67664]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2011-08-18 116608]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
S3 appliandMP;appliandMP;c:\windows\system32\DRIVERS\appliand.sys [2010-06-24 28256]
S3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
S3 netr28u;Belkin USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2007-08-15 552448]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-03-21 362600]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-01-23 c:\windows\Tasks\DriverCure.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe [2009-08-07 19:36]
.
2011-10-20 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2009-01-13 14:59]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://uk.yahoo.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uSearchURL,(Default) = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube Download - c:\users\user\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\user\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.1.254
DPF: {B947BD34-91CC-4590-9BA0-6F0F0D2028E8} - hxxp://www.productsandservices.bt.com/consumer/consumerProducts/js/BTSetupTools.cab
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-10-20 18:58:57
ComboFix-quarantined-files.txt 2011-10-20 17:58
ComboFix2.txt 2011-10-17 13:43
ComboFix3.txt 2011-10-16 13:25
.
Pre-Run: 8,201,285,632 bytes free
Post-Run: 8,043,216,896 bytes free
.
- - End Of File - - 6D9FB423EC37DE4160979735990A1543


Thanks for the help
hedley

Thanks for the reply.

Logs are as follows:

DDS.txt
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.7601.17514
Run by [removed] at 15:17:58 on 2011-10-22
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.44.1033.18.3199.2117 [GMT 1:00]
.
AV: Microsoft Security Essentials *Enabled/Outdated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Outdated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Windows\system32\svchost.exe -k apphost
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k iissvcs
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\System32\alg.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
C:\Windows\system32\Macromed\Flash\FlashUtil11c_ActiveX.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://uk.yahoo.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uSearchURL,(Default) = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
mURLSearchHooks: H - No File
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
{555d4d79-4bd2-4094-a395-cfc534424a05}
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [DriverCure] c:\program files\paretologic\drivercure\DriverCure.exe -restart
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [Reader Library Launcher] c:\program files\sony\reader\data\bin\launcher\Reader Library Launcher.exe
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [RIMBBLaunchAgent.exe] c:\program files\common files\research in motion\usb drivers\RIMBBLaunchAgent.exe
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallati…uot;ver=9.0.894
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\exifla~1.lnk - c:\program files\finepixviewer\QuickDCF2.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
mPolicies-explorer: EnableShellExecuteHooks = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Free YouTube Download - c:\users\andrea\appdata\roaming\dvdvideosoftiehelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\andrea\appdata\roaming\dvdvideosoftiehelpers\freeyoutubetomp3converter.htm
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/en-gb/wlscctrl2.cab
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {B947BD34-91CC-4590-9BA0-6F0F0D2028E8} - hxxp://www.productsandservices.bt.com/consumer/consumerProducts/js/BTSetupTools.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.4.24.0.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} - hxxp://download.microsoft.com/download/7/E/6/7E6A8567-DFE4-4624-87C3-163549BE2704/clearadj.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} - hxxp://utilities.pcpitstop.com/da2/PCPitStop2.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{76B9D603-1FBA-4C4D-B605-BEF24B8CFB35} : DhcpNameServer = 192.168.1.254
TCP: Interfaces\{9C44212A-06CD-4BB5-B11D-1B428733E612} : DhcpNameServer = 192.168.1.254
TCP: Interfaces\{9C44212A-06CD-4BB5-B11D-1B428733E612}\244564F4E4 : DhcpNameServer = 192.168.22.22 192.168.22.23
TCP: Interfaces\{9C44212A-06CD-4BB5-B11D-1B428733E612}\2445F40756E6A7F6E656 : DhcpNameServer = 192.168.22.22 192.168.22.23
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165648]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2011-7-19 116608]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-9-14 366152]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia updatus\daemonu.exe [2011-8-15 2255464]
R3 appliandMP;appliandMP;c:\windows\system32\drivers\appliand.sys [2010-6-24 28256]
R3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\drivers\KMWDFILTER.sys [2009-4-29 25088]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-6-15 22216]
R3 netr28u;Belkin USB Wireless LAN Card Driver for Vista;c:\windows\system32\drivers\netr28u.sys [2011-1-20 552448]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2011-8-27 362600]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 appliand;Applian Network Service;c:\windows\system32\drivers\appliand.sys [2010-6-24 28256]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 65024]
S3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2011-4-27 208944]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-6-14 15872]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2011-4-10 27192]
S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [2011-4-27 11232]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-6-14 52224]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-1-20 1343400]
.
