Spyware / Malware / Virus Removal

OTL/HiJackThis/Dds Scan Results

6 min read

Looking for the outcome? Ask AI

PandaManda Topic Starter

Post #1November 6, 2011, 10:35 PM UTC last edited November 6, 2011, 10:53 PM UTC

I'm currently having trouble with my computer, it's been running slower and slower, probably due to a virus. And also, the sound on my computer hasn't worked since I downloaded Windows 7 Ultimate. I had Windows Xp Home Edition before that. And suggestions on how to fix that would be wonderful, because it's quite annoying to not hear anything on a video or something. And the audio isn't working either. Like I can't talk over the mic because it says can't detect the sound card. Please help!

OTL Scan Result :

OTL logfile created on: 11/6/2011 4:13:43 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Austin\Desktop
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 0.65 Gb Available Physical Memory | 32.73% Memory free
4.00 Gb Paging File | 2.53 Gb Available in Paging File | 63.23% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 186.30 Gb Total Space | 94.64 Gb Free Space | 50.80% Space Free | Partition Type: NTFS

Computer Name: AUSTIN-PC | User Name: Austin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Austin\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Austin\Desktop\HiJackThis.exe (Trend Micro Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe (COMODO)
PRC - C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation)
PRC - C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation)
PRC - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()

========== Win32 Services (SafeList) ==========

SRV - (Steam Client Service) – C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (cmdAgent) – C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (CLPSLS) – C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe (COMODO)
SRV - (nvUpdatusService) – C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (MBAMSwissArmy) – C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (MBAMProtector) – C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (inspect) – C:\Windows\System32\drivers\inspect.sys (COMODO)
DRV - (cmdHlp) – C:\Windows\System32\drivers\cmdhlp.sys (COMODO)
DRV - (cmdGuard) – C:\Windows\System32\drivers\cmdGuard.sys (COMODO)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (vmbus) – C:\Windows\system32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\system32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\system32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (RdpVideoMiniport) – C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\system32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\system32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (Serial) – C:\Windows\System32\drivers\serial.sys (Brother Industries Ltd.)
DRV - (RsFx0103) – C:\Windows\System32\drivers\RsFx0103.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B8 A2 B6 AE D7 6C CC 01 [binary data]
IE - HKCU\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\3.0.40818.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/10/02 19:49:42 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2011/09/06 16:01:55 | 000,000,000 | —D | M] (No name found) – C:\Users\Austin\AppData\Roaming\Mozilla\Extensions
[2011/11/06 15:04:04 | 000,000,000 | —D | M] (No name found) – C:\Users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\0od5sz06.default\extensions
[2011/11/06 15:01:41 | 000,001,945 | —- | M] () – C:\Users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\0od5sz06.default\searchplugins\bing-zugo.xml
[2011/10/27 12:17:42 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/11/06 15:32:18 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011/09/06 18:59:22 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}
[2011/10/20 07:52:23 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2011/10/02 19:49:42 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll

