Fan is constantly on with high CPU usage

My Acer Aspire 5739 has been running very hot with high cpu usage and the fan is constantly running (Even when idle). I've played with the startup, run multiple scans (Advanced SystemCare, MSE, Malwarebytes) and found nothing. The "NT Kernel & System" seems to be taking up a lot of CPU time, and I'm getting frustrated. The computer also freezes multiple times per week, and then after it freezes, the fan keeps going and the computer still runs very warm. Thank you for taking the time to do this.

HIJACKTHIS Log:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:09:37 PM, on 11/1/2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Matt\AppData\Local\Richard_Z.H._Wang\FluffyApp\FluffyApp.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Origin\Origin.exe
C:\Program Files (x86)\Trillian\trillian.exe
C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Hotspot Shield\bin\openvpntray.exe
C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Matt\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Matt\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…33z196t48n4u246
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…33z196t48n4u246
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…33z196t48n4u246
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8118
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;127.0.0.1;*.local;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Gamingheavensdotcom Toolbar - {54bc2a5d-cd66-42d8-988a-fab4bd4bcfd9} - C:\Program Files (x86)\Gamingheavensdotcom\tbGami.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll
O3 - Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - (no file)
O3 - Toolbar: Gamingheavensdotcom Toolbar - {54bc2a5d-cd66-42d8-988a-fab4bd4bcfd9} - C:\Program Files (x86)\Gamingheavensdotcom\tbGami.dll
O3 - Toolbar: @C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKCU\..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [38328050E8A58DA138857FE54AF6A87CC306830A._service_run] "C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe" –type=service
O4 - HKCU\..\Run: [Uploadinator] "C:\Users\Matt\AppData\Local\Richard_Z.H._Wang\FluffyApp\FluffyApp.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [Google Update] "C:\Users\Matt\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [EADM] "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart
O4 - Startup: AutorunsDisabled
O4 - Startup: Trillian.lnk = C:\Program Files (x86)\Trillian\trillian.exe

DDS.txt: . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26 Run by [removed] at 18:56:54 on 2011-11-02 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4061.1158 [GMT -4:00] . AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: IObit Security 360 *Disabled/Updated* {FAE2835A-B90A-9E7A-85DA-82DBDA7C1E3A} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k RPCSS c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\SysWOW64\svchost.exe -k Akamai C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files (x86)\Bonjour\mDNSResponder.exe C:\Prey\platform\windows\cronsvc.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe C:\Windows\system32\imdsksvc.exe C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe C:\Windows\SysWOW64\PnkBstrA.exe C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe C:\Windows\system32\nvvsvc.exe C:\Program Files\Common Files\SPBA\upeksvr.exe C:\Program Files (x86)\Acer Bio Protection\CompPtcVUI.exe C:\Windows\system32\taskhost.exe C:\Program Files (x86)\Google\Update\1.3.21.79\GoogleCrashHandler.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Program Files\Logitech\SetPointP\SetPoint.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe C:\Program Files\NVIDIA Corporation\Display\nvtray.exe C:\Program Files (x86)\Steam\Steam.exe C:\Program Files (x86)\Origin\Origin.exe C:\Program Files (x86)\Trillian\trillian.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files (x86)\Hotspot Shield\bin\openvpntray.exe C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe C:\Users\Matt\AppData\Roaming\Spotify\Spotify.exe C:\Program Files (x86)\Common Files\Steam\SteamService.exe C:\Windows\system32\wuauclt.exe C:\Program Files\TortoiseSVN\bin\TSVNCache.exe C:\Program Files (x86)\Android\android-sdk\platform-tools\adb.exe C:\Users\Matt\AppData\Local\Richard_Z.H._Wang\FluffyApp\FluffyApp.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\system32\DllHost.exe C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\SysWOW64\rundll32.exe C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Matt\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5739g&r=27360110x116l0333z196t48n4u246 uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5739g&r=27360110x116l0333z196t48n4u246 mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5739g&r=27360110x116l0333z196t48n4u246 mURLSearchHooks: Gamingheavensdotcom Toolbar: {54bc2a5d-cd66-42d8-988a-fab4bd4bcfd9} - C:\Program Files (x86)\Gamingheavensdotcom\tbGami.dll mWinlogon: Userinit=userinit.exe BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Gamingheavensdotcom Toolbar: {54bc2a5d-cd66-42d8-988a-fab4bd4bcfd9} - C:\Program Files (x86)\Gamingheavensdotcom\tbGami.dll BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: Hotspot Shield Class: {f9e4a054-e9b1-4bc3-83a3-76a1ae736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll TB: {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No File TB: Gamingheavensdotcom Toolbar: {54bc2a5d-cd66-42d8-988a-fab4bd4bcfd9} - C:\Program Files (x86)\Gamingheavensdotcom\tbGami.dll TB: @C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll uRun: [Sidebar] C:\Program Files (x86)\Windows Sidebar\sidebar.exe /autoRun uRun: [38328050E8A58DA138857FE54AF6A87CC306830A._service_run] "C:\Users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe" –type=service uRun: [Uploadinator] "C:\Users\Matt\AppData\Local\Richard_Z.H._Wang\FluffyApp\FluffyApp.exe" uRun: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent uRun: [Google Update] "C:\Users\Matt\AppData\Local\Google\Update\GoogleUpdate.exe" /c uRun: [EADM] "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart StartupFolder: C:\Users\Matt\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Trillian.lnk - C:\Program Files (x86)\Trillian\trillian.exe StartupFolder: C:\Users\Matt\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\AUTORU~1\EVERNO~1.LNK - C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) mPolicies-system: DisableCAD = 1 (0x1) IE: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204 IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 IE: Google Sidewiki… - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html IE: {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files (x86)\Acer Bio Protection\PwdBank.exe IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab TCP: DhcpNameServer = 208.67.222.222 208.67.220.220 [removed] TCP: Interfaces\{AAF3B208-519F-47B9-B750-E64A649F5621} : DhcpNameServer = 208.67.222.222 208.67.220.220 [removed] TCP: Interfaces\{AAF3B208-519F-47B9-B750-E64A649F5621}\143636563737131343 : DhcpNameServer = 10.0.1.1 TCP: Interfaces\{AAF3B208-519F-47B9-B750-E64A649F5621}\2456C6B696E6F5562326361616 : NameServer = 8.8.8.8,8.8.4.4 TCP: Interfaces\{AAF3B208-519F-47B9-B750-E64A649F5621}\2456C6B696E6F5562326361616 : DhcpNameServer = 192.168.2.1 TCP: Interfaces\{AAF3B208-519F-47B9-B750-E64A649F5621}\3434 : DhcpNameServer = 192.168.0.22 192.168.0.32 TCP: Interfaces\{AAF3B208-519F-47B9-B750-E64A649F5621}\3434D23547574656E647 : DhcpNameServer = 192.168.0.22 192.168.0.32 TCP: Interfaces\{AAF3B208-519F-47B9-B750-E64A649F5621}\3434D27457563747 : NameServer = 8.8.8.8,8.8.4.4 TCP: Interfaces\{AAF3B208-519F-47B9-B750-E64A649F5621}\3434D27457563747 : DhcpNameServer = 192.168.0.22 192.168.0.32 TCP: Interfaces\{F456ED00-A404-4E88-AB95-1F312DD60582} : NameServer = 10.1.40.1 Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll LSA: Notification Packages = C:\Program Files (x86)\Acer Bio Protection\PwdFilterV64 BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: Gamingheavensdotcom Toolbar: {54bc2a5d-cd66-42d8-988a-fab4bd4bcfd9} - C:\Program Files (x86)\Gamingheavensdotcom\tbGami.dll BHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll BHO-X64: Search Helper - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO-X64: SkypeIEPluginBHO - No File BHO-X64: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO-X64: Hotspot Shield Class: {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll TB-X64: {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No File TB-X64: Gamingheavensdotcom Toolbar: {54bc2a5d-cd66-42d8-988a-fab4bd4bcfd9} - C:\Program Files (x86)\Gamingheavensdotcom\tbGami.dll TB-X64: @C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll IE-X64: {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files (x86)\Acer Bio Protection\PwdBank.exe IE-X64: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204 . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\6xi4wfiw.Beta\ FF - prefs.js: browser.startup.homepage - hxxps://reader.google.com/ FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=382950&p= FF - prefs.js: network.proxy.type - 0 FF - component: C:\Users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\6xi4wfiw.Beta\extensions\[removed]\platform\WINNT_x86-msvc\components\mozpopen.dll FF - plugin: C:\Program Files (x86)\eMusic Download Manager\plugin\npemusic.dll FF - plugin: C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll FF - plugin: C:\Users\Matt\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: C:\Users\Matt\AppData\Local\HuluDesktop\instances\0.9.14.1\nphdplg.dll FF - plugin: C:\Users\Matt\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll FF - plugin: C:\Users\Matt\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll FF - plugin: C:\Windows\system32\Macromed\Flash\NPSWF64_11_0_1.dll . —- FIREFOX POLICIES —- FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 . ============= SERVICES / DRIVERS =============== . R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys –> C:\Windows\system32\DRIVERS\MpFilter.sys [?] R1 mwlPSDFilter;mwlPSDFilter;C:\Windows\system32\DRIVERS\mwlPSDFilter.sys –> C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [?] R1 mwlPSDNServ;mwlPSDNServ;C:\Windows\system32\DRIVERS\mwlPSDNServ.sys –> C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [?] R1 mwlPSDVDisk;mwlPSDVDisk;C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys –> C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [?] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys –> C:\Windows\system32\DRIVERS\vwififlt.sys [?] R2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe -k Akamai [2009-7-13 20992] R2 CronService;Cron Service for Prey;C:\Prey\platform\windows\cronsvc.exe [2010-9-29 18432] R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-8-15 2329480] R2 hshld;Hotspot Shield Service;C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe [2011-10-5 288088] R2 HssWd;Hotspot Shield Monitoring Service;C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe -product HSS –> C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe -product HSS [?] R2 ImDskSvc;ImDisk Virtual Disk Driver Helper;C:\Windows\system32\imdsksvc.exe –> C:\Windows\system32\imdsksvc.exe [?] R2 MWLService;MyWinLocker Service;C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe [2009-8-6 311592] R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-25 2253120] R3 connctfyMP;connctfyMP;C:\Windows\system32\DRIVERS\connctfy.sys –> C:\Windows\system32\DRIVERS\connctfy.sys [?] R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\system32\DRIVERS\L1C62x64.sys –> C:\Windows\system32\DRIVERS\L1C62x64.sys [?] R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;C:\Windows\system32\DRIVERS\LEqdUsb.Sys –> C:\Windows\system32\DRIVERS\LEqdUsb.Sys [?] R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;C:\Windows\system32\DRIVERS\LHidEqd.Sys –> C:\Windows\system32\DRIVERS\LHidEqd.Sys [?] R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\system32\DRIVERS\NETwNs64.sys –> C:\Windows\system32\DRIVERS\NETwNs64.sys [?] R3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys –> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?] R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272] R3 nuvotoncir;Nuvoton IR Transceiver;C:\Windows\system32\DRIVERS\nuvotoncir.sys –> C:\Windows\system32\DRIVERS\nuvotoncir.sys [?] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys –> C:\Windows\system32\drivers\nvhda64v.sys [?] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys –> C:\Windows\system32\DRIVERS\vwifimp.sys [?] R3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys –> C:\Windows\system32\DRIVERS\WSDPrint.sys [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-2-9 135664] S3 AWEAlloc;AWE Memory Allocation Driver;C:\Windows\system32\DRIVERS\awealloc.sys –> C:\Windows\system32\DRIVERS\awealloc.sys [?] S3 connctfy;Connectify Service;C:\Windows\system32\DRIVERS\connctfy.sys –> C:\Windows\system32\DRIVERS\connctfy.sys [?] S3 easytether;easytether;C:\Windows\system32\DRIVERS\easytthr.sys –> C:\Windows\system32\DRIVERS\easytthr.sys [?] S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys –> C:\Windows\system32\DRIVERS\fssfltr.sys [?] S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-2-9 135664] S3 htcusbnet;HTC USB-NDIS miniport;C:\Windows\system32\DRIVERS\htcusbnet.sys –> C:\Windows\system32\DRIVERS\htcusbnet.sys [?] S3 ImDisk;ImDisk Virtual Disk Driver;C:\Windows\system32\DRIVERS\imdisk.sys –> C:\Windows\system32\DRIVERS\imdisk.sys [?] S3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys –> C:\Windows\system32\DRIVERS\MpNWMon.sys [?] S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\system32\DRIVERS\NETw5s64.sys –> C:\Windows\system32\DRIVERS\NETw5s64.sys [?] S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys –> C:\Windows\system32\DRIVERS\netw5v64.sys [?] S3 npggsvc;nProtect GameGuard Service;C:\Windows\system32\GameMon.des -service –> C:\Windows\system32\GameMon.des -service [?] S3 PSI;PSI;C:\Windows\system32\DRIVERS\psi_mf.sys –> C:\Windows\system32\DRIVERS\psi_mf.sys [?] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys –> C:\Windows\system32\Drivers\RtsUStor.sys [?] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys –> C:\Windows\system32\drivers\tsusbflt.sys [?] S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys –> C:\Windows\system32\Drivers\usbaapl64.sys [?] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?] S4 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952] S4 AdvancedSystemCareService;Advanced SystemCare Service;C:\Program Files (x86)\IObit\Advanced SystemCare 4\ASCService.exe [2011-10-3 328536] S4 Connectify;Connectify;C:\Program Files (x86)\Connectify\Connectifyd.exe [2011-3-9 892992] S4 ePowerSvc;Acer ePower Service;C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2009-8-22 796192] S4 Greg_Service;GRegService;C:\Program Files (x86)\Acer\Registration\GregHSRW.exe [2009-6-4 1150496] S4 IGBASVC;EgisTec Service;C:\Program Files (x86)\Acer Bio Protection\BASVC.exe [2009-8-5 3453440] S4 IS360service;IS360service;C:\Program Files (x86)\IObit\IObit Security 360\is360srv.exe [2011-1-8 312152] S4 NTI IScheduleSvc;NTI IScheduleSvc;C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-8-20 62720] S4 NTIBackupSvc;NTI Backup Now 5 Backup Service;C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-6-17 50432] S4 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-6-17 144640] S4 RelevantKnowledge;RelevantKnowledge;C:\Program Files (x86)\RelevantKnowledge\rlservice.exe /service –> C:\Program Files (x86)\RelevantKnowledge\rlservice.exe [?] S4 RS_Service;Raw Socket Service;C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [2009-8-22 253952] S4 ScrybeUpdater;Scrybe Updater;C:\Program Files (x86)\Scrybe\Service\ScrybeUpdater.exe [2010-3-4 1300992] S4 Secunia PSI Agent;Secunia PSI Agent;C:\Program Files (x86)\Secunia\PSI\psia.exe [2010-12-21 987704] S4 Secunia Update Agent;Secunia Update Agent;C:\Program Files (x86)\Secunia\PSI\sua.exe [2010-12-21 399416] S4 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096] S4 TeamViewer5;TeamViewer 5;C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe [2010-7-6 173352] S4 Updater Service;Updater Service;C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2009-8-22 240160] S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184] . =============== Created Last 30 ================ . 2011-11-02 22:56:51 607260 ——r- C:\Users\Matt\dds.scr 2011-11-02 10:26:56 69000 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4792AAD3-AEAA-4C65-9783-B654BA528FBA}\offreg.dll 2011-11-02 10:26:53 8570192 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4792AAD3-AEAA-4C65-9783-B654BA528FBA}\mpengine.dll 2011-11-02 00:41:06 302592 —-a-w- C:\Users\Matt\gmer.exe 2011-11-02 00:39:35 ——– d—–w- C:\Users\Matt\backups 2011-11-01 21:09:28 388096 —-a-w- C:\Users\Matt\HiJackThis.exe 2011-11-01 20:49:59 388096 —-a-r- C:\Users\Matt\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2011-11-01 20:49:58 ——– d—–w- C:\Program Files (x86)\Trend Micro 2011-10-29 22:49:55 ——– d—–w- C:\Program Files (x86)\Android 2011-10-28 10:27:53 3138048 —-a-w- C:\Windows\System32\win32k.sys 2011-10-28 10:27:43 75776 —-a-w- C:\Windows\SysWow64\psisrndr.ax 2011-10-28 10:27:43 613888 —-a-w- C:\Windows\System32\psisdecd.dll 2011-10-28 10:27:43 465408 —-a-w- C:\Windows\SysWow64\psisdecd.dll 2011-10-28 10:27:43 108032 —-a-w- C:\Windows\System32\psisrndr.ax 2011-10-28 10:27:20 861696 —-a-w- C:\Windows\System32\oleaut32.dll 2011-10-28 10:27:20 571904 —-a-w- C:\Windows\SysWow64\oleaut32.dll 2011-10-28 10:27:20 331776 —-a-w- C:\Windows\System32\oleacc.dll 2011-10-28 10:27:20 233472 —-a-w- C:\Windows\SysWow64\oleacc.dll 2011-10-27 00:07:54 ——– d—–w- C:\Users\Matt\AppData\Local\ESN Sonar 2011-10-27 00:05:26 ——– d—–w- C:\ProgramData\EA Core 2011-10-27 00:03:04 ——– d—–w- C:\Program Files (x86)\Battlelog Web Plugins 2011-10-26 17:45:31 ——– d—–w- C:\Users\Matt\.m2 2011-10-26 17:37:59 ——– d—–w- C:\Program Files\NetBeans 7.0.1 2011-10-26 09:36:59 ——– d–h–w- C:\Program Files (x86)\Common Files\EAInstaller 2011-10-26 01:26:48 ——– d—–w- C:\Program Files (x86)\NVIDIA Corporation 2011-10-26 01:26:13 837952 —-a-w- C:\Windows\System32\easyupdatusapiu64.dll 2011-10-26 01:26:13 539456 —-a-w- C:\Windows\System32\nvhotkey.dll 2011-10-26 01:26:13 5067584 —-a-w- C:\Windows\System32\nvsvc64.dll 2011-10-26 01:26:13 3074368 —-a-w- C:\Windows\System32\nvsvcr.dll 2011-10-26 01:26:13 222528 —-a-w- C:\Windows\System32\nvmctray.dll 2011-10-26 01:26:13 1640768 —-a-w- C:\Windows\System32\nvvsvc.exe 2011-10-26 01:26:13 137536 —-a-w- C:\Windows\System32\nvshext.dll 2011-10-26 01:26:13 10406208 —-a-w- C:\Windows\System32\nvcpl.dll 2011-10-26 01:25:51 ——– d—–w- C:\ProgramData\NVIDIA Corporation 2011-10-25 01:16:41 ——– d—–w- C:\Users\Matt\AppData\Roaming\Origin 2011-10-25 01:16:37 ——– d—–w- C:\Users\Matt\AppData\Local\Origin 2011-10-25 01:16:12 ——– d—–w- C:\ProgramData\Origin 2011-10-25 01:16:11 ——– d—–w- C:\ProgramData\Electronic