This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

My pc is infected [Solved]

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Hi there, Hope you can help.

I did a malwarebytes scan and found 4 trojans (which it cleaned) after restart i recieved a message that windows was blocking some startup programs.

In msconfig i noticed an entry nvcpldaemon.exe and thought it my be the blocked program and even though it has now disappered from the start up entries i am concerned that something still remails due to random crashes etc.

Here is a fresh hijack this scan


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:36:51, on 25/11/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\nvraidservice.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Windows\System32\Ctxfihlp.exe
C:\Program Files\Virgin Media\Service Manager\ServiceManager.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Windows\system32\Macromed\Flash\FlashUtil11c_ActiveX.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co.uk/ig/dell?hl=en&…amp;ibd=5080925
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/news/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co.uk/ig/dell?hl=en&…amp;ibd=5080925
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [Bluetooth HCI Monitor] RunDll32 HCIMNTR.DLL,RunCheckHCIMode
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVRaidService] C:\Windows\system32\nvraidservice.exe
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [ServiceManager.exe] "C:\Program Files\Virgin Media\Service Manager\ServiceManager.exe" /AUTORUN
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe" resetprofile
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative ALchemy AL1 Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\AL1Licensing.exe
O23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1c9f379c900cf25) (gupdate1c9f379c900cf25) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HsdService - Virgin Media - C:\Program Files\Virgin Media\Digital Home Support\HsdService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\Windows\system32\libusbd-nt.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: @C:\Program Files\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files\Nero\Update\NASvc.exe
O23 - Service: Performance Service (nTuneService) - NVIDIA - C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: Virgin Media Security (Radialpoint Security Services) - Virgin Media - C:\Program Files\Virgin Media\Security\RpsSecurityAwareR.exe
O23 - Service: RadialpointIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\Virgin Media\Security\AVG\Identity Protection\agent\Bin\AVGIDSAgent.exe
O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
O23 - Service: Virgin Media Security Firewall (RP_FWS) - Virgin Media - C:\Program Files\Virgin Media\Security\Fws.exe
O23 - Service: ServicepointService - Radialpoint Inc. - C:\Program Files\Virgin Media\Service Manager\ServicepointService.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - Unknown owner - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (file missing)
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

–
End of file - 11243 bytes


Thanks
Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.


Having said that….Let's get going!! :thumbup:
———-

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Right-click and Run as Administrator dds to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
———-

Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Right-click and Run as Administrator GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
.
———-

In your next reply please post the logs created by DDS and GMER. :)
OP returned. Topic re-opened. =============== Go ahead and run the tools I asked for and then post the logs that are created into your next reply. :)
Hi, jeff, DDS did not run (there was no option to run as an administrator)

Here is the GMER scan results as requested

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-11-30 20:55:10
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\0000009b Hitachi_ rev.GKAO
Running: gmer.exe; Driver: C:\Users\DOM&ED~1\AppData\Local\Temp\pwldapow.sys


—- System - GMER 1.0.15 —-

SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwAssignProcessToJobObject [0x9883F080]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwCreateFile [0x9883FBDE]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwDeleteFile [0x9883FDD6]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwDeleteKey [0x988435AC]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwDeleteValueKey [0x988435DE]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwLoadKey [0x98843740]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwOpenFile [0x9883FCF6]
SSDT \??\C:\Program Files\Virgin Media\Security\AVG\Identity Protection\agent\drivers\AVGIDSShim.sys ZwOpenProcess [0xAACD6620]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwOpenThread [0x9883F3EA]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwProtectVirtualMemory [0x9883F51C]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwQueryValueKey [0x988436B6]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwRenameKey [0x98843620]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwReplaceKey [0x98843652]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwRestoreKey [0x98843684]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwSetContextThread [0x9883F026]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwSetInformationFile [0x9883FE7C]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwSetValueKey [0x98843544]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwSuspendThread [0x9883EFC0]
SSDT \??\C:\Program Files\Virgin Media\Security\AVG\Identity Protection\agent\drivers\AVGIDSShim.sys ZwTerminateProcess [0xAACD66D0]
SSDT \??\C:\Program Files\Virgin Media\Security\AVG\Identity Protection\agent\drivers\AVGIDSShim.sys ZwTerminateThread [0xAACD6770]
SSDT \??\C:\Program Files\Virgin Media\Security\AVG\Identity Protection\agent\drivers\AVGIDSShim.sys ZwWriteVirtualMemory [0xAACD6810]
SSDT \??\C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_32301.sys ZwCreateThreadEx [0x97F797B0]

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!KeSetEvent + 191 80CC0914 4 Bytes [80, F0, 83, 98] {XOR AL, 0x83; CWDE }
.text ntkrnlpa.exe!KeSetEvent + 1D9 80CC095C 4 Bytes [DE, FB, 83, 98]
.text ntkrnlpa.exe!KeSetEvent + 2D1 80CC0A54 8 Bytes [D6, FD, 83, 98, AC, 35, 84, …]
.text ntkrnlpa.exe!KeSetEvent + 2E1 80CC0A64 4 Bytes [DE, 35, 84, 98]
.text ntkrnlpa.exe!KeSetEvent + 381 80CC0B04 4 Bytes [40, 37, 84, 98]
.text …
.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x92206340, 0x3D6517, 0xE8000020]
? System32\Drivers\5814b325.sys The system cannot find the path specified. !
? System32\Drivers\a6e7c172.sys The system cannot find the path specified. !