========== Chrome ==========

O1 HOSTS File: ([2009/06/10 16:39:37 | 000,000,824 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [COMODO] C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLA.exe (COMODO)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKLM..\Run: [CPA] C:\Program Files\COMODO\COMODO GeekBuddy\VALA.exe (COMODO)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CFE5CE54-6864-42F0-965A-0963A183322E}: DhcpNameServer = 192.168.0.2
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - AppInit_DLLs: (C:\Windows\system32\guard32.dll) -C:\Windows\System32\guard32.dll (COMODO)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 16:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/11/06 15:56:14 | 000,000,000 | —D | C] – C:\Users\Austin\Documents\DriverGenius
[2011/11/06 15:54:43 | 000,000,000 | —D | C] – C:\Program Files\Driver-Soft
[2011/11/06 15:54:06 | 000,000,000 | —D | C] – C:\ProgramData\Office Genuine Advantage
[2011/11/06 15:50:06 | 000,000,000 | —D | C] – C:\Users\Austin\AppData\Roaming\Nero
[2011/11/06 15:42:18 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Austin\Desktop\HiJackThis.exe
[2011/11/06 15:41:48 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\Austin\Desktop\OTL.exe
[2011/11/06 15:38:05 | 002,560,616 | —- | C] (NVIDIA Corporation) – C:\Windows\System32\nvsvcr.dll
[2011/11/06 15:35:36 | 000,000,000 | —D | C] – C:\Windows\LastGood
[2011/11/06 15:34:16 | 016,456,296 | —- | C] (NVIDIA Corporation) – C:\Windows\System32\nvoglv32.dll
[2011/11/06 15:34:16 | 010,589,800 | —- | C] (NVIDIA Corporation) – C:\Windows\System32\drivers\nvlddmkm.sys
[2011/11/06 15:34:16 | 000,899,688 | —- | C] (NVIDIA Corporation) – C:\Windows\System32\nvdispco3220150.dll
[2011/11/06 15:34:16 | 000,865,896 | —- | C] (NVIDIA Corporation) – C:\Windows\System32\nvgenco322090.dll
[2011/11/06 15:34:16 | 000,057,960 | —- | C] (Khronos Group) – C:\Windows\System32\OpenCL.dll
[2011/11/06 15:34:15 | 013,011,560 | —- | C] (NVIDIA Corporation) – C:\Windows\System32\nvcompiler.dll
[2011/11/06 15:34:15 | 005,301,352 | —- | C] (NVIDIA Corporation) – C:\Windows\System32\nvcuda.dll
[2011/11/06 15:34:15 | 002,804,328 | —- | C] (NVIDIA Corporation) – C:\Windows\System32\nvcuvid.dll
[2011/11/06 15:34:15 | 002,082,408 | —- | C] (NVIDIA Corporation) – C:\Windows\System32\nvcuvenc.dll
[2011/11/06 15:34:15 | 000,012,392 | —- | C] (NVIDIA Corporation) – C:\Windows\System32\drivers\nvBridge.kmd
[2011/11/06 15:33:10 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Nero
[2011/11/06 15:33:01 | 000,000,000 | —D | C] – C:\Program Files\Nero
[2011/11/06 15:32:51 | 000,000,000 | —D | C] – C:\ProgramData\Nero
[2011/11/06 15:27:59 | 006,727,840 | —- | C] (Skype Technologies S.A.) – C:\Users\Austin\Desktop\SkypeClicktoCall.exe
[2011/11/06 15:27:53 | 144,702,568 | —- | C] (NVIDIA Corporation) – C:\Users\Austin\Desktop\gigabyte_16258145145026.exe
[2011/11/06 15:26:21 | 000,041,272 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/11/06 15:25:24 | 000,000,000 | —D | C] – C:\ProgramData\LightScribe
[2011/11/06 15:21:09 | 000,000,000 | R–D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LightScribe Direct Disc Labeling
[2011/11/06 15:21:09 | 000,000,000 | —D | C] – C:\Program Files\Common Files\LightScribe
[2011/11/06 15:01:57 | 000,000,000 | —D | C] – C:\Users\Austin\AppData\Local\Soft32
[2011/11/06 15:01:41 | 000,000,000 | —D | C] – C:\Program Files\StartNow Toolbar
[2011/11/06 14:20:19 | 000,000,000 | —D | C] – C:\Program Files\TuneUpMedia
[2011/11/06 14:20:17 | 000,000,000 | —D | C] – C:\Users\Austin\AppData\Roaming\TuneUpMedia
[2011/11/06 14:20:03 | 000,000,000 | —D | C] – C:\ProgramData\TuneUpMedia
[2011/11/06 14:18:34 | 000,000,000 | —D | C] – C:\Users\Austin\AppData\Roaming\OpenCandy
[2011/11/06 14:06:06 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
[2011/11/06 14:05:58 | 000,000,000 | —D | C] – C:\Program Files\DAEMON Tools Lite
[2011/11/06 14:05:22 | 000,000,000 | —D | C] – C:\Users\Austin\AppData\Roaming\DAEMON Tools Lite
[2011/11/06 14:05:20 | 000,000,000 | —D | C] – C:\ProgramData\DAEMON Tools Lite
[2011/11/02 13:54:06 | 000,000,000 | —D | C] – C:\Users\Austin\jagexcache2
[2011/11/02 12:56:34 | 000,000,000 | —D | C] – C:\Users\Austin\jagexcache1
[2011/10/27 12:17:34 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011/10/20 07:52:19 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2011/10/20 07:52:19 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2011/10/20 07:52:19 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2011/10/15 10:04:37 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/10/15 10:03:54 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/10/15 10:03:54 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/10/15 10:00:37 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2011/10/11 16:29:35 | 002,382,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/10/11 16:29:33 | 001,798,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2011/10/11 16:29:33 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/10/11 16:29:33 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/10/11 16:29:32 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/10/11 15:22:41 | 000,465,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\psisdecd.dll
[2011/10/11 15:22:41 | 000,075,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\psisrndr.ax
[2011/10/11 15:22:28 | 002,334,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/11/06 15:43:11 | 000,625,664 | —- | M] () – C:\Users\Austin\Desktop\dds.scr
[2011/11/06 15:42:27 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Austin\Desktop\OTL.exe
[2011/11/06 15:42:27 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Austin\Desktop\HiJackThis.exe
[2011/11/06 15:42:18 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/11/06 15:40:30 | 000,808,304 | —- | M] () – C:\Windows\System32\perfh00C.dat
[2011/11/06 15:40:30 | 000,808,148 | —- | M] () – C:\Windows\System32\perfh00A.dat
[2011/11/06 15:40:30 | 000,806,018 | —- | M] () – C:\Windows\System32\perfh013.dat
[2011/11/06 15:40:30 | 000,802,842 | —- | M] () – C:\Windows\System32\perfh015.dat
[2011/11/06 15:40:30 | 000,802,840 | —- | M] () – C:\Windows\System32\perfh010.dat
[2011/11/06 15:40:30 | 000,791,840 | —- | M] () – C:\Windows\System32\prfh0816.dat
[2011/11/06 15:40:30 | 000,787,372 | —- | M] () – C:\Windows\System32\perfh019.dat
[2011/11/06 15:40:30 | 000,776,628 | —- | M] () – C:\Windows\System32\prfh0416.dat
[2011/11/06 15:40:30 | 000,759,588 | —- | M] () – C:\Windows\System32\perfh007.dat
[2011/11/06 15:40:30 | 000,746,326 | —- | M] () – C:\Windows\System32\perfh00E.dat
[2011/11/06 15:40:30 | 000,731,344 | —- | M] () – C:\Windows\System32\perfh005.dat
[2011/11/06 15:40:30 | 000,726,588 | —- | M] () – C:\Windows\System32\perfh01D.dat
[2011/11/06 15:40:30 | 000,725,196 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/11/06 15:40:30 | 000,719,602 | —- | M] () – C:\Windows\System32\perfh01F.dat
[2011/11/06 15:40:30 | 000,669,524 | —- | M] () – C:\Windows\System32\perfh008.dat
[2011/11/06 15:40:30 | 000,572,146 | —- | M] () – C:\Windows\System32\perfh006.dat