Arts 2011-10-25 01:16:11 ——– d—–w- C:\Program Files (x86)\Origin Games 2011-10-25 01:15:51 ——– d—–w- C:\Program Files (x86)\Origin 2011-10-17 22:58:54 ——– d—–w- C:\cygwin 2011-10-11 12:51:25 571208 —-a-w- C:\Program Files (x86)\Mozilla Firefox\extensions\[removed]\components\afurladvisor70.dll 2011-10-11 12:51:25 571208 —-a-w- C:\Program Files (x86)\Mozilla Firefox\extensions\[removed]\components\afurladvisor60.dll 2011-10-10 23:54:37 917840 ——w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{96FCBE3B-0FC6-4925-BFCE-7558A10B1D0E}\gapaengine.dll 2011-10-10 15:09:40 4550304 —-a-w- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll 2011-10-09 12:44:53 ——– d—–w- C:\Program Files (x86)\VirtualDJ 2011-10-06 22:00:13 ——– d—–w- C:\Users\Matt\AppData\Local\FLVService 2011-10-06 22:00:02 ——– d—–w- C:\Program Files (x86)\Freecorder 2011-10-06 20:57:44 98360 —-atw- C:\Users\Matt\AppData\Roaming\Microsoft\~DFK5d0ffef.tmp 2011-10-06 20:57:44 26200 —-atw- C:\Users\Matt\AppData\Roaming\Microsoft\qwadjb.dll 2011-10-06 20:57:44 18724 —-atw- C:\Users\Matt\AppData\Roaming\Microsoft\bass.dll 2011-10-06 20:57:44 16952 —-atw- C:\Users\Matt\AppData\Roaming\Microsoft\1eaadjc.dll 2011-10-06 20:57:44 15416 —-atw- C:\Users\Matt\AppData\Roaming\Microsoft\rsaadjd.dll 2011-10-06 20:57:44 14392 —-atw- C:\Users\Matt\AppData\Roaming\Microsoft\kfgresk.dll 2011-10-06 20:57:44 13984 —-atw- C:\Users\Matt\AppData\Roaming\Microsoft\mjcriu.dll 2011-10-06 20:57:44 10808 —-atw- C:\Users\Matt\AppData\Roaming\Microsoft\peaadje.dll 2011-10-06 20:55:18 ——– d—–w- C:\Program Files (x86)\MP3 My MP3 3.1 2011-10-06 20:34:16 ——– d—–w- C:\Program Files (x86)\Jack v1.9.7 . ==================== Find3M ==================== . 2011-11-02 22:40:47 29 —-a-w- C:\Windows\SysWow64\TempWmicBatchFile.bat 2011-10-30 00:08:10 280904 —-a-w- C:\Windows\SysWow64\PnkBstrB.xtr 2011-10-30 00:08:10 280904 —-a-w- C:\Windows\SysWow64\PnkBstrB.exe 2011-10-28 10:34:16 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2011-10-28 10:34:16 2382848 —-a-w- C:\Windows\System32\mshtml.tlb 2011-10-28 10:34:15 2309120 —-a-w- C:\Windows\System32\jscript9.dll 2011-10-28 10:34:15 1798144 —-a-w- C:\Windows\SysWow64\jscript9.dll 2011-10-28 10:34:15 1389056 —-a-w- C:\Windows\System32\wininet.dll 2011-10-28 10:34:15 1126912 —-a-w- C:\Windows\SysWow64\wininet.dll 2011-10-27 01:21:37 280904 —-a-w- C:\Windows\SysWow64\PnkBstrB.ex0 2011-10-26 09:36:41 75136 —-a-w- C:\Windows\SysWow64\PnkBstrA.exe 2011-10-25 10:34:46 414368 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2011-08-31 21:00:50 25416 —-a-w- C:\Windows\System32\drivers\mbam.sys . ============= FINISH: 18:59:03.57 =============== Attach.txt: . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume3 Install Date: 1/12/2010 6:50:07 PM System Uptime: 11/2/2011 3:26:11 PM (3 hours ago) . Motherboard: Acer | | JM50-MV Processor: Intel® Core™2 Duo CPU T6600 @ 2.20GHz | U2E1 | 2200/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 282 GiB total, 48.546 GiB free. E: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: VirtualBox Host-Only Ethernet Adapter Device ID: ROOT\NET\0001 Manufacturer: Oracle Corporation Name: VirtualBox Host-Only Ethernet Adapter PNP Device ID: ROOT\NET\0001 Service: VBoxNetAdp . ==== System Restore Points =================== . RP315: 10/18/2011 6:24:22 AM - Windows Update RP316: 10/22/2011 4:05:02 PM - Windows Update RP317: 10/25/2011 9:08:13 PM - Removed NVIDIA 3D Vision Controller Driver RP318: 10/26/2011 5:34:23 AM - Installed DirectX RP319: 10/26/2011 1:20:33 PM - Windows Update RP320: 10/28/2011 6:26:33 AM - Windows Modules Installer RP321: 10/30/2011 6:37:50 PM - Windows Update RP322: 11/1/2011 4:47:28 PM - Installed HiJackThis . ==== Installed Programs ====================== . . Update for Microsoft Office 2007 (KB2508958) µTorrent 2007 Microsoft Office Suite Service Pack 2 (SP2) Acer Arcade Instant On Acer Assist Acer Backup Manager Acer Bio Protection Acer Crystal Eye webcam Ver:1.1.103.803 Acer eRecovery Management Acer Games Acer GridVista Acer PowerSmart Manager Acer Registration Acer ScreenSaver Acer Updater Acer VCM Acrobat.com Adobe AIR Adobe Community Help Adobe Flash Media Live Encoder 3.2 Adobe Flash Player 10 ActiveX Adobe Media Player Adobe Photoshop CS5 Adobe Reader X (10.1.1) Adobe Shockwave Player 11.5 Advanced SystemCare 4 Akamai NetSession Interface Alpha Protocol Amazon Kindle Amazon MP3 Downloader 1.0.10 Amazon MP3 Uploader Amazon Unbox Video Android SDK Tools Apple Application Support Apple Software Update Aptana Studio 3 Artist's Sketchbook 1.65 Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver Audacity 1.2.6 Audiosurf Aurora 7.0a2 (x86 en-US) Backup Manager Basic Bandisoft MPEG-1 Decoder Battlefield 3™ Battlefield: Bad Company 2 Battlelog Web Plugins Bing Bar Bing Bar Platform Borderlands Boxee Call of Duty Black Ops - Remote Console Call of Duty: Black Ops Call of Duty: Black Ops - Multiplayer Call of Duty: Modern Warfare 2 Call of Duty: Modern Warfare 2 - Multiplayer CamStudio Choice Guard Cisco Connect Civilization III Complete Edition ColorSchemer Studio 2 Combat Arms Compatibility Pack for the 2007 Office system ConvertHelper 2.2 D3DX10 Day of Defeat: Source Dexpot DrayTek Router Tools V4.2.1 Dropbox DVD Flick 1.3.0.7 eBay Worldwide eMusic Download Manager 4.1.4 eReg ESN Sonar eSobi v2 Evernote v. 4.5.1 F.lux Façade FileZilla Client 3.4.0 Fingerprint Solution FluffyApp foobar2000 v1.1.5 Foreman version 0.1.0 Fraps FreeApps Freecorder 5 FX Chem 2.000 Game Booster Gamingheavensdotcom Toolbar Garry's Mod GIMP 2.6.10 Git version 1.7.6-preview20110708 Google Apps Google Chrome Google Earth Google SketchUp 7 Google Talk (remove only) Google Talk Plugin Google Toolbar for Internet Explorer Google Update Helper Google Voice Half-Life 2 Heroku version 2.8.4 HiJackThis Hotspot Shield 2.09 HP Officejet Pro 8500 A910 Help Hulu Desktop Identity Card ImgBurn Inkscape 0.47 Intel AppUp(SM) center IObit Security 360 Jack v1.9.7 Java Auto Updater Java™ 6 Update 26 Java™ SE Development Kit 6 Update 18 Jing Junk Mail filter update KeePass Password Safe 2.15 Killing Floor LAME v3.98.2 for Audacity Last.fm 1.5.4.27091 Launch Manager Left 4 Dead 2 LibreOffice 3.3 Livestream Procaster LogMeIn Hamachi Magicka Malwarebytes' Anti-Malware version 1.51.2.1300 Microsoft Office Excel MUI (English) 2007 Microsoft Office