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1020] ntdll.dll!KiUserApcDispatcher 77DE5B48 5 Bytes JMP 00414D50 C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (RapportMgmtService/Trusteer Ltd.)
.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1020] kernel32.dll!LoadLibraryExW + 173 76BE93EF 4 Bytes JMP 71AA000A
.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1020] WS2_32.dll!getaddrinfo 779A418A 5 Bytes JMP 71A40022
.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1020] WS2_32.dll!gethostbyname 779B62D4 5 Bytes JMP 71AD0022
.text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[4236] ntdll.dll!KiUserApcDispatcher 77DE5B48 5 Bytes JMP 00445210 C:\Program Files\Trusteer\Rapport\bin\RapportService.exe (RapportService/Trusteer Ltd.)
.text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[4236] kernel32.dll!LoadLibraryExW + 173 76BE93EF 4 Bytes JMP 71AC000A
.text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[4236] USER32.dll!InSendMessageEx + 3B1 7656E6B0 6 Bytes JMP 71AE001E
.text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[4236] WS2_32.dll!getaddrinfo 779A418A 5 Bytes JMP 71A20022
.text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[4236] WS2_32.dll!gethostbyname 779B62D4 5 Bytes JMP 71A60022
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] ntdll.dll!NtMapViewOfSection 77DE4974 5 Bytes JMP 719E0022
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] ntdll.dll!KiUserApcDispatcher + E 77DE5B56 5 Bytes JMP 01608FA0 c:\program files\trusteer\rapport\bin\rooksdol.dll (Rooks/Dolomite/Trusteer Ltd.)
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] kernel32.dll!QueueUserWorkItem 76BD9114 6 Bytes PUSH 710A0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] kernel32.dll!LoadLibraryExW + 173 76BE93EF 4 Bytes JMP 71AB000A
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] kernel32.dll!SetUnhandledExceptionFilter 76BEA8C5 6 Bytes PUSH 71A20022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WS2_32.dll!connect 779A40D9 5 Bytes JMP 71130022
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WS2_32.dll!getaddrinfo 779A418A 5 Bytes JMP 710E0022
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] GDI32.dll!BitBlt 779D70A6 6 Bytes PUSH 71820022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] USER32.dll!DdeInitializeW 76567921 6 Bytes PUSH 71760022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] USER32.dll!EnableWindow 7656CD8B 5 Bytes JMP 70249934 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] USER32.dll!RegisterClassExW 7656DA30 6 Bytes PUSH 71AD0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] USER32.dll!CreateWindowExA 7656DC2A 6 Bytes JMP 7191000A
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] USER32.dll!RegisterClassA 7656DF42 6 Bytes PUSH 71880022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] USER32.dll!RegisterClassW 7656E1AB 6 Bytes PUSH 71A50022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] USER32.dll!CreateWindowExW 76571305 6 Bytes JMP 7195000A
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] USER32.dll!TranslateMessage 765801AD 6 Bytes PUSH 716C0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] USER32.dll!PeekMessageW 7658045A 6 Bytes PUSH 719A0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] USER32.dll!DialogBoxParamW 765910B0 5 Bytes JMP 701A160B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] USER32.dll!DialogBoxIndirectParamW 76592EF5 5 Bytes JMP 7039605E C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] USER32.dll!GetClipboardData 765A715A 6 Bytes PUSH 71720022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] USER32.dll!DialogBoxParamA 765A8152 5 Bytes JMP 70395FF9 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] USER32.dll!DialogBoxIndirectParamA 765A847D 5 Bytes JMP 703960C3 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] USER32.dll!MessageBoxIndirectA 765BD4D9 5 Bytes JMP 70395F80 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] USER32.dll!MessageBoxIndirectW 765BD5D3 5 Bytes JMP 70395F07 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] USER32.dll!MessageBoxExA 765BD639 5 Bytes JMP 70395EA3 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] USER32.dll!MessageBoxExW 765BD65D 5 Bytes JMP 70395E3F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] ole32.dll!CoCreateInstance 76CF9F3E 6 Bytes JMP 718D000A
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] ole32.dll!CoCreateInstanceEx 76CF9F81 5 Bytes JMP 717E0022
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!InternetCloseHandle 7699B7C4 6 Bytes PUSH 714C0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!InternetReadFile 7699EA3A 6 Bytes PUSH 712C0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!HttpAddRequestHeadersA 769A1B9C 6 Bytes PUSH 71680022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!InternetQueryDataAvailable 769A22E4 6 Bytes PUSH 71300022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!InternetOpenA 769B4E33 6 Bytes PUSH 71380022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!InternetConnectA 769C5456 6 Bytes PUSH 71480022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!HttpOpenRequestA 769C5539 6 Bytes PUSH 71640022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!InternetConnectW 769C5AD2 6 Bytes PUSH 71440022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!HttpOpenRequestW 769C5DCB 6 Bytes PUSH 71600022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!HttpSendRequestW 769C6109 6 Bytes PUSH 71500022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!InternetReadFileExW 769CB5AB 6 Bytes PUSH 71240022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!InternetReadFileExA 769CB606 6 Bytes PUSH 71280022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!InternetGetCookieExA 769CE611 6 Bytes PUSH 713C0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!HttpSendRequestExW 769DAFE4 6 Bytes PUSH 71540022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!InternetWriteFile 769DB146 6 Bytes PUSH 711C0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!InternetOpenW 769EC02E 6 Bytes PUSH 71340022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!InternetSetStatusCallback 769EC242 6 Bytes PUSH 71200022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!HttpSendRequestA 769F5768 6 Bytes PUSH 715C0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!HttpSendRequestExA 76A3E7CD 6 Bytes PUSH 71580022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4736] WININET.dll!InternetGetCookieA 76A3FEC6 6 Bytes PUSH 71400022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] ntdll.dll!NtMapViewOfSection 77DE4974 5 Bytes JMP 719F0022
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] ntdll.dll!KiUserApcDispatcher + E 77DE5B56 5 Bytes JMP 01968FA0 c:\program files\trusteer\rapport\bin\rooksdol.dll (Rooks/Dolomite/Trusteer Ltd.)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] kernel32.dll!QueueUserWorkItem 76BD9114 6 Bytes PUSH 710A0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] kernel32.dll!LoadLibraryExW + 173 76BE93EF 4 Bytes JMP 71AC000A
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] kernel32.dll!SetUnhandledExceptionFilter 76BEA8C5 6 Bytes PUSH 71A30022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] kernel32.dll!CreateThread 76C0CB2E 5 Bytes JMP 7020723B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WS2_32.dll!connect 779A40D9 5 Bytes JMP 71130022
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WS2_32.dll!getaddrinfo 779A418A 5 Bytes JMP 710E0022
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] GDI32.dll!BitBlt 779D70A6 6 Bytes PUSH 71830022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!CreateDialogParamW 765672A2 5 Bytes JMP 703963C8 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!DdeInitializeW 76567921 6 Bytes PUSH 71770022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!GetAsyncKeyState 7656863C 5 Bytes JMP 701EDCCD C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!SetWindowsHookExW 765687AD 5 Bytes JMP 702420C4 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!CallNextHookEx 76568E3B 5 Bytes JMP 70267ACF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!UnhookWindowsHookEx 765698DB 5 Bytes JMP 7028EA88 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!EnableWindow 7656CD8B 5 Bytes JMP 70249934 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!RegisterClassExW 7656DA30 6 Bytes PUSH 71AE0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!DefWindowProcA 7656DB88 7 Bytes JMP 70209465 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!CreateWindowExA 7656DC2A 6 Bytes JMP 70213293 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!RegisterClassA 7656DF42 6 Bytes PUSH 71890022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!RegisterClassW 7656E1AB 6 Bytes PUSH 71A60022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!CreateWindowExW 76571305 6 Bytes JMP 7026FEAF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!GetKeyState 76578CB1 5 Bytes JMP 701EDBA7 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!TranslateMessage 765801AD 6 Bytes PUSH 716D0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!DefWindowProcW 765803B4 7 Bytes JMP 70267B32 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!PeekMessageW 7658045A 6 Bytes PUSH 719B0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!IsDialogMessageW 76580745 5 Bytes JMP 70396B23 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!CreateDialogParamA 765817AA 5 Bytes JMP 70396390 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!IsDialogMessage 76581847 5 Bytes JMP 70396AFB C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!CreateDialogIndirectParamA 765826F1 5 Bytes JMP 70396400 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!CreateDialogIndirectParamW 76589A62 5 Bytes JMP 70396438 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!SetKeyboardState 76590987 5 Bytes JMP 703973E9 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!DialogBoxParamW 765910B0 5 Bytes JMP 701A160B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!DialogBoxIndirectParamW 76592EF5 5 Bytes JMP 7039605E C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!SendInput 76592F75 5 Bytes JMP 70397391 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!EndDialog 7659326E 5 Bytes JMP 70396DCF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!SetCursorPos 765A6FB2 5 Bytes JMP 7039746A C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!GetClipboardData 765A715A 6 Bytes PUSH 71730022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!DialogBoxParamA 765A8152 5 Bytes JMP 70395FF9 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!DialogBoxIndirectParamA 765A847D 5 Bytes JMP 703960C3 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!MessageBoxIndirectA 765BD4D9 5 Bytes JMP 70395F80 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!MessageBoxIndirectW 765BD5D3 5 Bytes JMP 70395F07 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!MessageBoxExA 765BD639 5 Bytes JMP 70395EA3 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!MessageBoxExW 765BD65D 5 Bytes JMP 70395E3F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] USER32.dll!keybd_event 765BD972 5 Bytes JMP 7039734E C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] SHELL32.dll!SHRestricted + D95 76E789A8 4 Bytes [CF, 01, 96, 6B]
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] SHELL32.dll!SHRestricted + D9D 76E789B0 8 Bytes [E0, 61, 95, 6B, 79, F7, 95, …]
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] ole32.dll!OleLoadFromStream 76CC1E80 5 Bytes JMP 7039682D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] ole32.dll!CoCreateInstanceEx 76CF9F81 5 Bytes JMP 717F0022
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!InternetCloseHandle 7699B7C4 6 Bytes PUSH 714D0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!InternetReadFile 7699EA3A 6 Bytes PUSH 712C0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!HttpAddRequestHeadersA 769A1B9C 6 Bytes PUSH 71690022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!InternetQueryDataAvailable 769A22E4 6 Bytes PUSH 71300022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!InternetOpenA 769B4E33 6 Bytes PUSH 71380022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!InternetConnectA 769C5456 6 Bytes PUSH 71490022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!HttpOpenRequestA 769C5539 6 Bytes PUSH 71650022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!InternetConnectW 769C5AD2 6 Bytes PUSH 71440022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!HttpOpenRequestW 769C5DCB 6 Bytes PUSH 71610022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!HttpSendRequestW 769C6109 6 Bytes PUSH 71510022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!InternetReadFileExW 769CB5AB 6 Bytes PUSH 71240022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!InternetReadFileExA 769CB606 6 Bytes PUSH 71280022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!InternetGetCookieExA 769CE611 6 Bytes PUSH 713C0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!HttpSendRequestExW 769DAFE4 6 Bytes PUSH 71550022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!InternetWriteFile 769DB146 6 Bytes PUSH 711C0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!InternetOpenW 769EC02E 6 Bytes PUSH 71340022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!InternetSetStatusCallback 769EC242 6 Bytes PUSH 71200022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!HttpSendRequestA 769F5768 6 Bytes PUSH 715D0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!HttpSendRequestExA 76A3E7CD 6 Bytes PUSH 71590022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4788] WININET.dll!InternetGetCookieA 76A3FEC6 6 Bytes PUSH 71400022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] ntdll.dll!NtMapViewOfSection 77DE4974 5 Bytes JMP 719F0022
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] ntdll.dll!KiUserApcDispatcher + E 77DE5B56 5 Bytes JMP 00E78FA0 c:\program files\trusteer\rapport\bin\rooksdol.dll (Rooks/Dolomite/Trusteer Ltd.)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] kernel32.dll!QueueUserWorkItem 76BD9114 6 Bytes PUSH 710A0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] kernel32.dll!LoadLibraryExW + 173 76BE93EF 4 Bytes JMP 71AC000A
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] kernel32.dll!SetUnhandledExceptionFilter 76BEA8C5 6 Bytes PUSH 71A30022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] kernel32.dll!CreateThread 76C0CB2E 5 Bytes JMP 7020723B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WS2_32.dll!connect 779A40D9 5 Bytes JMP 71130022
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WS2_32.dll!getaddrinfo 779A418A 5 Bytes JMP 710E0022
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] GDI32.dll!BitBlt 779D70A6 6 Bytes PUSH 71830022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!CreateDialogParamW 765672A2 5 Bytes JMP 703963C8 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!DdeInitializeW 76567921 6 Bytes PUSH 71770022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!GetAsyncKeyState 7656863C 5 Bytes JMP 701EDCCD C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!SetWindowsHookExW 765687AD 5 Bytes JMP 702420C4 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!CallNextHookEx 76568E3B 5 Bytes JMP 70267ACF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!UnhookWindowsHookEx 765698DB 5 Bytes JMP 7028EA88 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!EnableWindow 7656CD8B 5 Bytes JMP 70249934 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!RegisterClassExW 7656DA30 6 Bytes PUSH 71AE0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!DefWindowProcA 7656DB88 7 Bytes JMP 70209465 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!CreateWindowExA 7656DC2A 6 Bytes JMP 70213293 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!RegisterClassA 7656DF42 6 Bytes PUSH 71890022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!RegisterClassW 7656E1AB 6 Bytes PUSH 71A60022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!CreateWindowExW 76571305 6 Bytes JMP 7026FEAF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!GetKeyState 76578CB1 5 Bytes JMP 701EDBA7 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!TranslateMessage 765801AD 6 Bytes PUSH 716D0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!DefWindowProcW 765803B4 7 Bytes JMP 70267B32 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!PeekMessageW 7658045A 6 Bytes PUSH 719B0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!IsDialogMessageW 76580745 5 Bytes JMP 70396B23 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!CreateDialogParamA 765817AA 5 Bytes JMP 70396390 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!IsDialogMessage 76581847 5 Bytes JMP 70396AFB C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!CreateDialogIndirectParamA 765826F1 5 Bytes JMP 70396400 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!CreateDialogIndirectParamW 76589A62 5 Bytes JMP 70396438 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!SetKeyboardState 76590987 5 Bytes JMP 703973E9 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!DialogBoxParamW 765910B0 5 Bytes JMP 701A160B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!DialogBoxIndirectParamW 76592EF5 5 Bytes JMP 7039605E C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!SendInput 76592F75 5 Bytes JMP 70397391 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!EndDialog 7659326E 5 Bytes JMP 70396DCF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!SetCursorPos 765A6FB2 5 Bytes JMP 7039746A C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!GetClipboardData 765A715A 6 Bytes PUSH 71730022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!DialogBoxParamA 765A8152 5 Bytes JMP 70395FF9 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!DialogBoxIndirectParamA 765A847D 5 Bytes JMP 703960C3 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!MessageBoxIndirectA 765BD4D9 5 Bytes JMP 70395F80 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!MessageBoxIndirectW 765BD5D3 5 Bytes JMP 70395F07 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!MessageBoxExA 765BD639 5 Bytes JMP 70395EA3 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!MessageBoxExW 765BD65D 5 Bytes JMP 70395E3F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] USER32.dll!keybd_event 765BD972 5 Bytes JMP 7039734E C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] SHELL32.dll!SHRestricted + D95 76E789A8 4 Bytes [CF, 01, 96, 6B]
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] SHELL32.dll!SHRestricted + D9D 76E789B0 8 Bytes [E0, 61, 95, 6B, 79, F7, 95, …]
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] ole32.dll!OleLoadFromStream 76CC1E80 5 Bytes JMP 7039682D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] ole32.dll!CoCreateInstanceEx 76CF9F81 5 Bytes JMP 717F0022
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!InternetCloseHandle 7699B7C4 6 Bytes PUSH 714C0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!InternetReadFile 7699EA3A 6 Bytes PUSH 712C0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!HttpAddRequestHeadersA 769A1B9C 6 Bytes PUSH 71690022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!InternetQueryDataAvailable 769A22E4 6 Bytes PUSH 71300022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!InternetOpenA 769B4E33 6 Bytes PUSH 71380022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!InternetConnectA 769C5456 6 Bytes PUSH 71480022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!HttpOpenRequestA 769C5539 6 Bytes PUSH 71650022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!InternetConnectW 769C5AD2 6 Bytes PUSH 71440022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!HttpOpenRequestW 769C5DCB 6 Bytes PUSH 71610022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!HttpSendRequestW 769C6109 6 Bytes PUSH 71500022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!InternetReadFileExW 769CB5AB 6 Bytes PUSH 71240022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!InternetReadFileExA 769CB606 6 Bytes PUSH 71280022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!InternetGetCookieExA 769CE611 6 Bytes PUSH 713C0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!HttpSendRequestExW 769DAFE4 6 Bytes PUSH 71540022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!InternetWriteFile 769DB146 6 Bytes PUSH 711C0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!InternetOpenW 769EC02E 6 Bytes PUSH 71340022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!InternetSetStatusCallback 769EC242 6 Bytes PUSH 71200022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!HttpSendRequestA 769F5768 6 Bytes PUSH 715D0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!HttpSendRequestExA 76A3E7CD 6 Bytes PUSH 71580022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4880] WININET.dll!InternetGetCookieA 76A3FEC6 6 Bytes PUSH 71400022; RET