[2011/11/06 15:40:30 | 000,557,422 | —- | M] () – C:\Windows\System32\perfh014.dat
[2011/11/06 15:40:30 | 000,544,286 | —- | M] () – C:\Windows\System32\perfh00B.dat
[2011/11/06 15:40:30 | 000,492,224 | —- | M] () – C:\Windows\System32\perfh012.dat
[2011/11/06 15:40:30 | 000,480,630 | —- | M] () – C:\Windows\System32\perfh011.dat
[2011/11/06 15:40:30 | 000,465,056 | —- | M] () – C:\Windows\System32\prfh0404.dat
[2011/11/06 15:40:30 | 000,455,632 | —- | M] () – C:\Windows\System32\perfh00D.dat
[2011/11/06 15:40:30 | 000,447,954 | —- | M] () – C:\Windows\System32\prfh0804.dat
[2011/11/06 15:40:30 | 000,194,004 | —- | M] () – C:\Windows\System32\perfc00E.dat
[2011/11/06 15:40:30 | 000,181,344 | —- | M] () – C:\Windows\System32\perfc00A.dat
[2011/11/06 15:40:30 | 000,178,620 | —- | M] () – C:\Windows\System32\perfc015.dat
[2011/11/06 15:40:30 | 000,175,936 | —- | M] () – C:\Windows\System32\perfc013.dat
[2011/11/06 15:40:30 | 000,175,908 | —- | M] () – C:\Windows\System32\prfc0816.dat
[2011/11/06 15:40:30 | 000,173,500 | —- | M] () – C:\Windows\System32\perfc019.dat
[2011/11/06 15:40:30 | 000,172,312 | —- | M] () – C:\Windows\System32\perfc00C.dat
[2011/11/06 15:40:30 | 000,171,802 | —- | M] () – C:\Windows\System32\perfc007.dat
[2011/11/06 15:40:30 | 000,170,500 | —- | M] () – C:\Windows\System32\prfc0416.dat
[2011/11/06 15:40:30 | 000,169,808 | —- | M] () – C:\Windows\System32\perfc010.dat
[2011/11/06 15:40:30 | 000,165,494 | —- | M] () – C:\Windows\System32\perfc01D.dat
[2011/11/06 15:40:30 | 000,164,116 | —- | M] () – C:\Windows\System32\perfc005.dat
[2011/11/06 15:40:30 | 000,162,898 | —- | M] () – C:\Windows\System32\perfc01F.dat
[2011/11/06 15:40:30 | 000,145,214 | —- | M] () – C:\Windows\System32\perfc011.dat
[2011/11/06 15:40:30 | 000,145,214 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/11/06 15:40:30 | 000,143,502 | —- | M] () – C:\Windows\System32\perfc012.dat
[2011/11/06 15:40:30 | 000,143,074 | —- | M] () – C:\Windows\System32\prfc0804.dat
[2011/11/06 15:40:30 | 000,138,160 | —- | M] () – C:\Windows\System32\prfc0404.dat
[2011/11/06 15:40:30 | 000,134,012 | —- | M] () – C:\Windows\System32\perfc008.dat
[2011/11/06 15:40:30 | 000,124,152 | —- | M] () – C:\Windows\System32\perfc00B.dat
[2011/11/06 15:40:30 | 000,121,492 | —- | M] () – C:\Windows\System32\perfc006.dat
[2011/11/06 15:40:30 | 000,118,302 | —- | M] () – C:\Windows\System32\perfc014.dat
[2011/11/06 15:40:30 | 000,107,920 | —- | M] () – C:\Windows\System32\perfc00D.dat
[2011/11/06 15:40:29 | 000,542,066 | —- | M] () – C:\Windows\System32\perfh001.dat
[2011/11/06 15:40:29 | 000,117,810 | —- | M] () – C:\Windows\System32\perfc001.dat
[2011/11/06 15:30:45 | 000,010,240 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/11/06 15:30:45 | 000,010,240 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/11/06 15:30:34 | 144,702,568 | —- | M] (NVIDIA Corporation) – C:\Users\Austin\Desktop\gigabyte_16258145145026.exe
[2011/11/06 15:28:22 | 006,727,840 | —- | M] (Skype Technologies S.A.) – C:\Users\Austin\Desktop\SkypeClicktoCall.exe
[2011/11/06 15:26:21 | 000,041,272 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/11/06 15:23:50 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/11/06 15:23:39 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/11/06 15:23:32 | 1610,113,024 | -HS- | M] () – C:\hiberfil.sys
[2011/11/03 22:26:48 | 000,000,046 | —- | M] () – C:\Users\Austin\jagex_cl_runescape_LIVE1.dat
[2011/11/03 22:26:48 | 000,000,032 | —- | M] () – C:\Users\Austin\jagex_cl_runescape_LIVE.dat
[2011/11/02 13:58:46 | 000,000,046 | —- | M] () – C:\Users\Austin\jagex_cl_runescape_LIVE2.dat
[2011/11/02 13:55:58 | 000,000,129 | —- | M] () – C:\Users\Austin\jagex_runescape_preferences2.dat
[2011/11/02 13:54:09 | 000,000,035 | —- | M] () – C:\Users\Austin\jagex_runescape_preferences.dat
[2011/10/28 10:50:12 | 000,000,000 | —- | M] () – C:\Users\Austin\AppData\Local\{10757541-0F3F-41FB-8350-9470B56B6844}
[2011/10/25 15:50:34 | 000,000,000 | —- | M] () – C:\Users\Austin\AppData\Local\{869E2954-74EC-4932-9417-B6158E798DE0}
[2011/10/25 14:54:17 | 000,000,000 | —- | M] () – C:\Users\Austin\AppData\Local\{9C98BE0C-DE77-4046-B805-BA9C2FE298D5}
[2011/10/25 14:52:27 | 000,000,000 | —- | M] () – C:\Users\Austin\AppData\Local\{9A1A0040-F268-418F-B62D-01B752FE59B7}
[2011/10/11 16:46:21 | 000,266,808 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/11/06 15:42:54 | 000,625,664 | —- | C] () – C:\Users\Austin\Desktop\dds.scr
[2011/11/06 15:34:16 | 000,004,364 | —- | C] () – C:\Windows\System32\nvinfo.pb
[2011/11/02 13:54:06 | 000,000,046 | —- | C] () – C:\Users\Austin\jagex_cl_runescape_LIVE2.dat
[2011/11/02 12:56:34 | 000,000,046 | —- | C] () – C:\Users\Austin\jagex_cl_runescape_LIVE1.dat
[2011/11/02 12:56:34 | 000,000,032 | —- | C] () – C:\Users\Austin\jagex_cl_runescape_LIVE.dat
[2011/10/28 10:50:12 | 000,000,000 | —- | C] () – C:\Users\Austin\AppData\Local\{10757541-0F3F-41FB-8350-9470B56B6844}
[2011/10/25 15:50:34 | 000,000,000 | —- | C] () – C:\Users\Austin\AppData\Local\{869E2954-74EC-4932-9417-B6158E798DE0}
[2011/10/25 14:54:17 | 000,000,000 | —- | C] () – C:\Users\Austin\AppData\Local\{9C98BE0C-DE77-4046-B805-BA9C2FE298D5}
[2011/10/25 14:52:27 | 000,000,000 | —- | C] () – C:\Users\Austin\AppData\Local\{9A1A0040-F268-418F-B62D-01B752FE59B7}
[2011/09/29 07:21:52 | 000,294,764 | —- | C] () – C:\Windows\System32\perfi01D.dat
[2011/09/29 07:21:50 | 000,726,588 | —- | C] () – C:\Windows\System32\perfh01D.dat
[2011/09/29 07:21:50 | 000,165,494 | —- | C] () – C:\Windows\System32\perfc01D.dat
[2011/09/29 07:21:50 | 000,037,052 | —- | C] () – C:\Windows\System32\perfd01D.dat
[2011/09/29 06:26:26 | 000,157,694 | —- | C] () – C:\Windows\System32\perfi012.dat
[2011/09/29 06:26:24 | 000,492,224 | —- | C] () – C:\Windows\System32\perfh012.dat
[2011/09/29 06:26:24 | 000,143,502 | —- | C] () – C:\Windows\System32\perfc012.dat
[2011/09/29 06:26:24 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd012.dat
[2011/09/29 02:55:49 | 000,111,310 | —- | C] () – C:\Windows\System32\prfi0804.dat
[2011/09/29 02:55:47 | 000,447,954 | —- | C] () – C:\Windows\System32\prfh0804.dat
[2011/09/29 02:55:47 | 000,143,074 | —- | C] () – C:\Windows\System32\prfc0804.dat
[2011/09/29 02:55:47 | 000,031,548 | —- | C] () – C:\Windows\System32\prfd0804.dat
[2011/09/29 01:29:48 | 000,141,988 | —- | C] () – C:\Windows\System32\perfi011.dat
[2011/09/29 01:29:46 | 000,480,630 | —- | C] () – C:\Windows\System32\perfh011.dat
[2011/09/29 01:29:46 | 000,145,214 | —- | C] () – C:\Windows\System32\perfc011.dat
[2011/09/29 01:29:46 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd011.dat
[2011/09/29 00:40:22 | 000,287,518 | —- | C] () – C:\Windows\System32\perfi00E.dat
[2011/09/29 00:40:20 | 000,746,326 | —- | C] () – C:\Windows\System32\perfh00E.dat
[2011/09/29 00:40:20 | 000,194,004 | —- | C] () – C:\Windows\System32\perfc00E.dat
[2011/09/29 00:40:20 | 000,048,094 | —- | C] () – C:\Windows\System32\perfd00E.dat
[2011/09/29 00:04:53 | 000,279,790 | —- | C] () – C:\Windows\System32\perfi00B.dat