Home and Student 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office PowerPoint Viewer 2007 (English) Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Suite Activation Assistant Microsoft Office Word MUI (English) 2007 Microsoft Search Enhancement Pack Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 Microsoft Works Microsoft XNA Framework Redistributable 3.1 Microsoft XNA Framework Redistributable 4.0 Microsoft_VC80_ATL_x86 Microsoft_VC80_CRT_x86 Microsoft_VC80_MFC_x86 Microsoft_VC80_MFCLOC_x86 Microsoft_VC90_ATL_x86 Microsoft_VC90_CRT_x86 Microsoft_VC90_MFC_x86 mIRC Miro Video Converter Mozilla Firefox 6.0 (x86 en-US) Mozilla Thunderbird (6.0) MP3 Skype Recorder MP3MyMP3 3.1 MSVCRT MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Mumble 1.2.3 Music Manager MyWinLocker NetBeans IDE 6.8 Norton Online Backup Notepad++ NTI Backup Now 5 NTI Backup Now Standard NTI Media Maker 8 Nuvoton CIR Device Driver NVIDIA PhysX Opera 10.62 Origin Pando Media Booster PDF Settings CS5 Peggle Extreme Plain Sight Pokemon Online 1.0.00 Polipo [removed] Portal 2 Portal: The First Slice Privoxy (remove only) Project64 1.6 PunkBuster Services Python 2.6 pycairo-1.8.6 Python 2.6 pygobject-2.20.0 Python 2.6 pygtk-2.16.0 Python 2.6.5 Quake Live Mozilla Plugin QuickTime Real Desktop 1.57 Standard Realtek High Definition Audio Driver Realtek USB 2.0 Card Reader Revo Uninstaller 1.92 RollerCoaster Tycoon 3 Ruby 1.9.2-p290 Safari Secunia PSI (2.0.0.1003) Security Update for 2007 Microsoft Office System (KB2288621) Security Update for 2007 Microsoft Office System (KB2288931) Security Update for 2007 Microsoft Office System (KB2345043) Security Update for 2007 Microsoft Office System (KB2553074) Security Update for 2007 Microsoft Office System (KB2553089) Security Update for 2007 Microsoft Office System (KB2553090) Security Update for 2007 Microsoft Office System (KB2584063) Security Update for 2007 Microsoft Office System (KB969559) Security Update for 2007 Microsoft Office System (KB976321) Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Extended (KB2416472) Security Update for Microsoft .NET Framework 4 Extended (KB2487367) Security Update for Microsoft Office Excel 2007 (KB2553073) Security Update for Microsoft Office InfoPath 2007 (KB979441) Security Update for Microsoft Office PowerPoint 2007 (KB2535818) Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623) Security Update for Microsoft Office system 2007 (972581) Security Update for Microsoft Office system 2007 (KB974234) Security Update for Microsoft Office Visio Viewer 2007 (KB973709) Security Update for Microsoft Office Word 2007 (KB2344993) SHOUTcast Source DSP 1.9.1 (remove only) Sid Meier's Civilization IV Sid Meier's Civilization IV: Beyond the Sword Sid Meier's Civilization IV: Colonization Sid Meier's Civilization IV: Warlords SimCity 3000 SimTheme Park Skype Click to Call Skype™ 5.5 Smart Defrag Songbird 1.9.3 (Build 1959) Sony Vegas Pro 8.0 Spacewar Speccy SpeedFan (remove only) SplitMediaLabs VH Screen Capture Driver (x86) Spotify Spotify DJ Startup Delayer v3.0 (build 307) Steam Sun GlassFish Enterprise Server v3 Super Meat Boy Synaptics Gesture Suite Featuring Scrybe Synergy System Requirements Lab Team Fortress 2 TeamViewer 5 Terraria TextFieldDemo TI Connect 1.6 Titanium Developer Tor 0.2.1.30 Trillian TweetDeck Update for 2007 Microsoft Office System (KB2284654) Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2473228) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Extended (KB2468871) Update for Microsoft .NET Framework 4 Extended (KB2533523) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 System (KB2539530) Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office OneNote 2007 (KB980729) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 (KB974631) Update for Microsoft Office Word 2007 Help (KB963665) Vidalia 0.2.10 VirtualDJ Home FREE Visual C++ 8.0 Runtime Setup Package (x64) VLC media player 1.1.4 Welcome Center Winamp Winamp Detector Plug-in Winamp Remote WinDirStat 1.1.2 Windows Live Communications Platform Windows Live Installer Windows Live Mail Windows Live Photo Gallery Windows Live SOXE Definitions Windows Live Sync Windows Live Upload Tool Windows Live UX Platform Windows Live Writer Windows Media Player Firefox Plugin WinPcap 4.1.2 WModem Driver Installer Xvid Video Codec . ==== Event Viewer Messages From Past Week ======== . 11/2/2011 8:01:58 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 11/2/2011 8:01:51 AM, Error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{AAF3B208-519F-47B9-B750-E64A649F5621} because another computer on the network has the same name. The server could not start. 11/2/2011 8:01:51 AM, Error: NetBT [4321] - The name "MATT-PC :20" could not be registered on the interface with IP address 192.168.101.12. The computer with the IP address 192.168.0.22 did not allow the name to be claimed by this computer. 11/2/2011 8:01:35 AM, Error: NetBT [4321] - The name "MATT-PC :0" could not be registered on the interface with IP address 192.168.101.12. The computer with the IP address 192.168.0.22 did not allow the name to be claimed by this computer. 11/2/2011 6:19:19 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the IPBusEnum service. 11/2/2011 6:15:56 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 11/2/2011 10:32:33 AM, Error: Service Control Manager [7022] - The Windows Update service hung on starting. 11/2/2011 10:31:16 AM, Error: NetBT [4319] - A duplicate name has been detected on the TCP network. The IP address of the computer that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state. 11/2/2011 10:17:23 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service. 11/2/2011 10:12:21 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. 11/2/2011 10:10:48 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 11/2/2011 10:09:57 AM, Error: volmgr [46] - Crash dump initialization failed! 11/1/2011 8:52:57 AM, Error: NetBT [4321] - The name "MATT-PC :0" could not be registered on the interface with IP address 192.168.101.90. The computer with the IP address 192.168.0.22 did not allow the name to be claimed by this computer. 11/1/2011 8:52:53 AM, Error: NetBT [4321] - The name "MATT-PC :20" could not be registered on the interface with IP address 192.168.101.90. The computer with the IP address 192.168.0.22 did not allow the name to be claimed by this computer. 