=============== Created Last 30 ================
.
2011-10-22 07:15:23 ——– d—–w- c:\users\andrea\appdata\local\{FA1832EB-37DC-405C-9CAA-D88865C8DA15}
2011-10-22 07:14:59 ——– d—–w- c:\users\andrea\appdata\local\{FC5628A9-206B-4609-9F2C-F66606ECD415}
2011-10-21 18:21:08 ——– d—–w- c:\users\andrea\appdata\local\{DB082F04-B844-4A24-B55D-256AA2AD55CD}
2011-10-21 18:20:44 ——– d—–w- c:\users\andrea\appdata\local\{501A9575-1ECA-4A3F-8DE5-ED737EFA9EC8}
2011-10-21 18:16:56 6881616 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{45ace414-a4dd-49cf-ada9-774aa03ae166}\mpengine.dll
2011-10-21 08:29:29 ——– d—–w- c:\users\andrea\appdata\local\{5EDCAAA7-493F-4CA0-8E5E-B1C400081607}
2011-10-21 08:29:07 ——– d—–w- c:\users\andrea\appdata\local\{F68C0E95-ACBE-4CEF-A405-AF5FEE45F590}
2011-10-21 07:35:33 ——– d—–w- c:\users\andrea\appdata\local\{FD4BB272-C5B9-48F8-AC4A-3A6BE22B85FF}
2011-10-21 07:35:11 ——– d—–w- c:\users\andrea\appdata\local\{B918D252-9AB1-459B-AD63-94951D17082B}
2011-10-20 15:41:48 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-10-20 11:45:58 ——– d—–w- c:\users\andrea\appdata\local\{C989D205-58EB-483C-A7DE-842C13243DC4}
2011-10-20 11:45:36 ——– d—–w- c:\users\andrea\appdata\local\{A674EF59-C644-4E42-94F8-5642338B2BEC}
2011-10-19 22:07:47 ——– d—–w- c:\users\andrea\appdata\local\{3F563EC9-1F60-471E-8410-2C8760BF3F44}
2011-10-19 22:07:25 ——– d—–w- c:\users\andrea\appdata\local\{28398451-4399-42D1-925A-38C5DB13B457}
2011-10-19 07:56:12 ——– d—–w- c:\users\andrea\appdata\local\{AEB94CF6-B88B-470E-B420-0D83402268B9}
2011-10-19 07:55:50 ——– d—–w- c:\users\andrea\appdata\local\{763FB793-EC99-4CAC-AE0C-C49F37F10834}
2011-10-18 23:52:23 ——– d—–w- c:\users\andrea\appdata\local\{8A8BFBB2-D282-4B84-AA6E-884D5C3A4E1D}
2011-10-18 13:54:58 ——– d—–w- c:\program files\ESET
2011-10-18 07:01:43 ——– d—–w- c:\users\andrea\appdata\local\{ABDABEFB-6D09-4B21-8C78-57C8468ED30B}
2011-10-18 07:01:20 ——– d—–w- c:\users\andrea\appdata\local\{59CBD88A-FF33-4383-BC58-556F7E9DF9EC}
2011-10-17 23:52:06 ——– d—–w- c:\users\andrea\appdata\local\{8C1C1BFE-5F55-4692-84B8-DFEB19C80935}
2011-10-17 13:43:28 ——– d-sh–w- C:\$RECYCLE.BIN
2011-10-17 13:43:26 ——– d—–w- c:\users\andrea\appdata\local\temp
2011-10-17 07:11:23 ——– d—–w- c:\users\andrea\appdata\local\{11DA63E5-E339-4A2F-A346-101E79CF0E4F}
2011-10-17 07:10:57 ——– d—–w- c:\users\andrea\appdata\local\{5FC61E54-CDAA-42A3-9EE4-A00B3E74506E}
2011-10-17 07:10:16 ——– d—–w- c:\users\andrea\appdata\local\{DB0948E4-3F40-40DE-B7CE-28ECC9F0B7A3}
2011-10-17 07:09:49 ——– d—–w- c:\users\andrea\appdata\local\{359BCE5E-3B88-4BA6-BB89-AEA3780640AC}
2011-10-16 12:58:02 98816 —-a-w- c:\windows\sed.exe
2011-10-16 12:58:02 518144 —-a-w- c:\windows\SWREG.exe
2011-10-16 12:58:02 256000 —-a-w- c:\windows\PEV.exe