[2011/09/29 00:04:51 | 000,544,286 | —- | C] () – C:\Windows\System32\perfh00B.dat
[2011/09/29 00:04:51 | 000,124,152 | —- | C] () – C:\Windows\System32\perfc00B.dat
[2011/09/29 00:04:51 | 000,038,258 | —- | C] () – C:\Windows\System32\perfd00B.dat
[2011/09/28 23:31:54 | 000,229,316 | —- | C] () – C:\Windows\System32\perfi00D.dat
[2011/09/28 23:31:52 | 000,455,632 | —- | C] () – C:\Windows\System32\perfh00D.dat
[2011/09/28 23:31:52 | 000,107,920 | —- | C] () – C:\Windows\System32\perfc00D.dat
[2011/09/28 23:31:52 | 000,032,166 | —- | C] () – C:\Windows\System32\perfd00D.dat
[2011/09/28 22:59:14 | 000,341,322 | —- | C] () – C:\Windows\System32\perfi013.dat
[2011/09/28 22:59:12 | 000,806,018 | —- | C] () – C:\Windows\System32\perfh013.dat
[2011/09/28 22:59:12 | 000,175,936 | —- | C] () – C:\Windows\System32\perfc013.dat
[2011/09/28 22:59:12 | 000,043,068 | —- | C] () – C:\Windows\System32\perfd013.dat
[2011/09/28 22:27:26 | 000,298,300 | —- | C] () – C:\Windows\System32\perfi014.dat
[2011/09/28 22:27:24 | 000,557,422 | —- | C] () – C:\Windows\System32\perfh014.dat
[2011/09/28 22:27:24 | 000,118,302 | —- | C] () – C:\Windows\System32\perfc014.dat
[2011/09/28 22:27:24 | 000,036,156 | —- | C] () – C:\Windows\System32\perfd014.dat
[2011/09/28 21:37:23 | 000,369,984 | —- | C] () – C:\Windows\System32\perfi008.dat
[2011/09/28 21:37:21 | 000,669,524 | —- | C] () – C:\Windows\System32\perfh008.dat
[2011/09/28 21:37:21 | 000,134,012 | —- | C] () – C:\Windows\System32\perfc008.dat
[2011/09/28 21:37:21 | 000,045,182 | —- | C] () – C:\Windows\System32\perfd008.dat
[2011/09/28 20:48:12 | 000,335,478 | —- | C] () – C:\Windows\System32\perfi010.dat
[2011/09/28 20:48:10 | 000,802,840 | —- | C] () – C:\Windows\System32\perfh010.dat
[2011/09/28 20:48:10 | 000,169,808 | —- | C] () – C:\Windows\System32\perfc010.dat
[2011/09/28 20:48:10 | 000,037,534 | —- | C] () – C:\Windows\System32\perfd010.dat
[2011/09/28 20:18:04 | 000,292,004 | —- | C] () – C:\Windows\System32\perfi005.dat
[2011/09/28 20:18:02 | 000,731,344 | —- | C] () – C:\Windows\System32\perfh005.dat
[2011/09/28 20:18:02 | 000,164,116 | —- | C] () – C:\Windows\System32\perfc005.dat
[2011/09/28 20:18:02 | 000,036,232 | —- | C] () – C:\Windows\System32\perfd005.dat
[2011/09/28 19:51:08 | 000,289,060 | —- | C] () – C:\Windows\System32\perfi001.dat
[2011/09/28 19:51:06 | 000,542,066 | —- | C] () – C:\Windows\System32\perfh001.dat
[2011/09/28 19:51:06 | 000,117,810 | —- | C] () – C:\Windows\System32\perfc001.dat
[2011/09/28 19:51:06 | 000,042,056 | —- | C] () – C:\Windows\System32\perfd001.dat
[2011/09/28 19:23:31 | 000,344,522 | —- | C] () – C:\Windows\System32\perfi00C.dat
[2011/09/28 19:23:29 | 000,808,304 | —- | C] () – C:\Windows\System32\perfh00C.dat
[2011/09/28 19:23:29 | 000,172,312 | —- | C] () – C:\Windows\System32\perfc00C.dat
[2011/09/28 19:23:29 | 000,038,160 | —- | C] () – C:\Windows\System32\perfd00C.dat
[2011/09/28 18:53:25 | 000,336,656 | —- | C] () – C:\Windows\System32\prfi0816.dat
[2011/09/28 18:53:22 | 000,791,840 | —- | C] () – C:\Windows\System32\prfh0816.dat
[2011/09/28 18:53:22 | 000,175,908 | —- | C] () – C:\Windows\System32\prfc0816.dat
[2011/09/28 18:53:22 | 000,040,548 | —- | C] () – C:\Windows\System32\prfd0816.dat
[2011/09/28 18:30:40 | 000,306,636 | —- | C] () – C:\Windows\System32\perfi006.dat
[2011/09/28 18:30:38 | 000,572,146 | —- | C] () – C:\Windows\System32\perfh006.dat
[2011/09/28 18:30:38 | 000,121,492 | —- | C] () – C:\Windows\System32\perfc006.dat
[2011/09/28 18:30:38 | 000,039,236 | —- | C] () – C:\Windows\System32\perfd006.dat
[2011/09/28 18:12:14 | 000,341,432 | —- | C] () – C:\Windows\System32\perfi00A.dat
[2011/09/28 18:12:12 | 000,808,148 | —- | C] () – C:\Windows\System32\perfh00A.dat
[2011/09/28 18:12:12 | 000,181,344 | —- | C] () – C:\Windows\System32\perfc00A.dat
[2011/09/28 18:12:12 | 000,041,390 | —- | C] () – C:\Windows\System32\perfd00A.dat
[2011/09/28 17:58:06 | 000,117,840 | —- | C] () – C:\Windows\System32\prfi0404.dat
[2011/09/28 17:58:04 | 000,465,056 | —- | C] () – C:\Windows\System32\prfh0404.dat
[2011/09/28 17:58:04 | 000,138,160 | —- | C] () – C:\Windows\System32\prfc0404.dat
[2011/09/28 17:58:04 | 000,031,548 | —- | C] () – C:\Windows\System32\prfd0404.dat
[2011/09/28 17:45:01 | 000,337,158 | —- | C] () – C:\Windows\System32\perfi015.dat
[2011/09/28 17:45:00 | 000,802,842 | —- | C] () – C:\Windows\System32\perfh015.dat
[2011/09/28 17:45:00 | 000,178,620 | —- | C] () – C:\Windows\System32\perfc015.dat
[2011/09/28 17:45:00 | 000,038,710 | —- | C] () – C:\Windows\System32\perfd015.dat
[2011/09/28 17:34:15 | 000,336,704 | —- | C] () – C:\Windows\System32\perfi019.dat
[2011/09/28 17:34:14 | 000,787,372 | —- | C] () – C:\Windows\System32\perfh019.dat
[2011/09/28 17:34:14 | 000,173,500 | —- | C] () – C:\Windows\System32\perfc019.dat
[2011/09/28 17:34:14 | 000,039,446 | —- | C] () – C:\Windows\System32\perfd019.dat
[2011/09/28 17:22:32 | 000,323,154 | —- | C] () – C:\Windows\System32\prfi0416.dat
[2011/09/28 17:22:31 | 000,776,628 | —- | C] () – C:\Windows\System32\prfh0416.dat
[2011/09/28 17:22:31 | 000,170,500 | —- | C] () – C:\Windows\System32\prfc0416.dat
[2011/09/28 17:22:31 | 000,038,536 | —- | C] () – C:\Windows\System32\prfd0416.dat
[2011/09/28 17:04:32 | 000,295,922 | —- | C] () – C:\Windows\System32\perfi007.dat
[2011/09/28 17:04:30 | 000,759,588 | —- | C] () – C:\Windows\System32\perfh007.dat
[2011/09/28 17:04:30 | 000,171,802 | —- | C] () – C:\Windows\System32\perfc007.dat
[2011/09/28 17:04:30 | 000,038,104 | —- | C] () – C:\Windows\System32\perfd007.dat
[2011/09/28 16:43:36 | 000,285,034 | —- | C] () – C:\Windows\System32\perfi01F.dat
[2011/09/28 16:43:33 | 000,719,602 | —- | C] () – C:\Windows\System32\perfh01F.dat
[2011/09/28 16:43:33 | 000,162,898 | —- | C] () – C:\Windows\System32\perfc01F.dat
[2011/09/28 16:43:33 | 000,037,160 | —- | C] () – C:\Windows\System32\perfd01F.dat
[2011/09/24 19:17:06 | 000,080,416 | —- | C] () – C:\Windows\System32\RtNicProp32.dll
[2011/09/24 19:15:38 | 000,001,769 | —- | C] () – C:\Windows\Language_trs.ini
[2011/09/07 17:20:13 | 000,080,896 | —- | C] () – C:\Windows\System32\RDVGHelper.exe
[2011/09/07 17:18:50 | 000,066,048 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2009/07/13 23:57:37 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/13 23:33:53 | 000,266,808 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 21:05:48 | 000,725,196 | —- | C] () – C:\Windows\System32\perfh009.dat
[2009/07/13 21:05:48 | 000,291,294 | —- | C] () – C:\Windows\System32\perfi009.dat
[2009/07/13 21:05:48 | 000,145,214 | —- | C] () – C:\Windows\System32\perfc009.dat
[2009/07/13 21:05:48 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd009.dat
[2009/07/13 21:05:05 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2009/07/13 21:04:11 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2009/07/13 18:55:01 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 18:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 18:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/06/10 16:26:10 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat

========== LOP Check ==========

[2011/10/11 18:44:14 | 000,000,000 | —D | M] – C:\Users\Austin\AppData\Roaming\.minecraft
[2011/11/06 19:22:12 | 000,000,000 | —D | M] – C:\Users\Austin\AppData\Roaming\DAEMON Tools Lite
[2011/09/24 19:10:46 | 000,000,000 | —D | M] – C:\Users\Austin\AppData\Roaming\Device Doctor
[2011/11/06 19:22:11 | 000,000,000 | —D | M] – C:\Users\Austin\AppData\Roaming\OpenCandy
[2011/09/18 18:54:44 | 000,000,000 | —D | M] – C:\Users\Austin\AppData\Roaming\Rainmeter
[2011/11/06 15:35:15 | 000,000,000 | —D | M] – C:\Users\Austin\AppData\Roaming\TuneUpMedia
[2011/11/06 19:22:26 | 000,000,000 | —D | M] – C:\Users\Austin\AppData\Roaming\uTorrent
[2009/07/13 23:53:46 | 000,022,712 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/06/10 16:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2011/06/21 19:30:59 | 000,000,211 | —- | M] () – C:\Boot.bak
[2011/09/06 18:10:53 | 000,000,197 | RHS- | M] () – C:\boot.ini
[2011/07/04 14:55:31 | 000,000,327 | RHS- | M] () – C:\Boot.ini.saved
[2010/11/20 07:40:07 | 000,383,786 | RHS- | M] () – C:\bootmgr
[2011/09/06 19:06:04 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2004/08/03 22:00:00 | 000,260,272 | RHS- | M] () – C:\cmldr
[2009/06/10 16:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2009/08/02 03:59:51 | 000,171,136 | RHS- | M] () – C:\grldr
[2011/11/06 15:23:32 | 1610,113,024 | -HS- | M] () – C:\hiberfil.sys
[2009/04/25 12:53:40 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/04/25 12:53:40 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2006/02/28 07:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/11/23 18:36:20 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/11/06 15:23:36 | 2146,820,096 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2009/07/13 23:52:25 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 23:52:25 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 23:52:25 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 23:52:25 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 16:31:19 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/13 20:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2010/11/20 07:21:36 | 000,030,208 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 23:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/09/24 19:38:54 | 000,000,221 | -HS- | M] () – C:\Users\Austin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/11/06 15:30:34 | 144,702,568 | —- | M] (NVIDIA Corporation) – C:\Users\Austin\Desktop\gigabyte_16258145145026.exe
[2011/11/06 15:42:27 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Austin\Desktop\HiJackThis.exe
[2011/09/06 16:36:21 | 000,270,142 | —- | M] () – C:\Users\Austin\Desktop\Minecraft.exe
[2011/11/06 15:42:27 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Austin\Desktop\OTL.exe
[2011/11/06 15:28:22 | 006,727,840 | —- | M] (Skype Technologies S.A.) – C:\Users\Austin\Desktop\SkypeClicktoCall.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-11-06 20:52:16

< End of report >

HiJackThis Results:
bvc
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 3:45:44 PM, on 11/6/2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Users\Austin\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [COMODO] C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLA.exe
O4 - HKLM\..\Run: [CPA] C:\Program Files\COMODO\COMODO GeekBuddy\VALA.exe
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO livePCsupport Service (CLPSLS) - COMODO - C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