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs trufos.sys
AttachedDevice \Driver\tdx \Device\Tcp rp_skt32.sys (Radialpoint Filter/Radialpoint Inc.)

Device \Driver\BTHUSB \Device\00000088 bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)

AttachedDevice \Driver\tdx \Device\Udp rp_skt32.sys (Radialpoint Filter/Radialpoint Inc.)
AttachedDevice \Driver\tdx \Device\RawIp rp_skt32.sys (Radialpoint Filter/Radialpoint Inc.)

Device \Driver\BTHUSB \Device\0000008a bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat trufos.sys
AttachedDevice \FileSystem\fastfat \Fat AVGIDSFilter.sys

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001e4ce69510
Reg HKLM\SYSTEM\ControlSet080\Services\BTHPORT\Parameters\Keys\001e4ce69510 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet081\Services\BTHPORT\Parameters\Keys\001e4ce69510 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet082\Services\BTHPORT\Parameters\Keys\001e4ce69510 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet083\Services\BTHPORT\Parameters\Keys\001e4ce69510 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet084\Services\BTHPORT\Parameters\Keys\001e4ce69510 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet085\Services\BTHPORT\Parameters\Keys\001e4ce69510 (not active ControlSet)

—- Disk sectors - GMER 1.0.15 —-

Disk \Device\Harddisk0\DR0 MBR read error
Disk \Device\Harddisk0\DR0 MBR BIOS signature not found 0

—- Files - GMER 1.0.15 —-

File C:\Windows\Temp\TMP00000062F155D35E3A586A24 0 bytes

—- EOF - GMER 1.0.15 —-
Hey Jeff. If i right click the first DDS link, I do not get a 'run as administrator' option and the second link only gives me the options test-install-configure. When i try to run i get a brief glimpse of a command prompt which disappears immediately and nothing else happens
Hi,

Print out these instructions as we may need to close every window that is open later in the fix.


It is possible that the infection you are trying to remove will not allow you to download files on the infected computer. If this is the case, then you will need to download the files requested in this guide on another computer and then transfer them to the infected computer. You can transfer the files via a CD/DVD, external drive, or USB flash drive.

Do not reboot your computer after running rkill as the malware programs will start again.