2011-10-16 12:58:02 208896 —-a-w- c:\windows\MBR.exe
2011-10-16 12:52:33 ——– d—–w- c:\users\andrea\appdata\local\{C65DC0A3-83E5-457C-8DF7-621DFEEC2F3B}
2011-10-16 12:52:10 ——– d—–w- c:\users\andrea\appdata\local\{7199DED5-75BD-452E-97FF-812F0DBF9010}
2011-10-16 00:02:15 ——– d—–w- c:\users\andrea\appdata\local\{AA1B99F2-D68D-4142-8F64-1158028D533F}
2011-10-16 00:01:53 ——– d—–w- c:\users\andrea\appdata\local\{D561E86F-95A8-4C8B-9492-367E6D62052D}
2011-10-15 09:14:03 ——– d—–w- c:\users\andrea\appdata\local\{00ACF806-8CD4-4EEA-91CD-DD06AE18DA85}
2011-10-15 09:13:41 ——– d—–w- c:\users\andrea\appdata\local\{38D0568C-089F-4D5D-80FD-6B9B04A657ED}
2011-10-14 20:47:51 ——– d—–w- c:\users\andrea\appdata\local\{7265357C-6DB3-4F4E-940D-5CC6F1FD65BA}
2011-10-14 20:47:28 ——– d—–w- c:\users\andrea\appdata\local\{B05E7878-E703-45E4-B21B-231093076B87}
2011-10-14 08:47:03 ——– d—–w- c:\users\andrea\appdata\local\{8D9F9D3D-3D8A-4214-BC7F-0B7C18C15490}
2011-10-14 08:46:41 ——– d—–w- c:\users\andrea\appdata\local\{66AC1A6F-A799-4351-8C65-192DB14B15C9}
2011-10-13 23:56:16 ——– d—–w- c:\users\andrea\appdata\local\{62198A29-1592-4E30-A801-F0C2C9C90B25}
2011-10-13 23:55:54 ——– d—–w- c:\users\andrea\appdata\local\{EED96CFA-5882-4D66-8ECF-69B62A590DE0}
2011-10-13 20:47:18 75776 —-a-w- c:\windows\system32\psisrndr.ax
2011-10-13 20:47:17 465408 —-a-w- c:\windows\system32\psisdecd.dll
2011-10-13 20:47:16 571904 —-a-w- c:\windows\system32\oleaut32.dll
2011-10-13 20:47:16 233472 —-a-w- c:\windows\system32\oleacc.dll
2011-10-13 20:47:09 2334720 —-a-w- c:\windows\system32\win32k.sys
2011-10-13 20:47:00 981504 —-a-w- c:\windows\system32\wininet.dll
2011-10-13 20:47:00 860672 —-a-w- c:\program files\internet explorer\iedvtool.dll
2011-10-13 20:46:58 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-10-13 20:46:58 163328 —-a-w- c:\program files\internet explorer\ieproxy.dll
2011-10-13 10:14:39 ——– d—–w- c:\users\andrea\appdata\local\{E2388635-6452-4BA1-8DBC-0C1777BF48BB}
2011-10-13 10:14:17 ——– d—–w- c:\users\andrea\appdata\local\{69FF985A-B74B-411D-9D0B-F8C769FC4997}
2011-10-12 18:31:38 ——– d—–w- c:\users\andrea\appdata\local\4kdownload.com
2011-10-12 18:21:41 ——– d—–w- c:\program files\4kDownload
2011-10-12 18:02:23 ——– d—–w- c:\users\andrea\appdata\roaming\KastorVideoConverter
2011-10-12 18:02:23 ——– d—–w- c:\program files\Kastor Free Video Converter
2011-10-12 16:04:25 703824 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{1257f976-61c2-4d01-942f-44a7f1580c11}\gapaengine.dll
2011-10-12 15:59:16 ——– d—–w- c:\users\andrea\appdata\local\{48023554-05CE-4793-8A1B-DCA27AE601AC}
2011-10-12 15:58:53 ——– d—–w- c:\users\andrea\appdata\local\{81C82AB2-0F6E-4319-B7DA-C0F6B13E5E71}
2011-10-12 08:04:41 ——– d—–w- c:\users\andrea\appdata\local\{AFD1A34C-A25B-4EC0-8F0E-76520FE19959}