–
End of file - 5892 bytes

Dds Results:
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 15:52:47.98 on Sun 11/06/2011
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.2047.544 [GMT -5:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: COMODO Defense+ *Enabled/Updated* {CE351521-78FA-2048-BB22-B68A4A5CA7EC}
FW: COMODO Firewall *Enabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Users\Austin\Desktop\gigabyte_16258145145026.exe
C:\NVIDIA\DisplayDriver\275.33\Vista\International\setup.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\nvvsvc.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Users\Austin\Desktop\OTL.exe
C:\Users\Austin\Desktop\HiJackThis.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Austin\Desktop\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: H - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File
uRun: [Steam] "c:\program files\steam\Steam.exe" -silent
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [COMODO] c:\program files\comodo\comodo geekbuddy\CLPSLA.exe
mRun: [CPA] c:\program files\comodo\comodo geekbuddy\VALA.exe
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
AppInit_DLLs: c:\windows\system32\guard32.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\austin\appdata\roaming\mozilla\firefox\profiles\0od5sz06.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\3.0.40818.0\npctrlui.dll
.
============= SERVICES / DRIVERS ===============
.
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [2011-6-30 238960]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2011-6-30 37592]
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2011-6-6 64952]
R2 CLPSLS;COMODO livePCsupport Service;c:\program files\comodo\comodo geekbuddy\CLPSLS.exe [2011-5-25 154424]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-9-30 366152]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia updatus\daemonu.exe [2011-9-6 2214504]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-9-6 22216]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2011-9-24 394856]
R4 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-11-6 41272]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-9-7 136176]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-9-7 136176]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-9-7 15872]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-9-7 52224]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-9-7 1343400]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2009-7-22 47128]
S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [2009-3-30 239336]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10.sqlexpress\mssql\binn\SQLAGENT.EXE [2009-3-30 366936]
.
=============== Created Last 30 ================
.
2011-11-06 20:54:43 ——– d—–w- c:\program files\Driver-Soft
2011-11-06 20:52:09 56200 —-a-w- c:\progra~2\microsoft\windows defender\definition updates\{ffeda959-5b89-48b4-89c3-32d2229098d7}\offreg.dll
2011-11-06 20:52:06 6668624 —-a-w- c:\progra~2\microsoft\windows defender\definition updates\{ffeda959-5b89-48b4-89c3-32d2229098d7}\mpengine.dll
2011-11-06 20:45:54 56200 —-a-w- c:\progra~2\microsoft\windows defender\definition updates\{4af9d72f-55ea-44a6-bdf8-bd358deafa5f}\offreg.dll
2011-11-06 20:38:05 2560616 —-a-w- c:\windows\system32\nvsvcr.dll
2011-11-06 20:34:16 899688 —-a-w- c:\windows\system32\nvdispco3220150.dll
2011-11-06 20:34:16 865896 —-a-w- c:\windows\system32\nvgenco322090.dll
2011-11-06 20:34:16 57960 —-a-w- c:\windows\system32\OpenCL.dll
2011-11-06 20:34:16 16456296 —-a-w- c:\windows\system32\nvoglv32.dll
2011-11-06 20:34:16 10589800 —-a-w- c:\windows\system32\drivers\nvlddmkm.sys
2011-11-06 20:34:15 5301352 —-a-w- c:\windows\system32\nvcuda.dll
2011-11-06 20:34:15 2804328 —-a-w- c:\windows\system32\nvcuvid.dll
2011-11-06 20:34:15 2082408 —-a-w- c:\windows\system32\nvcuvenc.dll
2011-11-06 20:34:15 13011560 —-a-w- c:\windows\system32\nvcompiler.dll
2011-11-06 20:33:01 ——– d—–w- c:\program files\Nero
2011-11-06 20:32:51 ——– d—–w- c:\progra~2\Nero
2011-11-06 20:30:51 6668624 ——w- c:\progra~2\microsoft\windows defender\definition updates\{4af9d72f-55ea-44a6-bdf8-bd358deafa5f}\mpengine.dll
2011-11-06 20:26:21 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-11-06 20:25:24 ——– d—–w- c:\progra~2\LightScribe
2011-11-06 20:01:57 ——– d—–w- c:\users\austin\appdata\local\Soft32
2011-11-06 20:01:41 ——– d—–w- c:\program files\StartNow Toolbar
2011-11-06 19:20:19 ——– d—–w- c:\program files\TuneUpMedia
2011-11-06 19:20:17 ——– d—–w- c:\users\austin\appdata\roaming\TuneUpMedia
2011-11-06 19:20:03 ——– d—–w- c:\progra~2\TuneUpMedia
2011-11-06 19:18:34 ——– d—–w- c:\users\austin\appdata\roaming\OpenCandy
2011-11-06 19:05:58 ——– d—–w- c:\program files\DAEMON Tools Lite
2011-11-06 19:05:22 ——– d—–w- c:\users\austin\appdata\roaming\DAEMON Tools Lite
2011-11-06 19:05:20 ——– d—–w- c:\progra~2\DAEMON Tools Lite
2011-11-02 18:54:06 ——– d—–w- c:\users\austin\jagexcache2
2011-11-02 17:56:34 ——– d—–w- c:\users\austin\jagexcache1
2011-10-18 14:34:28 4590240 —-a-w- c:\program files\mozilla firefox\extensions\{82af8dca-6de9-405d-bd5e-43525bdad38a}\components\SkypeFfComponent.dll
2011-10-15 15:03:54 ——– d—–w- c:\program files\iTunes
2011-10-15 15:03:54 ——– d—–w- c:\program files\iPod
2011-10-15 15:00:37 ——– d—–w- c:\program files\Bonjour
2011-10-11 20:22:41 75776 —-a-w- c:\windows\system32\psisrndr.ax
2011-10-11 20:22:41 465408 —-a-w- c:\windows\system32\psisdecd.dll
2011-10-11 20:22:39 571904 —-a-w- c:\windows\system32\oleaut32.dll
2011-10-11 20:22:39 233472 —-a-w- c:\windows\system32\oleacc.dll
2011-10-11 20:22:28 2334720 —-a-w- c:\windows\system32\win32k.sys
.
==================== Find3M ====================
.
2011-10-04 20:35:15 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-03 09:06:03 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-09-25 00:14:15 100896 —-a-w- c:\windows\system32\RTNUninst32.dll
2011-09-25 00:14:14 80416 —-a-w- c:\windows\system32\RtNicProp32.dll
2011-09-13 02:16:27 152576 —-a-w- c:\windows\system32\msclmd.dll
2011-09-06 21:09:51 348160 —-a-w- c:\windows\system32\msvcr71.dll
2011-09-06 21:09:51 1700352 —-a-w- c:\windows\system32\gdiplus.dll
2011-09-06 21:09:51 1060864 —-a-w- c:\windows\system32\mfc71.dll
2011-09-01 02:35:59 1798144 —-a-w- c:\windows\system32\jscript9.dll
2011-09-01 02:28:15 1126912 —-a-w- c:\windows\system32\wininet.dll
2011-09-01 02:22:54 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2011-08-31 03:05:04 83816 —-a-w- c:\windows\system32\dns-sd.exe
2011-08-31 03:05:04 73064 —-a-w- c:\windows\system32\dnssd.dll
2011-08-31 03:05:04 50536 —-a-w- c:\windows\system32\jdns_sd.dll
2011-08-31 03:05:04 178536 —-a-w- c:\windows\system32\dnssdX.dll
.
============= FINISH: 15:57:30.90 ===============

PandaManda

Post #2November 10, 2011, 10:59 PM UTC

I never got a reply on this, so I'll just bump I guess.

Tomk

Post #3November 14, 2011, 10:00 PM UTC

Hi PandaManda,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

µTorrent
You have µTorrent, a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx
http://www.techweb.com/wire/160500554
http://www.internetworldstats.com/articles/art053.htm

I would recommend that you uninstall µTorrent, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

PandaManda

Post #4November 15, 2011, 1:30 AM UTC last edited November 15, 2011, 2:19 AM UTC

Hello, For some reason it didn't run correctly, I downloaded it and everything, disabled and rebooted computer, and it says "COMODO Defense+" Is a real time scanner and to disable it and all that. I didn't even think I still had that installed. I just thought I had the Comodo Antivirus. Help please!

EDIT : Nevermind, it worked.