Please download and run the following tool to help allow other programs to run. (courtesy of BleepingComputer.com)
There are 5 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click and choose Run as Admin
You only need to get one of them to run, not all of them.
  • rkill.exe
  • rkill.com
  • rkill.scr
  • WiNlOgOn.exe
  • uSeRiNiT.exe

Do not reboot your computer after running rkill as the malware programs will start again.
————

  • Download OTL to your desktop.
  • Right-click and Run as Administrator on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.
Hi Jeff, the logs as requested



OTL logfile created on: 01/12/2011 15:33:24 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\DOM&EDYTA;\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.75 Gb Total Physical Memory | 1.40 Gb Available Physical Memory | 50.86% Memory free
5.70 Gb Paging File | 4.04 Gb Available in Paging File | 70.84% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 921.44 Gb Total Space | 566.07 Gb Free Space | 61.43% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 4.82 Gb Free Space | 48.18% Space Free | Partition Type: NTFS

Computer Name: DOM-PC | User Name: DOM&EDYTA; | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\DOM&EDYTA;\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Trusteer\Rapport\bin\RapportService.exe (Trusteer Ltd.)
PRC - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Virgin Media\Service Manager\ServicepointService.exe (Radialpoint Inc.)
PRC - C:\Program Files\Virgin Media\Service Manager\ServiceManager.exe (Virgin Media)
PRC - C:\Program Files\Virgin Media\Digital Home Support\HsdService.exe (Virgin Media)
PRC - C:\Program Files\Nero\Update\NASvc.exe (Nero AG)
PRC - C:\Program Files\Virgin Media\Security\RpsSecurityAwareR.exe (Virgin Media)
PRC - C:\Program Files\Virgin Media\Security\Fws.exe (Virgin Media)
PRC - C:\Program Files\Virgin Media\Security\AVG\Identity Protection\agent\bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Windows\System32\Ctxfihlp.exe (Creative Technology Ltd)
PRC - C:\Windows\System32\CTxfispi.exe (Creative Technology Ltd)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe (NVIDIA)
PRC - C:\Windows\System32\nvraidservice.exe (NVIDIA Corporation)
PRC - C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe (Broadcom Corporation.)
PRC - C:\Windows\System32\libusbd-nt.exe (http://libusb-win32.sourceforge.net)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Trusteer\Rapport\bin\js32.dll ()
MOD - C:\ProgramData\Trusteer\Rapport\store\exts\RapportMS\28896\RapportMS.dll ()
MOD - C:\Program Files\Virgin Media\Service Manager\Windows7Features.dll ()
MOD - C:\Program Files\WinRAR\RarExt.dll ()
MOD - C:\Windows\System32\APOMngr.DLL ()
MOD - C:\Windows\System32\CmdRtr.DLL ()
MOD - C:\Windows\CTXFIRES.DLL ()
MOD - C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll ()
MOD - C:\Windows\System32\btwhidcs.dll ()


========== Win32 Services (SafeList) ==========

SRV - (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter) – File not found
SRV - (RapportMgmtService) – C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
SRV - (scan) – C:\Program Files\Virgin Media\Security\BitDefender\scan.dll (S.C. BitDefender S.R.L)
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (ServicepointService) – C:\Program Files\Virgin Media\Service Manager\ServicepointService.exe (Radialpoint Inc.)
SRV - (HsdService) – C:\Program Files\Virgin Media\Digital Home Support\HsdService.exe (Virgin Media)
SRV - (NAUpdate) – C:\Program Files\Nero\Update\NASvc.exe (Nero AG)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (Radialpoint Security Services) – C:\Program Files\Virgin Media\Security\RpsSecurityAwareR.exe (Virgin Media)
SRV - (RP_FWS) – C:\Program Files\Virgin Media\Security\Fws.exe (Virgin Media)
SRV - (RadialpointIDSAgent) – C:\Program Files\Virgin Media\Security\AVG\Identity Protection\agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (PDEngine) – C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe (Raxco Software, Inc.)
SRV - (PDAgent) – C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe (Raxco Software, Inc.)
SRV - (Creative ALchemy AL1 Licensing Service) – C:\Program Files\Common Files\Creative Labs Shared\Service\AL1Licensing.exe (Creative Labs)
SRV - (nTuneService) – C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe (NVIDIA)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (libusbd) – C:\Windows\System32\libusbd-nt.exe (http://libusb-win32.sourceforge.net)


========== Driver Services (SafeList) ==========

DRV - (RapportCerberus_32301) – C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_32301.sys ()
DRV - (RapportEI) – C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys (Trusteer Ltd.)
DRV - (RapportPG) – C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (Trusteer Ltd.)
DRV - (RapportKELL) – C:\Windows\System32\drivers\RapportKELL.sys (Trusteer Ltd.)
DRV - (RPSKT) Security Services Driver (x86) – C:\Windows\System32\drivers\rp_skt32.sys (Radialpoint Inc.)
DRV - (MBAMProtector) – C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (RapportIaso) – c:\ProgramData\Trusteer\Rapport\store\exts\RapportMS\28896\RapportIaso.sys (Trusteer Ltd.)
DRV - (ssudmdm) SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.) – C:\Windows\System32\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) – C:\Windows\System32\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (RapportBuka) – C:\Windows\System32\drivers\RapportBuka.sys (Trusteer Ltd.)
DRV - (Trufos) – C:\Program Files\Virgin Media\Security\BitDefender\trufos.sys (BitDefender S.R.L.)
DRV - (Profos) – C:\Program Files\Virgin Media\Security\BitDefender\profos.sys (BitDefender S.R.L.)
DRV - (RadialpointIDSDriver) – C:\Program Files\Virgin Media\Security\AVG\Identity Protection\agent\drivers\AVGIDSDriver.sys (AVG Technologies )
DRV - (RadialpointIDSFilter) – C:\Program Files\Virgin Media\Security\AVG\Identity Protection\agent\drivers\AVGIDSfilter.sys (AVG Technologies )
DRV - (RadialpointIDSShim) – C:\Program Files\Virgin Media\Security\AVG\Identity Protection\agent\drivers\AVGIDSShim.sys (AVG Technologies )
DRV - (RadialpointIDSEH) – C:\Windows\system32\drivers\AVGIDSEH.sys (AVG Technologies )
DRV - (bdfsfltr) – C:\Windows\system32\drivers\bdfsfltr.sys (BitDefender S.R.L. Bucharest, ROMANIA)
DRV - (pavboot) – C:\Windows\system32\drivers\pavboot.sys (Panda Security, S.L.)
DRV - (DefragFS) – C:\Windows\System32\drivers\DefragFs.sys (Raxco Software, Inc.)
DRV - (ha20x2k) – C:\Windows\System32\drivers\ha20x2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:\Windows\System32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\Windows\System32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\Windows\System32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\Windows\System32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctaud2k) Creative Audio Driver (WDM) – C:\Windows\System32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ctac32k) – C:\Windows\System32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (CTEXFIFX.SYS) – C:\Windows\System32\drivers\CTEXFIFX.SYS (Creative Technology Ltd.)
DRV - (CTEXFIFX) – C:\Windows\System32\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV - (CTHWIUT.SYS) – C:\Windows\System32\drivers\CTHWIUT.SYS (Creative Technology Ltd.)
DRV - (CTHWIUT) – C:\Windows\System32\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV - (CT20XUT.SYS) – C:\Windows\System32\drivers\CT20XUT.SYS (Creative Technology Ltd.)
DRV - (CT20XUT) – C:\Windows\System32\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV - (NVENETFD) – C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (NVR0Dev) – C:\Windows\nvoclock.sys (NVidia Corp.)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (nvrd32) – C:\Windows\system32\drivers\nvrd32.sys (NVIDIA Corporation)
DRV - (nvstor32) – C:\Windows\system32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (NWADI) – C:\Windows\System32\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV - (NWUSBPort) – C:\Windows\System32\drivers\nwusbser.sys (Novatel Wireless Inc.)
DRV - (NWUSBModem) – C:\Windows\System32\drivers\nwusbmdm.sys (Novatel Wireless Inc.)
DRV - (ElbyDelay) – C:\Windows\System32\drivers\ElbyDelay.sys (Elaborate Bytes AG)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (libusb0) – C:\Windows\System32\drivers\libusb0.sys ()
DRV - (Afc) – C:\Windows\System32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (ASPI32) – C:\Windows\System32\drivers\ASPI32.SYS (Adaptec)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co.uk/ig/dell?hl=en&…amp;ibd=5080925
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/news/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@pandasecurity.com/activescan: C:\Program Files\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security, S.L.)
FF - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: C:\Program Files\Virgin Media\Service Manager\nprpspa.dll (Virgin Media)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)



========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.106\gcswf32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.106\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.106\pdf.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Updater (Enabled) = C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Service Manager (Enabled) = C:\Program Files\Virgin Media\Service Manager\nprpspa.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