11/1/2011 4:43:37 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect. 11/1/2011 4:43:37 PM, Error: Service Control Manager [7000] - The Steam Client Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 11/1/2011 4:39:45 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 11/1/2011 4:29:36 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 11/1/2011 2:14:42 AM, Error: ACPI [13] - : The embedded controller (EC) did not respond within the specified timeout period. This may indicate that there is an error in the EC hardware or firmware or that the BIOS is accessing the EC incorrectly. You should check with your computer manufacturer for an upgraded BIOS. In some situations, this error may cause the computer to function incorrectly. 10/31/2011 9:27:38 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer DUCK that believes that it is the master browser for the domain on transport NetBT_Tcpip_{AAF3B208-519F-47B9-B750-E64A649F5621}. The master browser is stopping or an election is being forced. 10/31/2011 10:32:50 AM, Error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{F456ED00-A404-4E88-AB95-1F312DD60582} because another computer on the network has the same name. The server could not start. 10/31/2011 1:25:20 PM, Error: NetBT [4321] - The name "MATT-PC :0" could not be registered on the interface with IP address 192.168.100.204. The computer with the IP address 192.168.0.22 did not allow the name to be claimed by this computer. 10/31/2011 1:25:17 PM, Error: NetBT [4321] - The name "MATT-PC :20" could not be registered on the interface with IP address 192.168.100.204. The computer with the IP address 192.168.0.22 did not allow the name to be claimed by this computer. 10/29/2011 6:31:29 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 10/27/2011 10:23:24 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 10/27/2011 10:15:09 AM, Error: Service Control Manager [7022] - The Network Location Awareness service hung on starting. 10/26/2011 8:12:31 AM, Error: NetBT [4321] - The name "MATT-PC :0" could not be registered on the interface with IP address 192.168.101.176. The computer with the IP address 192.168.0.22 did not allow the name to be claimed by this computer. 10/26/2011 8:12:30 AM, Error: NetBT [4321] - The name "MATT-PC :20" could not be registered on the interface with IP address 192.168.101.176. The computer with the IP address 192.168.0.22 did not allow the name to be claimed by this computer. . ==== End Of File =========================== GMER found nothing.

When I rebooted after running CF, my CPU seemed more stable, until Steam and Origin started up, but I'm assuming that they'll settle down. Anyway, the CF log: The ComboFix log: ComboFix 11-11-03.03 - Matt 11/03/2011 17:07:49.1.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4061.1250 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: IObit Security 360 *Disabled/Updated* {FAE2835A-B90A-9E7A-85DA-82DBDA7C1E3A} SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\Acer Bio Protection\PwdFilterV64.dll c:\programdata\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge c:\programdata\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\About RelevantKnowledge.lnk c:\programdata\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Privacy Policy and User License Agreement.lnk c:\programdata\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Support.lnk c:\users\Matt\AppData\Roaming\Microsoft\~DFK5d0ffef.tmp c:\users\Matt\AppData\Roaming\Microsoft\1eaadjc.dll c:\users\Matt\AppData\Roaming\Microsoft\bass.dll c:\users\Matt\AppData\Roaming\Microsoft\kfgresk.dll c:\users\Matt\AppData\Roaming\Microsoft\mjcriu.dll c:\users\Matt\AppData\Roaming\Microsoft\peaadje.dll c:\users\Matt\AppData\Roaming\Microsoft\qwadjb.dll c:\users\Matt\AppData\Roaming\Microsoft\rsaadjd.dll c:\users\Matt\dds.scr . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . ——-\Service_RelevantKnowledge . . ((((((((((((((((((((((((( Files Created from 2011-10-03 to 2011-11-03 ))))))))))))))))))))))))))))))) . . 2011-11-03 21:38 . 2011-11-03 21:38 69000 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2C713F95-E14C-488C-A191-E6A2F9EBBE65}\offreg.dll 2011-11-03 21:34 . 2011-11-03 21:34 ——– d—–w- c:\users\Guest\AppData\Local\temp 2011-11-03 21:34 . 2011-11-03 21:34 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-11-03 16:44 . 2011-10-07 04:16 8570192 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2C713F95-E14C-488C-A191-E6A2F9EBBE65}\mpengine.dll 2011-11-02 00:41 . 2011-07-17 02:21 302592 —-a-w- c:\users\Matt\gmer.exe 2011-11-02 00:39 . 2011-11-02 00:39 ——– d—–w- c:\users\Matt\backups 2011-11-01 21:09 . 2010-03-25 22:42 388096 —-a-w- c:\users\Matt\HiJackThis.exe 2011-11-01 20:49 . 2011-11-01 20:50 388096 —-a-r- c:\users\Matt\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2011-11-01 20:49 . 2011-11-01 20:49 ——– d—–w- c:\program files (x86)\Trend Micro 2011-10-29 22:49 . 2011-10-29 22:49 ——– d—–w- c:\program files (x86)\Android 2011-10-28 10:27 . 2011-10-28 10:27 3138048 —-a-w- c:\windows\system32\win32k.sys 2011-10-28 10:27 . 2011-10-28 10:27 75776 —-a-w- c:\windows\SysWow64\psisrndr.ax 2011-10-28 10:27 . 2011-10-28 10:27 613888 —-a-w- c:\windows\system32\psisdecd.dll 2011-10-28 10:27 . 2011-10-28 10:27 465408 —-a-w- c:\windows\SysWow64\psisdecd.dll 2011-10-28 10:27 . 2011-10-28 10:27 108032 —-a-w- c:\windows\system32\psisrndr.ax 2011-10-28 10:27 . 2011-10-28 10:27 861696 —-a-w- c:\windows\system32\oleaut32.dll 2011-10-28 10:27 . 2011-10-28 10:27 571904 —-a-w- c:\windows\SysWow64\oleaut32.dll 2011-10-28 10:27 . 2011-10-28 10:27 331776 —-a-w- c:\windows\system32\oleacc.dll 2011-10-28 10:27 . 2011-10-28 10:27 233472 —-a-w- c:\windows\SysWow64\oleacc.dll 2011-10-27 00:07 . 2011-10-27 07:09 ——– d—–w- c:\users\Matt\AppData\Local\ESN Sonar 2011-10-27 00:05 . 2011-10-27 00:05 ——– d—–w- c:\programdata\EA Core 2011-10-27 00:03 . 2011-10-27 00:03 ——– d—–w- c:\program files (x86)\Battlelog Web Plugins 2011-10-26 17:45 . 2011-10-26 17:45 ——– d—–w- c:\users\Matt\.m2 2011-10-26 17:37 . 2011-10-26 17:40 ——– d—–w- c:\program files\NetBeans 7.0.1 2011-10-26 09:36 . 2011-10-26 09:36 ——– d–h–w- c:\program files (x86)\Common Files\EAInstaller 2011-10-26 01:27 . 2011-11-03 17:12 ——– d—–w- c:\users\UpdatusUser 2011-10-26 01:26 . 