ComboFix Log:

ComboFix 11-11-14.03 - Austin 11/14/2011 20:36:30.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.2047.1284 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
FW: COMODO Firewall *Enabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A}
SP: COMODO Defense+ *Enabled/Updated* {CE351521-78FA-2048-BB22-B68A4A5CA7EC}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\StartNow Toolbar
c:\program files\StartNow Toolbar\Resources\images\engine_images.png
c:\program files\StartNow Toolbar\Resources\images\engine_maps.png
c:\program files\StartNow Toolbar\Resources\images\engine_news.png
c:\program files\StartNow Toolbar\Resources\images\engine_videos.png
c:\program files\StartNow Toolbar\Resources\images\engine_web.png
c:\program files\StartNow Toolbar\Resources\images\icon_amazon.png
c:\program files\StartNow Toolbar\Resources\images\icon_ebay.png
c:\program files\StartNow Toolbar\Resources\images\icon_facebook.png
c:\program files\StartNow Toolbar\Resources\images\icon_games.png
c:\program files\StartNow Toolbar\Resources\images\icon_msn.png
c:\program files\StartNow Toolbar\Resources\images\icon_shopping.png
c:\program files\StartNow Toolbar\Resources\images\icon_travel.png
c:\program files\StartNow Toolbar\Resources\images\icon_twitter.png
c:\program files\StartNow Toolbar\Resources\images\startnow_logo.png
c:\program files\StartNow Toolbar\Resources\installer.xml
c:\program files\StartNow Toolbar\Resources\skin\chevron_button.png
c:\program files\StartNow Toolbar\Resources\skin\searchbox_button_hover.png
c:\program files\StartNow Toolbar\Resources\skin\searchbox_button_normal.png
c:\program files\StartNow Toolbar\Resources\skin\searchbox_dropdown_button_normal.png
c:\program files\StartNow Toolbar\Resources\skin\searchbox_input_background.png
c:\program files\StartNow Toolbar\Resources\skin\searchbox_input_left.png
c:\program files\StartNow Toolbar\Resources\skin\searchbox_input_middle.png
c:\program files\StartNow Toolbar\Resources\skin\separator.png
c:\program files\StartNow Toolbar\Resources\skin\splitter.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ff_hover_c.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_c.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_l.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_r.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_c.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_l.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_r.png
c:\program files\StartNow Toolbar\Resources\toolbar.xml
c:\program files\StartNow Toolbar\Resources\update.xml
c:\program files\StartNow Toolbar\uninstall.dat
.
.
((((((((((((((((((((((((( Files Created from 2011-10-15 to 2011-11-15 )))))))))))))))))))))))))))))))
.
.
2011-11-15 02:11 . 2011-11-15 02:12 ——– d—–w- c:\users\Austin\AppData\Local\temp
2011-11-15 02:11 . 2011-11-15 02:11 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp
2011-11-15 02:11 . 2011-11-15 02:11 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-11-15 01:27 . 2011-11-15 01:27 56200 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A2D219D3-3AE2-4BA7-A816-87AE77779049}\offreg.dll
2011-11-12 00:37 . 2011-10-07 17:47 33984 —-a-w- c:\windows\system32\cmdcsr.dll
2011-11-11 21:49 . 2011-10-07 03:48 6668624 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A2D219D3-3AE2-4BA7-A816-87AE77779049}\mpengine.dll
2011-11-09 22:07 . 2011-09-29 16:03 1290608 —-a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-09 22:07 . 2011-10-01 04:37 708608 —-a-w- c:\program files\Common Files\System\wab32.dll
2011-11-09 22:06 . 2011-09-29 03:37 2341888 —-a-w- c:\windows\system32\win32k.sys
2011-11-06 20:54 . 2011-11-06 20:54 ——– d—–w- c:\program files\Driver-Soft
2011-11-06 20:54 . 2011-11-06 20:54 ——– d—–w- c:\programdata\Office Genuine Advantage
2011-11-06 20:50 . 2011-11-06 20:50 ——– d—–w- c:\users\Austin\AppData\Roaming\Nero
2011-11-06 20:38 . 2011-05-25 07:24 2560616 —-a-w- c:\windows\system32\nvsvcr.dll
2011-11-06 20:34 . 2011-05-25 07:24 57960 —-a-w- c:\windows\system32\OpenCL.dll
2011-11-06 20:34 . 2011-05-25 07:24 16456296 —-a-w- c:\windows\system32\nvoglv32.dll
2011-11-06 20:34 . 2011-05-25 07:24 899688 —-a-w- c:\windows\system32\nvdispco3220150.dll
2011-11-06 20:34 . 2011-05-25 07:24 865896 —-a-w- c:\windows\system32\nvgenco322090.dll
2011-11-06 20:34 . 2011-05-25 07:24 10589800 —-a-w- c:\windows\system32\drivers\nvlddmkm.sys
2011-11-06 20:34 . 2011-05-25 07:24 2804328 —-a-w- c:\windows\system32\nvcuvid.dll
2011-11-06 19:18 . 2011-11-07 00:22 ——– d—–w- c:\users\Austin\AppData\Roaming\OpenCandy
2011-11-06 19:05 . 2011-11-07 00:22 ——– d—–w- c:\program files\DAEMON Tools Lite
2011-11-06 19:05 . 2011-11-07 00:22 ——– d—–w- c:\users\Austin\AppData\Roaming\DAEMON Tools Lite
2011-11-06 19:05 . 2011-11-06 19:05 ——– d—–w- c:\programdata\DAEMON Tools Lite
2011-11-02 18:54 . 2011-11-02 18:54 ——– d—–w- c:\users\Austin\jagexcache2
2011-11-02 17:56 . 2011-11-02 17:56 ——– d—–w- c:\users\Austin\jagexcache1
2011-10-18 14:34 . 2011-10-18 14:34 4590240 —-a-w- c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-07 17:47 . 2011-06-30 13:38 82400 —-a-w- c:\windows\system32\drivers\inspect.sys
2011-10-07 17:47 . 2011-06-30 13:38 39640 —-a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-10-07 17:47 . 2011-06-30 13:38 488208 —-a-w- c:\windows\system32\drivers\cmdGuard.sys
2011-10-07 17:47 . 2011-06-30 13:38 19600 —-a-w- c:\windows\system32\drivers\cmderd.sys
2011-10-07 17:47 . 2011-06-30 13:37 300200 —-a-w- c:\windows\system32\guard32.dll
2011-10-04 20:35 . 2011-09-06 21:30 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-03 09:06 . 2011-09-06 23:59 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-09-25 00:35 . 2011-09-25 00:35 86528 —-a-w- c:\windows\system32\iesysprep.dll
2011-09-25 00:35 . 2011-09-25 00:35 76800 —-a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-09-25 00:35 . 2011-09-25 00:35 74752 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-09-25 00:35 . 2011-09-25 00:35 63488 —-a-w- c:\windows\system32\tdc.ocx
2011-09-25 00:35 . 2011-09-25 00:35 48640 —-a-w- c:\windows\system32\mshtmler.dll
2011-09-25 00:35 . 2011-09-25 00:35 161792 —-a-w- c:\windows\system32\msls31.dll
2011-09-25 00:35 . 2011-09-25 00:35 110592 —-a-w- c:\windows\system32\IEAdvpack.dll
2011-09-25 00:35 . 2011-09-25 00:35 74752 —-a-w- c:\windows\system32\iesetup.dll
2011-09-25 00:35 . 2011-09-25 00:35 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-09-25 00:35 . 2011-09-25 00:35 367104 —-a-w- c:\windows\system32\html.iec
2011-09-25 00:35 . 2011-09-25 00:35 35840 —-a-w- c:\windows\system32\imgutil.dll
2011-09-25 00:35 . 2011-09-25 00:35 23552 —-a-w- c:\windows\system32\licmgr10.dll
2011-09-25 00:35 . 2011-09-25 00:35 152064 —-a-w- c:\windows\system32\wextract.exe
2011-09-25 00:35 . 2011-09-25 00:35 150528 —-a-w- c:\windows\system32\iexpress.exe
2011-09-25 00:35 . 2011-09-25 00:35 142848 —-a-w- c:\windows\system32\ieUnatt.exe
2011-09-25 00:35 . 2011-09-25 00:35 1427456 —-a-w- c:\windows\system32\inetcpl.cpl
2011-09-25 00:35 . 2011-09-25 00:35 11776 —-a-w- c:\windows\system32\mshta.exe
2011-09-25 00:35 . 2011-09-25 00:35 101888 —-a-w- c:\windows\system32\admparse.dll
2011-09-25 00:14 . 2011-09-25 00:17 100896 —-a-w- c:\windows\system32\RTNUninst32.dll
2011-09-25 00:14 . 2011-09-25 00:17 80416 —-a-w- c:\windows\system32\RtNicProp32.dll
2011-09-25 00:14 . 2011-09-25 00:17 394856 —-a-w- c:\windows\system32\drivers\Rt86win7.sys
2011-09-18 23:40 . 2011-09-18 23:40 112832 —-a-w- c:\programdata\Microsoft\VCExpress\10.0\1033\ResourceCache.dll
2011-09-13 02:16 . 2009-07-14 02:05 152576 —-a-w- c:\windows\system32\msclmd.dll
2011-09-06 21:09 . 2011-09-06 21:09 348160 —-a-w- c:\windows\system32\msvcr71.dll
2011-09-06 21:09 . 2011-09-06 21:09 1700352 —-a-w- c:\windows\system32\gdiplus.dll
2011-09-06 21:09 . 2011-09-06 21:09 1060864 —-a-w- c:\windows\system32\mfc71.dll
2011-09-01 02:35 . 2011-10-11 21:29 1798144 —-a-w- c:\windows\system32\jscript9.dll
2011-09-01 02:28 . 2011-10-11 21:29 1126912 —-a-w- c:\windows\system32\wininet.dll
2011-09-01 02:22 . 2011-10-11 21:29 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2011-08-31 21:00 . 2011-09-07 00:13 22216 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-08-31 03:05 . 2011-08-31 03:05 83816 —-a-w- c:\windows\system32\dns-sd.exe
2011-08-31 03:05 . 2011-08-31 03:05 73064 —-a-w- c:\windows\system32\dnssd.dll
2011-08-31 03:05 . 2011-08-31 03:05 50536 —-a-w- c:\windows\system32\jdns_sd.dll
2011-08-31 03:05 . 2011-08-31 03:05 178536 —-a-w- c:\windows\system32\dnssdX.dll
2011-08-27 04:26 . 2011-10-11 20:22 571904 —-a-w- c:\windows\system32\oleaut32.dll
2011-08-27 04:26 . 2011-10-11 20:22 233472 —-a-w- c:\windows\system32\oleacc.dll
2011-08-17 04:24 . 2011-10-11 20:22 465408 —-a-w- c:\windows\system32\psisdecd.dll
2011-08-17 04:19 . 2011-10-11 20:22 75776 —-a-w- c:\windows\system32\psisrndr.ax
2011-11-09 23:06 . 2011-09-06 21:01 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-09-07 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-10-09 421736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\guard32.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CLPSLS]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\COMODO]
2011-05-26 03:43 208184 —-a-w- c:\program files\COMODO\COMODO GeekBuddy\CLPSLA.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\COMODO Internet Security]
2011-10-20 11:58 2497352 —-a-w- c:\program files\COMODO\COMODO Internet Security\cfp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CPA]
2011-05-26 03:43 182584 —-a-w- c:\program files\COMODO\COMODO GeekBuddy\VALA.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-08-31 21:00 449608 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2011-09-06 21:38 1242448 —-a-w- c:\program files\Steam\Steam.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-09-07 136176]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-09-07 136176]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-09-07 1343400]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-23 47128]
R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 239336]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 366936]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2011-10-07 488208]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2011-10-07 39640]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 CLPSLS;COMODO livePCsupport Service;c:\program files\COMODO\COMODO GeekBuddy\CLPSLS.exe [2011-05-26 154424]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-25 2214504]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-09-25 394856]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-07 17:33]
.
2011-11-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-07 17:33]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.0.2
FF - ProfilePath - c:\users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\0od5sz06.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(580)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'lsass.exe'(516)
c:\windows\system32\guard32.dll
.
Completion time: 2011-11-14 21:16:22
ComboFix-quarantined-files.txt 2011-11-15 02:16
.
Pre-Run: 101,185,556,480 bytes free
Post-Run: 101,452,054,528 bytes free
.
- - End Of File - - 9EBAE8614F21058E61F926B3E395A83F