O1 HOSTS File: ([2006/09/18 21:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [Bluetooth HCI Monitor] C:\Windows\System32\HCIMNTR.DLL (Logitech Inc.)
O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\System32\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NVRaidService] C:\Windows\System32\nvraidservice.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [ServiceManager.exe] C:\Program Files\Virgin Media\Service Manager\ServiceManager.exe (Virgin Media)
O4 - HKLM..\Run: [VolPanel] C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [NVIDIA nTune] C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe (NVIDIA)
O8 - Extra context menu item: Send image to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F2CB22CF-5321-40F2-A621-99E752E4851B}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\application/x-internet-signup {A173B69A-1F9B-4823-9FDA-412F641E65D6} - C:\Program Files\Tiscali\Tiscali Internet\dlls\tiscalifilter.dll ()
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) -C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\DOM&EDYTA;\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\DOM&EDYTA;\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 21:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{486898e6-016d-11e0-bcc6-001e4ce69510}\Shell - "" = AutoRun
O33 - MountPoints2\{67dc625a-8aa4-11dd-970a-806e6f6e6963}\Shell - "" = AutoRun
O34 - HKLM BootExecute: (PDBoot.exe)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/12/01 15:31:00 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\DOM&EDYTA;\Desktop\OTL.exe
[2011/11/30 20:12:41 | 000,607,260 | R— | C] (Swearware) – C:\Users\DOM&EDYTA;\Desktop\dds.com
[2011/11/30 19:51:21 | 000,607,260 | R— | C] (Swearware) – C:\Users\DOM&EDYTA;\Desktop\dds.scr
[2011/11/24 23:22:13 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/11/24 23:21:30 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/11/24 23:21:28 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/11/21 20:36:58 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2011/11/16 00:22:02 | 000,028,552 | —- | C] (Panda Security, S.L.) – C:\Windows\System32\drivers\pavboot.sys
[2011/11/15 13:34:04 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2011/11/15 13:34:04 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2011/11/15 13:34:04 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2011/11/09 03:03:21 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011/11/09 03:03:07 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2011/11/07 22:14:06 | 000,000,000 | R–D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security Scan
[2011/11/07 22:14:06 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\NSS
[2011/11/07 22:14:06 | 000,000,000 | —D | C] – C:\Program Files\Norton Security Scan
[2011/11/07 22:14:06 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\NSS\0306000.01F
[2011/11/07 22:14:04 | 000,000,000 | —D | C] – C:\Program Files\NortonInstaller
[2011/11/07 21:28:38 | 000,056,208 | —- | C] (Trusteer Ltd.) – C:\Windows\System32\drivers\RapportKELL.sys
[2011/11/04 23:11:32 | 000,000,000 | —D | C] – C:\Users\DOM&EDYTA;\AppData\Roaming\Nero
[2011/11/04 23:09:45 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Nero
[2011/11/04 23:09:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero
[2011/11/04 23:09:37 | 000,000,000 | —D | C] – C:\Program Files\Nero
[2011/11/04 23:09:28 | 000,000,000 | —D | C] – C:\ProgramData\Nero
[2011/11/04 22:45:47 | 000,000,000 | —D | C] – C:\Program Files\Ask.com
[2011/11/04 22:44:30 | 004,379,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DX9_40.dll
[2011/11/04 22:44:03 | 003,497,832 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_34.dll
[2011/11/04 22:25:07 | 000,000,000 | —D | C] – C:\Users\DOM&EDYTA;\.swt
[2009/07/18 18:12:41 | 000,047,360 | —- | C] (VSO Software) – C:\Users\DOM&EDYTA;\AppData\Roaming\pcouffin.sys
[2009/06/03 12:21:54 | 000,060,928 | —- | C] ( ) – C:\Windows\System32\a3d.dll
[2009/06/03 11:56:56 | 000,012,800 | —- | C] ( ) – C:\Windows\System32\killapps.exe
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/12/01 15:35:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/01 15:32:03 | 000,000,680 | —- | M] () – C:\Users\DOM&EDYTA;\AppData\Local\d3d9caps.dat
[2011/12/01 15:31:00 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\DOM&EDYTA;\Desktop\OTL.exe
[2011/12/01 15:15:46 | 001,008,114 | —- | M] () – C:\Users\DOM&EDYTA;\Desktop\rkill.exe
[2011/12/01 14:13:08 | 000,000,506 | —- | M] () – C:\Windows\tasks\SystemToolsDailyTest.job
[2011/12/01 13:54:12 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/01 13:54:11 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/12/01 13:54:11 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/12/01 13:54:06 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/12/01 13:54:01 | 2950,139,904 | -HS- | M] () – C:\hiberfil.sys
[2011/12/01 12:51:09 | 000,055,468 | —- | M] () – C:\Windows\System32\BMXStateBkp-{00000003-00000000-00000007-00001102-00000005-60021102}.rfx
[2011/12/01 12:51:09 | 000,055,468 | —- | M] () – C:\Windows\System32\BMXState-{00000003-00000000-00000007-00001102-00000005-60021102}.rfx
[2011/12/01 12:51:09 | 000,000,788 | —- | M] () – C:\Windows\System32\DVCState-{00000003-00000000-00000007-00001102-00000005-60021102}.rfx
[2011/12/01 12:51:08 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2011/11/30 20:12:41 | 000,607,260 | R— | M] (Swearware) – C:\Users\DOM&EDYTA;\Desktop\dds.com
[2011/11/30 19:52:22 | 000,294,216 | —- | M] () – C:\Users\DOM&EDYTA;\Desktop\gmer.zip
[2011/11/30 19:51:21 | 000,607,260 | R— | M] (Swearware) – C:\Users\DOM&EDYTA;\Desktop\dds.scr
[2011/11/30 14:19:33 | 000,000,448 | -H– | M] () – C:\Windows\tasks\Norton Security Scan for DOM&EDYTA.job;
[2011/11/30 13:07:00 | 000,000,820 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2011/11/25 14:31:15 | 000,002,531 | —- | M] () – C:\Users\DOM&EDYTA;\Desktop\HiJackThis.lnk
[2011/11/24 23:22:13 | 000,001,666 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/11/23 21:12:05 | 000,000,000 | —- | M] () – C:\Users\DOM&EDYTA;\Desktop\Baxi UK.url
[2011/11/21 20:36:58 | 000,002,075 | —- | M] () – C:\Users\Public\Desktop\Google Earth.lnk
[2011/11/18 21:54:26 | 000,615,806 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/11/18 21:54:26 | 000,111,056 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/11/18 11:36:18 | 000,001,973 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2011/11/09 03:03:21 | 000,001,728 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/11/08 01:08:00 | 000,414,368 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/11/07 23:04:43 | 000,000,203 | —- | M] () – C:\Users\DOM&EDYTA;\Desktop\southernnet.southernrailway.com-.url
[2011/11/07 23:04:43 | 000,000,000 | —- | M] () – C:\Users\DOM&EDYTA;\Desktop\Staff Login Southern Railways.url
[2011/11/07 21:28:38 | 000,056,208 | —- | M] (Trusteer Ltd.) – C:\Windows\System32\drivers\RapportKELL.sys
[2011/11/04 23:10:31 | 000,002,122 | —- | M] () – C:\Users\Public\Desktop\Nero Burning ROM 10.lnk
[2011/11/04 22:22:14 | 000,001,635 | —- | M] () – C:\Users\Public\Desktop\Vuze.lnk
[2011/11/04 22:22:14 | 000,001,635 | —- | M] () – C:\Users\DOM&EDYTA;\Application Data\Microsoft\Internet Explorer\Quick Launch\Vuze.lnk
[2011/11/03 23:50:00 | 000,000,564 | —- | M] () – C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2011/11/01 18:24:49 | 000,043,286 | —- | M] () – C:\Users\DOM&EDYTA;\AppData\Roaming\UserTile.png
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/01 15:15:45 | 001,008,114 | —- | C] () – C:\Users\DOM&EDYTA;\Desktop\rkill.exe
[2011/12/01 03:36:14 | 2950,139,904 | -HS- | C] () – C:\hiberfil.sys
[2011/11/30 19:52:55 | 000,302,592 | —- | C] () – C:\Users\DOM&EDYTA;\Desktop\gmer.exe
[2011/11/30 19:52:22 | 000,294,216 | —- | C] () – C:\Users\DOM&EDYTA;\Desktop\gmer.zip
[2011/11/24 23:22:13 | 000,001,666 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/11/23 21:12:05 | 000,000,000 | —- | C] () – C:\Users\DOM&EDYTA;\Desktop\Baxi UK.url
[2011/11/21 20:36:58 | 000,002,075 | —- | C] () – C:\Users\Public\Desktop\Google Earth.lnk
[2011/11/09 03:03:21 | 000,001,728 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/11/07 23:04:43 | 000,000,203 | —- | C] () – C:\Users\DOM&EDYTA;\Desktop\southernnet.southernrailway.com-.url
[2011/11/07 23:04:43 | 000,000,000 | —- | C] () – C:\Users\DOM&EDYTA;\Desktop\Staff Login Southern Railways.url
[2011/11/07 22:14:10 | 000,000,448 | -H– | C] () – C:\Windows\tasks\Norton Security Scan for DOM&EDYTA.job;
[2011/11/07 22:14:06 | 000,000,172 | —- | C] () – C:\Windows\System32\drivers\NSS\0306000.01F\isolate.ini
[2011/11/04 23:10:31 | 000,002,122 | —- | C] () – C:\Users\Public\Desktop\Nero Burning ROM 10.lnk
[2011/11/01 18:24:49 | 000,043,286 | —- | C] () – C:\Users\DOM&EDYTA;\AppData\Roaming\UserTile.png
[2011/07/26 16:26:48 | 000,030,568 | —- | C] () – C:\Windows\MusiccityDownload.exe
[2011/07/26 16:26:46 | 000,974,848 | —- | C] () – C:\Windows\System32\cis-2.4.dll
[2011/07/26 16:26:46 | 000,081,920 | —- | C] () – C:\Windows\System32\issacapi_bs-2.3.dll
[2011/07/26 16:26:46 | 000,065,536 | —- | C] () – C:\Windows\System32\issacapi_pe-2.3.dll
[2011/07/26 16:26:46 | 000,057,344 | —- | C] () – C:\Windows\System32\issacapi_se-2.3.dll
[2010/09/06 15:05:49 | 000,000,981 | —- | C] () – C:\Windows\eReg.dat
[2010/06/21 17:47:57 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/06/21 17:36:51 | 000,000,768 | —- | C] () – C:\Windows\System32\Remover.ini
[2010/04/30 19:17:11 | 000,033,792 | —- | C] () – C:\Windows\System32\drivers\libusb0.sys
[2010/03/11 21:52:05 | 000,004,984 | —- | C] () – C:\Windows\System32\drivers\nvphy.bin
[2010/02/25 18:40:33 | 000,000,085 | -HS- | C] () – C:\ProgramData\.zreglib
[2009/12/27 14:29:48 | 000,000,036 | —- | C] () – C:\Users\DOM&EDYTA;\AppData\Local\housecall.guid.cache
[2009/11/29 11:45:51 | 000,001,057 | —- | C] () – C:\Users\DOM&EDYTA;\AppData\Roaming\vso_ts_preview.xml
[2009/11/29 11:43:27 | 000,087,608 | —- | C] () – C:\Users\DOM&EDYTA;\AppData\Roaming\inst.exe
[2009/11/08 16:09:21 | 000,000,013 | —- | C] () – C:\Windows\msgtn.ini
[2009/10/21 12:20:08 | 000,005,504 | —- | C] () – C:\Windows\System32\drivers\StarOpen_x86.sys
[2009/09/24 20:24:12 | 000,003,654 | —- | C] () – C:\Windows\System32\drivers\Sonyhcp.dll
[2009/09/23 22:49:19 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/09/23 22:49:19 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/08/07 07:01:50 | 000,000,097 | —- | C] () – C:\Windows\System32\SETUP.DAT
[2009/08/03 14:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 14:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/07/18 18:12:41 | 000,087,608 | —- | C] () – C:\Users\DOM&EDYTA;\AppData\Roaming\ezpinst.exe
[2009/07/18 18:12:41 | 000,007,887 | —- | C] () – C:\Users\DOM&EDYTA;\AppData\Roaming\pcouffin.cat
[2009/07/18 18:12:41 | 000,001,144 | —- | C] () – C:\Users\DOM&EDYTA;\AppData\Roaming\pcouffin.inf
[2009/07/16 09:21:30 | 000,001,492 | —- | C] () – C:\Users\DOM&EDYTA;\AppData\Roaming\wklnhst.dat
[2009/06/30 17:56:23 | 000,091,648 | —- | C] () – C:\Users\DOM&EDYTA;\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/06/17 06:57:08 | 000,000,680 | —- | C] () – C:\Users\DOM&EDYTA;\AppData\Local\d3d9caps.dat
[2009/06/16 16:32:22 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/06/03 13:00:30 | 000,026,928 | —- | C] () – C:\Windows\System32\instwdm.ini
[2009/06/03 13:00:28 | 000,000,054 | —- | C] () – C:\Windows\System32\ctzapxx.ini
[2009/06/03 12:19:42 | 000,002,560 | —- | C] () – C:\Windows\System32\CtxfiRes.dll
[2009/06/03 12:00:34 | 000,016,384 | —- | C] () – C:\Windows\System32\regplib.exe
[2009/06/03 11:57:12 | 000,007,680 | —- | C] () – C:\Windows\System32\enlocstr.exe
[2009/05/26 10:56:08 | 000,000,297 | —- | C] () – C:\Windows\System32\kill.ini
[2008/09/25 09:48:32 | 000,876,544 | —- | C] () – C:\Windows\System32\TEACico2.dll
[2008/09/25 09:48:31 | 000,321,512 | —- | C] () – C:\Windows\System32\ctdlang.dat
[2008/09/25 09:48:31 | 000,056,509 | —- | C] () – C:\Windows\System32\ctdnlstr.dat
[2008/09/25 01:54:44 | 000,000,012 | —- | C] () – C:\Windows\bthservsdp.dat
[2008/09/25 01:10:02 | 000,002,560 | —- | C] () – C:\Windows\CTXFIRES.DLL
[2008/09/25 01:09:56 | 000,148,480 | —- | C] () – C:\Windows\System32\APOMngr.DLL
[2008/09/25 01:09:56 | 000,073,728 | —- | C] () – C:\Windows\System32\CmdRtr.DLL
[2008/02/03 23:11:25 | 000,000,000 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2007/08/16 04:23:28 | 000,040,960 | —- | C] () – C:\Windows\System32\gpyapi.dll
[2007/03/20 15:44:02 | 000,000,566 | —- | C] () – C:\Windows\System32\SP7302.ini
[2007/02/13 10:14:18 | 000,389,120 | —- | C] () – C:\Windows\System32\btwhidcs.dll
[2006/11/02 12:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 12:47:37 | 000,380,440 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 12:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 10:33:01 | 000,615,806 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 10:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 10:33:01 | 000,111,056 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 10:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 10:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 10:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 08:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 08:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 07:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 07:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/09/13 11:06:10 | 000,045,056 | —- | C] () – C:\Windows\System32\gtapi.dll
[2005/12/15 05:17:00 | 000,159,744 | —- | C] () – C:\Windows\System32\EPSPTDV.DLL
[2001/11/14 11:56:00 | 001,802,240 | —- | C] () – C:\Windows\System32\lcppn21.dll