2011-10-26 01:27 ——– d—–w- c:\program files (x86)\NVIDIA Corporation 2011-10-26 01:26 . 2011-10-15 08:53 837952 —-a-w- c:\windows\system32\easyupdatusapiu64.dll 2011-10-26 01:26 . 2011-10-15 08:53 539456 —-a-w- c:\windows\system32\nvhotkey.dll 2011-10-26 01:26 . 2011-10-15 08:53 5067584 —-a-w- c:\windows\system32\nvsvc64.dll 2011-10-26 01:26 . 2011-10-15 08:53 3074368 —-a-w- c:\windows\system32\nvsvcr.dll 2011-10-26 01:26 . 2011-10-15 08:53 222528 —-a-w- c:\windows\system32\nvmctray.dll 2011-10-26 01:26 . 2011-10-15 08:53 1640768 —-a-w- c:\windows\system32\nvvsvc.exe 2011-10-26 01:26 . 2011-10-15 08:53 137536 —-a-w- c:\windows\system32\nvshext.dll 2011-10-26 01:26 . 2011-10-15 08:53 10406208 —-a-w- c:\windows\system32\nvcpl.dll 2011-10-26 01:25 . 2011-10-26 01:25 ——– d—–w- c:\programdata\NVIDIA Corporation 2011-10-25 01:16 . 2011-10-25 01:21 ——– d—–w- c:\users\Matt\AppData\Roaming\Origin 2011-10-25 01:16 . 2011-10-27 00:05 ——– d—–w- c:\users\Matt\AppData\Local\Origin 2011-10-25 01:16 . 2011-10-25 12:13 ——– d—–w- c:\programdata\Origin 2011-10-25 01:16 . 2011-10-27 00:05 ——– d—–w- c:\programdata\Electronic Arts 2011-10-25 01:16 . 2011-10-25 22:31 ——– d—–w- c:\program files (x86)\Origin Games 2011-10-25 01:15 . 2011-10-25 01:19 ——– d—–w- c:\program files (x86)\Origin 2011-10-17 22:58 . 2011-10-17 23:05 ——– d—–w- C:\cygwin 2011-10-11 12:51 . 2011-10-05 22:43 571208 —-a-w- c:\program files (x86)\Mozilla Firefox\extensions\[removed]\components\afurladvisor70.dll 2011-10-11 12:51 . 2011-10-05 22:43 571208 —-a-w- c:\program files (x86)\Mozilla Firefox\extensions\[removed]\components\afurladvisor60.dll 2011-10-10 23:54 . 2011-10-10 23:54 917840 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{96FCBE3B-0FC6-4925-BFCE-7558A10B1D0E}\gapaengine.dll 2011-10-10 15:09 . 2011-10-10 15:09 4550304 —-a-w- c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll 2011-10-09 12:44 . 2011-10-09 12:44 ——– d—–w- c:\program files (x86)\VirtualDJ 2011-10-06 22:00 . 2011-10-06 22:00 ——– d—–w- c:\users\Matt\AppData\Local\FLVService 2011-10-06 22:00 . 2011-10-06 22:00 ——– d—–w- c:\program files (x86)\Freecorder 2011-10-06 20:55 . 2011-10-10 00:25 ——– d—–w- c:\program files (x86)\MP3 My MP3 3.1 . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-11-03 21:37 . 2010-10-27 11:55 29 —-a-w- c:\windows\SysWow64\TempWmicBatchFile.bat 2011-10-30 00:08 . 2010-04-11 11:48 280904 —-a-w- c:\windows\SysWow64\PnkBstrB.xtr 2011-10-30 00:08 . 2010-04-11 11:38 280904 —-a-w- c:\windows\SysWow64\PnkBstrB.exe 2011-10-27 01:21 . 2010-04-11 11:38 280904 —-a-w- c:\windows\SysWow64\PnkBstrB.ex0 2011-10-26 09:36 . 2010-04-11 11:38 75136 —-a-w- c:\windows\SysWow64\PnkBstrA.exe 2011-10-25 10:34 . 2011-05-15 11:18 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2011-10-07 04:16 . 2011-04-04 00:50 8570192 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2011-08-31 21:00 . 2011-07-19 18:55 25416 —-a-w- c:\windows\system32\drivers\mbam.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{54bc2a5d-cd66-42d8-988a-fab4bd4bcfd9}] 2010-06-13 23:10 2734688 —-a-w- c:\program files (x86)\Gamingheavensdotcom\tbGami.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{54bc2a5d-cd66-42d8-988a-fab4bd4bcfd9}"= "c:\program files (x86)\Gamingheavensdotcom\tbGami.dll" [2010-06-13 2734688] . [HKEY_CLASSES_ROOT\clsid\{54bc2a5d-cd66-42d8-988a-fab4bd4bcfd9}] . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 94208 —-a-w- c:\users\Matt\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 94208 —-a-w- c:\users\Matt\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 94208 —-a-w- c:\users\Matt\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2009-08-06 17:18 120104 —-a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files (x86)\Windows Sidebar\sidebar.exe" [2010-11-20 1174016] "38328050E8A58DA138857FE54AF6A87CC306830A._service_run"="c:\users\Matt\AppData\Local\Google\Chrome\Application\chrome.exe" [2011-11-01 1047096] "Uploadinator"="c:\users\Matt\AppData\Local\Richard_Z.H._Wang\FluffyApp\FluffyApp.exe" [2011-07-09 251392] "Steam"="c:\program files (x86)\Steam\steam.exe" [2011-08-13 1242448] "EADM"="c:\program files (x86)\Origin\Origin.exe" [2011-10-20 28651144] "Dexpot"="c:\program files (x86)\Dexpot\dexpot.exe" [2011-05-29 1290240] "sbitunesagent"="c:\program files (x86)\Songbird\songbirditunesagent.exe" [2011-01-27 266240] "Xvid"="c:\program files (x86)\Xvid\CheckUpdate.exe" [2011-01-17 8192] "MusicManager"="c:\users\Matt\AppData\Local\Programs\Google\MusicManager\MusicManager.exe" [2011-09-14 13128704] . c:\users\Matt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\Matt\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-5-25 24176560] Trillian.lnk - c:\program files (x86)\Trillian\trillian.exe [2011-8-19 2278240] . c:\users\Matt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled EvernoteClipper.lnk - c:\program files (x86)\Evernote\Evernote\EvernoteClipper.exe [2011-9-19 993280] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) "DisableCAD"= 1 (0x1) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-09 135664] R3 AWEAlloc;AWE Memory Allocation Driver;c:\windows\system32\DRIVERS\awealloc.sys [x] R3 connctfy;Connectify Service;c:\windows\system32\DRIVERS\connctfy.sys [x] R3 dump_wmimmc;dump_wmimmc;c:\program files (x86)\steam\steamapps\common\ava\Binaries\GameGuard\dump_wmimmc.sys [x] R3 easytether;easytether;c:\windows\system32\DRIVERS\easytthr.sys [x] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-09 135664] R3 htcusbnet;HTC USB-NDIS miniport;c:\windows\system32\DRIVERS\htcusbnet.sys [x] R3 ImDisk;ImDisk Virtual Disk Driver;c:\windows\system32\DRIVERS\imdisk.sys [x] R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x] R3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x] R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272] R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [x] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x] R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952] R4 Connectify;Connectify;c:\program files (x86)\Connectify\Connectifyd.exe [2011-03-09 892992] R4 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2009-08-19 796192] R4 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-06-04 1150496] R4 IGBASVC;EgisTec Service;c:\program files (x86)\Acer Bio Protection\BASVC.exe [2009-08-05 3453440] R4 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-08-21 