2011-10-12 08:04:19 ——– d—–w- c:\users\andrea\appdata\local\{7232B27A-BFAF-4C7A-BF30-D4FDAE15EDC2}
2011-10-12 00:09:20 ——– d—–w- c:\users\andrea\appdata\local\{3054F1EF-BD52-4A85-98CE-440A705AACCE}
2011-10-11 07:02:32 ——– d—–w- c:\users\andrea\appdata\local\{0F87D0A6-9A5A-4627-8750-D490645AC0B2}
2011-10-11 07:02:10 ——– d—–w- c:\users\andrea\appdata\local\{22290191-3361-4934-B32F-EFE2A10F5BA7}
2011-10-10 23:52:30 ——– d—–w- c:\users\andrea\appdata\local\{0E387E55-7AB7-44D6-9E01-5184A023B475}
2011-10-10 23:52:08 ——– d—–w- c:\users\andrea\appdata\local\{3D25D236-EECF-4DE5-A6BE-8D66089FC383}
2011-10-10 08:58:11 ——– d—–w- c:\users\andrea\appdata\local\{937BF3DF-7712-4C12-8394-E77E20C8BB91}
2011-10-10 08:57:49 ——– d—–w- c:\users\andrea\appdata\local\{FC289618-19F2-4165-A5A9-7AE453FDA353}
2011-10-09 12:43:46 ——– d—–w- c:\users\andrea\appdata\local\{2037F4D1-AF4D-40C9-B879-7F08DD6F9818}
2011-10-09 12:43:24 ——– d—–w- c:\users\andrea\appdata\local\{8A8066CE-59AC-451B-856B-94BD3BBB2A89}
2011-10-08 13:57:07 ——– d—–w- c:\users\andrea\appdata\local\{DD3079A2-C342-4B28-95B7-FD9087688E18}
2011-10-08 13:56:45 ——– d—–w- c:\users\andrea\appdata\local\{FC3B0D9D-F95F-4363-85CD-D6EB62F0FEBD}
2011-10-08 00:01:01 ——– d—–w- c:\users\andrea\appdata\local\{94C4B5A8-ED99-4A2C-B764-2588D4EADBFE}
2011-10-08 00:00:39 ——– d—–w- c:\users\andrea\appdata\local\{478071EC-7EAF-4405-B97A-DAC01A0B9F3A}
2011-10-07 07:12:13 ——– d—–w- c:\users\andrea\appdata\local\{71D0B687-4B4F-43D9-BA41-509155D98922}
2011-10-07 07:11:51 ——– d—–w- c:\users\andrea\appdata\local\{4993B835-DE6F-4158-A62F-71A783A79A2E}
2011-10-07 06:57:51 ——– d—–w- c:\users\andrea\appdata\local\{4E8AC5DA-6B11-4726-AAF2-38B6696345CC}
2011-10-07 06:57:29 ——– d—–w- c:\users\andrea\appdata\local\{94A604ED-F6FB-4F4C-A180-DB238406597B}
2011-10-06 13:15:09 ——– d—–w- c:\users\andrea\appdata\local\{7296FB7E-A99B-42D1-B894-5D5851AAED8C}
2011-10-06 13:14:47 ——– d—–w- c:\users\andrea\appdata\local\{41070372-9E79-43A7-BB42-BFBE6C247FCC}
2011-10-06 11:35:06 ——– d—–w- c:\users\andrea\appdata\local\{5F3D560A-8427-48A9-8D60-D365A2AD00D9}
2011-10-06 11:34:44 ——– d—–w- c:\users\andrea\appdata\local\{01BDFB78-5A46-4E4A-A349-5B8856F1E23C}
2011-10-05 20:24:38 ——– d—–w- c:\users\andrea\appdata\local\{368581BC-4FDE-4E23-AA2B-E18CE45E33A0}
2011-10-05 20:24:16 ——– d—–w- c:\users\andrea\appdata\local\{5CD5447D-A442-4ADF-9F84-46EA5161F752}
2011-10-05 08:23:51 ——– d—–w- c:\users\andrea\appdata\local\{9F036208-A0FD-43F7-A590-9D984CD682F1}
2011-10-05 08:23:29 ——– d—–w- c:\users\andrea\appdata\local\{C2C068F6-2D4F-4337-8685-939C3D9C66CF}
2011-10-04 20:23:04 ——– d—–w- c:\users\andrea\appdata\local\{63FAF84B-4541-4A10-B708-865ED65A9C0C}
2011-10-04 20:22:43 ——– d—–w- c:\users\andrea\appdata\local\{29E8C9D5-28A7-476B-80BC-6DC0FE8C626A}