Tomk

Post #5November 15, 2011, 2:25 AM UTC

Good.

Now let's get an online scan:

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

Please go here then click on: [external image: Posted Image]

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:

- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
Now click on: [external image: Posted Image]
The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
Now click on: [external image: Posted Image]
Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

PandaManda

Post #6November 15, 2011, 11:47 PM UTC

Took awhile, but here's the scan results!

ESET Log:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=63b80e0c00faf741af85cceb42be8570
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-11-15 11:42:13
# local_time=2011-11-15 06:42:13 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=6.0.6000 NT
# compatibility_mode=3073 16777213 80 71 0 2460075 0 0
# compatibility_mode=5893 16776573 100 94 0 72936046 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=417389
# found=0
# cleaned=0
# scan_time=9278

Tomk

Post #7November 16, 2011, 4:22 AM UTC

I'm not finding virus.

I realize that you still are having issues… but at this point, I think you will be better served by posting in the Windows forum and seeking help from the Tech Team. When you post there, it would be a good idea to provide a link back to this thread so that they will have access to the information you have already provided here. Do re-iterate the issues you are having in your post.

But first…

Time for some housekeeping

Click START then RUN
Now type ComboFix /Uninstall in the runbox and click OK.
Note the space between the X and the U, it needs to be there.
[external image: Posted Image]

The above procedure will:

Implement some cleanup procedures.
Reset System Restore.

Double click on OTL to run it.
Click on CleanUp!
When done, you will be prompted to restart your computer. Please restart your computer.

Please re-enable any security that was disabled.

The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

Tomk

Post #8November 20, 2011, 7:38 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

OTL/HiJackThis/Dds Scan Results

✨ Ask AI

Ask AI