62720] R4 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-06-18 50432] R4 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-06-18 144640] R4 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [2009-07-10 253952] R4 ScrybeUpdater;Scrybe Updater;c:\program files (x86)\Scrybe\Service\ScrybeUpdater.exe [2010-03-04 1300992] R4 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2010-12-21 987704] R4 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2010-12-21 399416] R4 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R4 TeamViewer5;TeamViewer 5;c:\program files (x86)\TeamViewer\Version5\TeamViewer_Service.exe [2010-07-06 173352] R4 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x] S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x] S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x] S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [x] S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136] S2 CronService;Cron Service for Prey;c:\prey\platform\windows\cronsvc.exe [2010-09-29 18432] S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-08-15 2329480] S2 hshld;Hotspot Shield Service;c:\program files (x86)\Hotspot Shield\bin\openvpnas.exe [2011-10-06 288088] S2 HssWd;Hotspot Shield Monitoring Service;c:\program files (x86)\Hotspot Shield\bin\hsswd.exe [2011-05-26 329544] S2 ImDskSvc;ImDisk Virtual Disk Driver Helper;c:\windows\system32\imdsksvc.exe [x] S2 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-08-06 311592] S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x] S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120] S3 connctfyMP;connctfyMP;c:\windows\system32\DRIVERS\connctfy.sys [x] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x] S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys [x] S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys [x] S3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x] S3 nuvotoncir;Nuvoton IR Transceiver;c:\windows\system32\DRIVERS\nuvotoncir.sys [x] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x] S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x] S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] Akamai REG_MULTI_SZ Akamai . Contents of the 'Scheduled Tasks' folder . 2011-11-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-09 23:49] . 2011-11-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-09 23:49] . 2011-11-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3216554100-3927655099-2747082274-1001Core.job - c:\users\Matt\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-17 02:54] . 2011-11-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3216554100-3927655099-2747082274-1001UA.job - c:\users\Matt\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-17 02:54] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}] 2011-06-20 17:37 287048 —-a-w- c:\program files (x86)\Hotspot Shield\HssIE\HssIE_64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2010-04-23 22:50 76040 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2010-04-23 22:50 76040 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2010-04-23 22:50 76040 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2010-04-23 22:50 76040 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2010-04-23 22:50 76040 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2010-04-23 22:50 76040 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2010-04-23 22:50 76040 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2010-04-23 22:50 76040 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2010-04-23 22:50 76040 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 97792 —-a-w- c:\users\Matt\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 97792 —-a-w- c:\users\Matt\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 97792 —-a-w- c:\users\Matt\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 97792 —-a-w- c:\users\Matt\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2009-08-06 17:19 137512 —-a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-03 11545192] "EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1680976] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736] "combofix"="c:\combofix\CF9812.3XE" [2010-11-20 345088] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x1 . ——- Supplementary Scan ——- . uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5739g&r=27360110x116l0333z196t48n4u246 uLocal Page = c:\windows\system32\blank.htm mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5739g&r=27360110x116l0333z196t48n4u246 mLocal Page = c:\windows\SysWOW64\blank.htm IE: Add to Evernote 4.0 - c:\program files (x86)\Evernote\Evernote\EvernoteIE.dll/204 IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 IE: Google Sidewiki… - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html IE: {{A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://c:\program files (x86)\Evernote\Evernote\EvernoteIE.dll/204 TCP: Interfaces\{AAF3B208-519F-47B9-B750-E64A649F5621}\2456C6B696E6F5562326361616: NameServer = 8.8.8.8,8.8.4.4 TCP: Interfaces\{AAF3B208-519F-47B9-B750-E64A649F5621}\3434D27457563747: NameServer = 8.8.8.8,8.8.4.4 TCP: Interfaces\{F456ED00-A404-4E88-AB95-1F312DD60582}: NameServer = 10.1.40.1 FF - ProfilePath - c:\users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\6xi4wfiw.Beta\ FF - prefs.js: browser.startup.homepage - hxxps://reader.google.com/ FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=382950&p= FF - prefs.js: network.proxy.type - 0 FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) SafeBoot-mcmscsvc SafeBoot-MCODS Toolbar-Locked - (no file) HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Acer Bio Protection\CompPtcVUI.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Bonjour\mDNSResponder.exe c:\program files (x86)\Hotspot Shield\HssWPR\hsssrv.exe c:\program files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe c:\windows\SysWOW64\PnkBstrA.exe c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe c:\program files (x86)\Google\Update\1.3.21.79\GoogleCrashHandler.exe . ************************************************************************** . Completion time: 2011-11-03 17:56:40 - machine was rebooted ComboFix-quarantined-files.txt 2011-11-03 21:56 . Pre-Run: 53,516,206,080 bytes free Post-Run: 54,273,347,584 bytes free . - - End Of File - - 0F9A4218F6F3CE2782CFA79F2A963396