2011-10-04 08:22:19 ——– d—–w- c:\users\andrea\appdata\local\{7CAF4A28-FB5C-4D57-902F-68DAF348723B}
2011-10-04 08:21:57 ——– d—–w- c:\users\andrea\appdata\local\{6EDE0834-5AD0-44DE-9B4D-BE077FB8F6E4}
2011-10-03 20:21:33 ——– d—–w- c:\users\andrea\appdata\local\{3A0BF5D0-C9BF-43D1-9ED7-03D613A237F4}
2011-10-03 20:21:10 ——– d—–w- c:\users\andrea\appdata\local\{D47A0D53-780C-4526-B767-FB362A5B7FB8}
2011-10-03 19:28:03 ——– d—–w- c:\users\andrea\appdata\local\{50BB6D06-3A7B-4241-B7E0-75B585DD8203}
2011-10-03 19:27:40 ——– d—–w- c:\users\andrea\appdata\local\{D58C7AA2-7B47-444D-A9BE-6E2869DA8984}
2011-10-03 07:27:15 ——– d—–w- c:\users\andrea\appdata\local\{1A5C25BE-232E-4C9D-AC1D-7ECB470BF863}
2011-10-03 07:26:53 ——– d—–w- c:\users\andrea\appdata\local\{7FCAC91F-80F3-4686-BCAF-97AFE97DB8F1}
2011-10-02 19:12:02 ——– d—–w- c:\users\andrea\appdata\local\{784FFB76-F9FF-45C5-865A-F1516519777D}
2011-10-02 19:11:39 ——– d—–w- c:\users\andrea\appdata\local\{A4FFA84F-2B48-4F65-8026-3124339899B7}
2011-10-02 07:11:09 ——– d—–w- c:\users\andrea\appdata\local\{7037B9FA-58B3-46E8-93E0-6A8EB423FE1C}
2011-10-02 07:10:42 ——– d—–w- c:\users\andrea\appdata\local\{7BB2022B-8549-4E64-8BED-32C8D5078EEB}
2011-10-01 22:11:24 ——– d—–w- c:\users\andrea\appdata\local\{4FC13612-AB50-4926-AF7D-B081235F6DF5}
2011-10-01 20:39:17 ——– d—–w- c:\users\andrea\appdata\local\{53D0530F-2D31-4750-B319-733FD4258242}
2011-10-01 20:38:55 ——– d—–w- c:\users\andrea\appdata\local\{FC925BA5-BB4C-4F59-9126-E96A1A8F868B}
2011-10-01 08:14:29 ——– d—–w- c:\users\andrea\appdata\local\{A47C0489-03C0-4E70-8EB7-264268438EAC}
2011-10-01 08:14:07 ——– d—–w- c:\users\andrea\appdata\local\{DEE552B2-ECAB-4759-88DF-43A6FD07AB98}
2011-10-01 07:34:47 ——– d—–w- c:\users\andrea\appdata\local\{0C245B7F-2494-4B11-85F0-34479DFD6313}
2011-10-01 00:02:41 ——– d—–w- c:\users\andrea\appdata\local\{B6DCECBF-7800-4238-BE9E-E51FF50C27ED}
2011-09-30 11:58:19 ——– d—–w- c:\users\andrea\appdata\local\{DD6C526D-E76F-4033-882D-552BF8B3764E}
2011-09-30 11:57:57 ——– d—–w- c:\users\andrea\appdata\local\{1E5BD8C6-A59A-4EB3-B487-D09E3BB74BC9}
2011-09-29 23:57:33 ——– d—–w- c:\users\andrea\appdata\local\{B4D4196D-DEF4-41A1-8F98-265E773ADB45}
2011-09-29 23:57:11 ——– d—–w- c:\users\andrea\appdata\local\{A8198B9E-920E-49D0-8E08-FAB09232E5EE}
2011-09-29 09:32:40 ——– d—–w- c:\users\andrea\appdata\local\{E76B5DD0-AA66-4DE3-BB05-191204EDE72B}
2011-09-29 09:32:17 ——– d—–w- c:\users\andrea\appdata\local\{F5AEF607-85E0-4603-B24C-347493207B28}
2011-09-29 08:32:09 ——– d—–w- c:\users\andrea\appdata\local\{77924743-BAB2-42DB-AAEC-9D6445CD329D}
2011-09-29 08:31:47 ——– d—–w- c:\users\andrea\appdata\local\{219644C9-D869-4579-872D-9A53A4273CBB}
2011-09-28 13:51:35 ——– d—–w- c:\users\andrea\appdata\local\{F68A01A5-FADA-4DCE-AFB3-B7627CFC6291}