========== LOP Check ==========

[2010/09/14 22:35:30 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Audacity
[2011/12/01 01:11:56 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Azureus
[2010/03/29 14:29:00 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/12/01 15:42:46 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\HandBrake
[2009/10/02 23:36:23 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Microgaming
[2011/01/12 21:51:22 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\PCDr
[2009/11/08 16:08:41 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\ppstream
[2011/10/01 17:52:54 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Radialpoint
[2011/08/12 12:41:33 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Samsung
[2009/08/20 19:47:16 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Template
[2011/07/21 17:33:07 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Tific
[2010/01/23 18:10:49 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Trusteer
[2011/02/04 21:24:16 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\TuneUp Software
[2010/09/08 12:55:03 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Uniblue
[2011/09/13 12:27:28 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\uTorrent
[2011/10/01 15:41:57 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Virgin Media
[2011/10/29 07:56:34 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Vso
[2011/11/03 23:50:00 | 000,000,564 | —- | M] () – C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
[2011/12/01 12:51:08 | 000,032,646 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2011/12/01 14:13:08 | 000,000,506 | —- | M] () – C:\Windows\Tasks\SystemToolsDailyTest.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:6971CCC5

< End of report >



OTL Extras logfile created on: 01/12/2011 15:33:24 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\DOM&EDYTA;\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.75 Gb Total Physical Memory | 1.40 Gb Available Physical Memory | 50.86% Memory free
5.70 Gb Paging File | 4.04 Gb Available in Paging File | 70.84% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 921.44 Gb Total Space | 566.07 Gb Free Space | 61.43% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 4.82 Gb Free Space | 48.18% Space Free | Partition Type: NTFS

Computer Name: DOM-PC | User Name: DOM&EDYTA; | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] – C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 1
"InternetSettingsDisableNotify" = 1
"AutoUpdateDisableNotify" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 1
"FirewallOverride" = 1
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\PPStream\PPStream.exe" = C:\Program Files\PPStream\PPStream.exe:*:Enabled:PPSÍøÂçµçÊÓ
"C:\Program Files\PPStream\PPSAP.exe" = C:\Program Files\PPStream\PPSAP.exe:*:Enabled:PPS ÍøÂç¼ÓËÙÆ÷