2011-09-28 13:51:13 ——– d—–w- c:\users\andrea\appdata\local\{642F2B76-0A22-4817-9C7B-21C9499EECF3}
2011-09-28 12:43:33 ——– d—–w- c:\users\andrea\appdata\local\{AC5681DC-9AE8-47ED-829D-31C62FE132F0}
2011-09-27 23:57:38 ——– d—–w- c:\users\andrea\appdata\local\{0298F06B-08E7-48AE-912C-535267B07C5C}
2011-09-27 23:57:16 ——– d—–w- c:\users\andrea\appdata\local\{36153293-A395-4404-B8B6-E1B78AA131FC}
2011-09-27 21:54:08 ——– d—–w- c:\users\andrea\appdata\local\{AF93A72B-7C0C-4397-8435-26DB6427D6D0}
2011-09-27 09:31:20 ——– d—–w- c:\users\andrea\appdata\local\{40A0F5BC-6E7E-4021-82E4-BD9B112EBD25}
2011-09-27 09:30:58 ——– d—–w- c:\users\andrea\appdata\local\{07AB4ADF-440E-4CAA-B0D6-2C6DFFCA00DE}
2011-09-27 07:16:58 ——– d—–w- c:\users\andrea\appdata\local\{A9EBC93A-35A5-4AAB-90C7-EB929705529E}
2011-09-27 07:08:55 ——– d—–w- c:\users\andrea\appdata\local\{55A3F524-B81E-499E-84B3-0D4B960B9E5E}
2011-09-26 23:47:45 ——– d—–w- c:\users\andrea\appdata\local\{C7BF5F90-C3C2-4FAF-AC00-A4C9D3F6A05E}
2011-09-26 18:12:02 ——– d—–w- c:\program files\WinTips, Inc
2011-09-26 10:10:09 ——– d—–w- c:\users\andrea\appdata\local\{1F8DCDA8-4B95-4C54-9B31-C995C99EC11F}
2011-09-26 10:09:47 ——– d—–w- c:\users\andrea\appdata\local\{174E271C-4593-4A73-9C4B-796FAC350010}
2011-09-25 21:59:21 ——– d—–w- c:\users\andrea\appdata\local\{F7127F57-37E1-4085-AE05-F8A30EB83919}
2011-09-25 21:58:58 ——– d—–w- c:\users\andrea\appdata\local\{1D1F8198-FE30-40E8-96A9-2B1AFC7CB87E}
2011-09-25 09:06:08 ——– d—–w- c:\users\andrea\appdata\local\{68E1F379-F325-400C-8A96-2E9E31BC704D}
2011-09-25 09:05:46 ——– d—–w- c:\users\andrea\appdata\local\{E7F5DC37-31DD-41F4-9D1C-E26BBDA3614B}
2011-09-25 07:41:12 ——– d—–w- c:\users\andrea\appdata\local\{F388D32A-A69E-4DED-A910-156005189CE5}
2011-09-24 13:14:54 ——– d—–w- c:\users\andrea\appdata\local\{4E8985E8-9003-4663-A323-38DABD889CB9}
2011-09-24 13:14:32 ——– d—–w- c:\users\andrea\appdata\local\{1C2BFFEF-9766-44BA-9A66-0A043B37D0A9}
2011-09-23 10:51:45 ——– d—–w- c:\users\andrea\appdata\local\{C9E11933-F1DC-4540-B53A-E0DB00BD20F1}
2011-09-23 10:51:23 ——– d—–w- c:\users\andrea\appdata\local\{0F59940E-2411-4B08-BC69-A29D5B22639C}
2011-09-23 00:10:13 ——– d—–w- c:\users\andrea\appdata\local\{79C009A9-B609-4D5A-856D-8389B3597881}
2011-09-22 16:19:11 ——– d—–w- c:\users\andrea\appdata\local\Taggtool
2011-09-22 14:44:02 ——– d—–w- c:\program files\DVDVideoSoft
.
==================== Find3M ====================
.
2011-10-19 07:55:21 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-31 16:00:50 22216 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-08-04 14:50:03 114 —-a-w- c:\windows\Printdir.bat
.
============= FINISH: 15:19:00.72 ===============

Attach.txt

Hope I have done this properly.
hedley