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6B74A3C9-562B-4396-AAB0-4FA3D23C2DED}" = lport=2869 | protocol=6 | dir=in | app=system |
"{82F04C30-777B-49A3-BE86-7651643B4E8C}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{B3562355-F30C-4158-9B91-5CDD7976BA68}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{F955286A-485B-496B-9305-A23027CC3604}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{FF04C55D-D83B-494D-982D-4337A9B568FD}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2038DA13-9511-4669-960F-D61ECA240865}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{2611EA9A-2028-460D-831D-CC211CCE6CA5}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{41C54273-CE91-4E0B-B933-7F97437BED6C}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{44D73438-6351-47D6-AE8A-CB6F94AF6688}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{47811787-3EDD-495D-927F-71B2935978CB}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{5163452A-AC8B-4CC7-ADE9-A835AAC7616C}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe |
"{567E27E5-E43A-4CFC-914E-CA07956B1F87}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{57FEA39E-70D6-4037-B45A-911CBAF4BF1E}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{6B1FB1DC-FC74-4B0D-BCE1-CEAC8B71CE8F}" = protocol=6 | dir=in | app=c:\program files\virgin media\service manager\servicepointservice.exe |
"{6C2576D4-0293-4EF0-96D6-A33570E0AA7B}" = protocol=17 | dir=in | app=c:\program files\virgin media\service manager\servicepointservice.exe |
"{74E93129-5552-4DA6-8F31-4A014EA07CA1}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe |
"{B085185E-75F9-4F7C-9BE5-B96CF84E3F74}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B4E55BB3-C83E-4F97-A97B-CD66CF4E0F53}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{B763A54C-3B34-4F73-9FBC-AB85F9958690}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{D46EDB1E-3898-4E72-89D8-B8EA91F5684B}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{DD6BF723-F5A6-4706-99AE-FFB135B700C1}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{F5BD868B-857B-4B76-8040-048A98FC6A56}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0090A87C-3E0E-43D4-AA71-A71B06563A4A}" = Dell Support Center
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.0.1.4300
"{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{17504ED4-DB08-40A8-81C2-27D8C01581DA}" = Windows Live Remote Service Resources
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18F11181-EA1A-42AE-AF89-4867C7F7A6FA}" = Sound Blaster X-Fi
"{190D0C6E-C8A7-4019-8FB5-FD041EC1F2D2}" = Mobile Broadband Drivers
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1DD81E7D-0D28-4CEB-87B2-C041A4FCB215}" = Rapport
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 29
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{294BF709-D758-4363-8D75-01479AD20927}" = Windows Live Family Safety
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3127F76D-5335-4AC7-BD1E-2F5247A23C24}" = iTunes
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{42929F0F-CE14-47AF-9FC7-FF297A603021}" = Dell Resource CD
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{464B3406-A4D0-4914-910F-7CA4380DCC13}" = Windows Live Remote Client Resources
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)
"{5887D64D-2663-43FB-B4BD-7464C56AB425}" = NVIDIA System Monitor
"{58B2B6D3-E5FF-4D16-87AC-52CC5717C7C6}" = Tiscali Internet
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5AD839E7-BFA7-4796-B2CA-B1D824ECCDF7}" = Virgin Media Security
"{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}" = Sony USB Driver
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6B7B6D4D-8F9B-4CB3-8CA4-BCA9CC4C1A22}" = EDocs
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{714048C6-7703-4059-A8EC-17B31AAB73A2}" = RPS RpsCore
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{73C2BB36-ABE5-4E02-A043-E6C0F91A3E2C}" = PC VGA Camer@ Plus
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{7673108D-9DED-4454-9712-FB2771D94446}" = RPS PerfectDiskStub
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7A5D731D-B4B3-490E-B339-75685712BAAB}" = Nero Burning ROM 10
"{7B738CD9-D107-48C7-8E65-2E6639A39C8D}" = PerfectDisk 10 Professional
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}" = NVIDIA Performance
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-007A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{9B6B24BE-80E7-46C4-9FA5-B167D5E0F345}" = Nero BurningROM 10 Help (CHM)
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A4B9033B-D183-4A6C-9BCB-6BC8F80B939D}" = RPS CRT
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.1)
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D5068583-D569-468B-9755-5FBF5848F46F}" = Sony Picture Utility
"{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.3
"{DB6AB705-C9BD-40E3-8929-2EA57F36A4FF}_is1" = ConvertXtoDVD 4.1.7.343
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and ConquerTM Generals Zero Hour
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F53D678E-238F-4A71-9742-08BB6774E9DC}" = Windows Live Family Safety
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone Configuration Utility
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner
"{FE83F463-7E61-4B18-9FA0-B94B90A0B6B9}" = Nero Burning ROM 10
"8461-7759-5462-8226" = Vuze
"ActiveScan 2.0" = Panda ActiveScan 2.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"ALchemy X-Fi" = Creative ALchemy (X-Fi Edition)
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.12 (Unicode)
"AviSynth" = AviSynth 2.5
"CCleaner" = CCleaner
"CloneDVD2" = CloneDVD2
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Dell Support Center" = Dell Support Center
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX Setup
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EPSON Printer and Utilities" = EPSON Printer Software
"EPSON Scanner" = EPSON Scan
"Google Chrome" = Google Chrome
"Google Desktop" = Google Desktop
"Google Updater" = Google Updater
"InstallShield_{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"InstallShield_{5887D64D-2663-43FB-B4BD-7464C56AB425}" = NVIDIA System Monitor
"InstallShield_{73C2BB36-ABE5-4E02-A043-E6C0F91A3E2C}" = PC VGA Camer@ Plus
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}" = NVIDIA Performance
"InstallShield_{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and ConquerTM Generals Zero Hour
"LAME for Audacity_is1" = LAME v3.98.2 for Audacity
"LibUSB-Win32_is1" = LibUSB-Win32-0.1.10.1
"Magic DVD Ripper_is1" = Magic DVD Ripper V5.4
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"NSS" = Norton Security Scan
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"RadialpointClientGateway_is1" = Virgin Media Service Manager 3.7.47
"RadialpointHomeSecurityDashboard_is1" = Virgin Media Digital Home Support 2.1.27
"RadialpointSecurityAdvisorService_is1" = Radialpoint Security Advisor 2.5.19
"Rapport_msi" = Rapport
"Total Video Converter 3.50_is1" = Total Video Converter 3.50
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"YouTube Downloader App" = YouTube Downloader App 1.03

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"f031ef6ac137efc5" = Dell Driver Download Manager

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 01/12/2011 10:15:09 | Computer Name = DOM-PC | Source = PC-Doctor | ID = 1
Description = (5732) Asapi: (14:15:09:5960)(5732) engine.EngineLink - Error – 81
Invalid connection to client

Error - 01/12/2011 10:15:09 | Computer Name = DOM-PC | Source = PC-Doctor | ID = 1
Description = (5732) Asapi: (14:15:09:7160)(5732) engine.EngineLink - Error – 81
Invalid connection to client

Error - 01/12/2011 10:15:09 | Computer Name = DOM-PC | Source = PC-Doctor | ID = 1
Description = (5732) Asapi: (14:15:09:8360)(5732) engine.EngineLink - Error – 81
Invalid connection to client

Error - 01/12/2011 10:15:09 | Computer Name = DOM-PC | Source = PC-Doctor | ID = 1
Description = (5732) Asapi: (14:15:09:9560)(5732) engine.EngineLink - Error – 81
Invalid connection to client

Error - 01/12/2011 10:15:10 | Computer Name = DOM-PC | Source = PC-Doctor | ID = 1
Description = (5732) Asapi: (14:15:10:0760)(5732) engine.EngineLink - Error – 81
Invalid connection to client

Error - 01/12/2011 10:15:10 | Computer Name = DOM-PC | Source = PC-Doctor | ID = 1
Description = (5732) Asapi: (14:15:10:1960)(5732) engine.EngineLink - Error – 81
Invalid connection to client

Error - 01/12/2011 10:15:10 | Computer Name = DOM-PC | Source = PC-Doctor | ID = 1
Description = (5732) Asapi: (14:15:10:3160)(5732) engine.EngineLink - Error – 81
Invalid connection to client

Error - 01/12/2011 10:15:10 | Computer Name = DOM-PC | Source = PC-Doctor | ID = 1
Description = (5732) Asapi: (14:15:10:4370)(5732) engine.EngineLink - Error – 81
Invalid connection to client

Error - 01/12/2011 10:15:10 | Computer Name = DOM-PC | Source = PC-Doctor | ID = 1
Description = (5732) Asapi: (14:15:10:5570)(5732) engine.EngineLink - Error – 81
Invalid connection to client

Error - 01/12/2011 10:15:10 | Computer Name = DOM-PC | Source = PC-Doctor | ID = 1
Description = (5732) Asapi: (14:15:10:6770)(5732) engine.EngineLink - Error – 81
Invalid connection to client

[ System Events ]
Error - 30/11/2011 23:32:52 | Computer Name = DOM-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 30/11/2011 23:32:52 | Computer Name = DOM-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 30/11/2011 23:32:52 | Computer Name = DOM-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 30/11/2011 23:32:52 | Computer Name = DOM-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 30/11/2011 23:37:44 | Computer Name = DOM-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 30/11/2011 23:38:06 | Computer Name = DOM-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 01/12/2011 08:48:32 | Computer Name = DOM-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 01/12/2011 08:48:55 | Computer Name = DOM-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 01/12/2011 09:55:34 | Computer Name = DOM-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 01/12/2011 09:55:53 | Computer Name = DOM-PC | Source = Service Control Manager | ID = 7026
Description =


< End of report >
Hi dom1978111,

Download Combofix from either of the links below, and save it to your desktop.
Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.
Hello again

Combofix.txt

ComboFix 11-12-01.02 - DOM&EDYTA 01/12/2011 18:22:09.1.4 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2813.1309 [GMT 0:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Virgin Media Security Anti-Virus *Disabled/Updated* {A61154FD-4365-E00F-9A33-13A09AD54B56}
FW: Virgin Media Security Firewall *Disabled* {9E2AD5D8-090A-E157-B16C-BA9564060C2D}
SP: Virgin Media Security Anti-Spyware *Disabled/Updated* {1D70B519-655F-EF81-A083-28D2E15201EB}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\muzapp.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-11-01 to 2011-12-01 )))))))))))))))))))))))))))))))
.
.
2011-12-01 18:38 . 2011-12-01 18:39 ——– d—–w- c:\users\DOM&EDYTA\AppData\Local\temp
2011-12-01 18:38 . 2011-12-01 18:38 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-12-01 13:54 . 2011-12-01 13:54 56200 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{14F2C18B-C7AB-425F-AE72-9A7BFFDD1C0E}\offreg.dll
2011-11-30 00:08 . 2011-10-07 03:48 6668624 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{14F2C18B-C7AB-425F-AE72-9A7BFFDD1C0E}\mpengine.dll
2011-11-25 14:28 . 2011-11-25 14:28 388096 —-a-r- c:\users\DOM&EDYTA\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-11-24 23:21 . 2011-11-24 23:21 ——– d—–w- c:\program files\iPod
2011-11-24 23:21 . 2011-11-24 23:22 ——– d—–w- c:\program files\iTunes
2011-11-16 00:22 . 2009-06-30 10:37 28552 —-a-w- c:\windows\system32\drivers\pavboot.sys
2011-11-09 03:03 . 2011-11-09 03:03 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
2011-11-09 03:03 . 2011-11-09 03:03 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
2011-11-09 03:03 . 2011-11-09 03:03 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2011-11-09 03:03 . 2011-11-09 03:03 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2011-11-09 03:03 . 2011-11-09 03:03 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2011-11-09 03:03 . 2011-11-09 03:03 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2011-11-09 03:03 . 2011-11-09 03:03 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2011-11-09 03:03 . 2011-11-09 03:03 ——– d—–w- c:\program files\QuickTime
2011-11-08 23:52 . 2011-10-17 11:41 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-11-08 23:52 . 2011-09-20 21:02 905088 —-a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-08 23:52 . 2011-09-30 15:57 707584 —-a-w- c:\program files\Common Files\System\wab32.dll
2011-11-07 22:14 . 2011-11-07 22:14 ——– d—–w- c:\windows\system32\drivers\NSS
2011-11-07 22:14 . 2011-11-07 22:14 ——– d—–w- c:\program files\Norton Security Scan
2011-11-07 22:14 . 2011-11-07 22:14 ——– d—–w- c:\program files\NortonInstaller
2011-11-07 21:28 . 2011-11-07 21:28 56208 —-a-w- c:\windows\system32\drivers\RapportKELL.sys
2011-11-04 23:11 . 2011-11-04 23:23 ——– d—–w- c:\users\DOM&EDYTA\AppData\Roaming\Nero
2011-11-04 23:09 . 2011-11-04 23:09 ——– d—–w- c:\program files\Common Files\Nero
2011-11-04 23:09 . 2011-11-04 23:11 ——– d—–w- c:\program files\Nero
2011-11-04 23:09 . 2011-11-04 23:11 ——– d—–w- c:\programdata\Nero
2011-11-04 22:45 . 2011-11-04 23:04 ——– d—–w- c:\program files\Ask.com
2011-11-04 22:44 . 2008-10-15 06:22 4379984 —-a-w- c:\windows\system32\D3DX9_40.dll
2011-11-04 22:44 . 2007-05-16 16:45 3497832 —-a-w- c:\windows\system32\d3dx9_34.dll
2011-11-04 22:25 . 2011-11-04 22:25 ——– d—–w- c:\users\DOM&EDYTA\.swt
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-08 01:08 . 2011-06-17 22:29 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-24 14:29 . 2011-10-24 14:29 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-10-24 14:29 . 2011-10-24 14:29 69632 —-a-w- c:\windows\system32\QuickTime.qts
2011-10-03 05:06 . 2010-05-16 16:15 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-10-01 14:24 . 2011-10-01 14:24 53192 —-a-w- c:\windows\system32\drivers\rp_skt32.sys
2011-10-01 14:23 . 2011-10-01 14:24 48384 —-a-w- c:\windows\system32\drivers\rp_pkt32.sys
2011-09-06 13:30 . 2011-10-13 12:11 2043392 —-a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-05-21 12:17 1233288 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-21 1233288]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-21 1233288]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nTune"="c:\program files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe" [2008-05-30 110592]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-25 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"Bluetooth HCI Monitor"="HCIMNTR.DLL" [2006-12-07 9728]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-23 13531680]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-23 92704]
"NVRaidService"="c:\windows\system32\nvraidservice.exe" [2008-01-03 184864]
"VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2007-04-17 184320]
"CTxfiHlp"="CTXFIHLP.EXE" [2009-06-03 25600]
"ServiceManager.exe"="c:\program files\Virgin Media\Service Manager\ServiceManager.exe" [2011-03-25 4371768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-2-13 715568]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HsdService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Radialpoint Security Services]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^DOM&EDYTA^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=c:\users\DOM&EDYTA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnk.Startup
backupExtension=.Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 11:55 937920 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2011-09-27 06:22 59240 —-a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DHSClient.exe]
2011-03-23 13:12 2032952 —-a-w- c:\program files\Virgin Media\Digital Home Support\DHSClient.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-07-28 23:08 1259376 —-a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2008-09-25 01:14 29744 —-a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 11:44 31072 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-11-13 00:24 421736 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper]
2011-07-26 19:23 958352 —-a-w- c:\program files\Samsung\Kies\KiesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR]
2011-07-26 19:23 20880 —-a-w- c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
2011-07-26 19:23 3507088 —-a-w- c:\program files\Samsung\Kies\KiesTrayAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-08-31 16:00 449608 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2011-08-31 16:00 1047208 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-11-10 01:54 4240760 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 14:28 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-06-15 14:02 15141768 —-a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-09-25 01:14 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-21 02:23 1008184 —-a-w- c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"UpdReg"=c:\windows\UpdReg.EXE
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiSpywareOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1c9f379c900cf25;Google Update Service (gupdate1c9f379c900cf25);c:\program files\Google\Update\GoogleUpdate.exe [2009-06-22 133104]
R3 Creative ALchemy AL1 Licensing Service;Creative ALchemy AL1 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\AL1Licensing.exe [2008-09-25 79360]
R3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.SYS [2009-06-03 171032]
R3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.SYS [2009-06-03 1324056]
R3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.SYS [2009-06-03 72728]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2011-07-20 77624]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-06-22 133104]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [2009-07-18 47360]
R3 RapportKELL;RapportKELL;c:\windows\system32\Drivers\RapportKELL.sys [2011-11-07 56208]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2011-07-20 181432]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-06-30 28552]
S0 RadialpointIDSEH;RadialpointIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2009-11-02 25608]
S1 RapportBuka;RapportBuka;c:\windows\system32\drivers\RapportBuka.sys [2010-02-25 390528]
S1 RapportCerberus_32301;RapportCerberus_32301;c:\programdata\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_32301.sys [2011-11-07 227312]
S1 RapportEI;RapportEI;c:\program files\Trusteer\Rapport\bin\RapportEI.sys [2011-11-07 71440]
S1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [2011-11-07 164112]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 HsdService;HsdService;c:\program files\Virgin Media\Digital Home Support\HsdService.exe [2011-03-23 1406264]
S2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;c:\windows\system32\libusbd-nt.exe [2005-03-09 18944]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [2010-05-04 503080]
S2 Radialpoint Security Services;Virgin Media Security;c:\program files\Virgin Media\Security\RpsSecurityAwareR.exe [2010-01-04 165408]
S2 RadialpointIDSAgent;RadialpointIDSAgent;c:\program files\Virgin Media\Security\AVG\Identity Protection\agent\Bin\AVGIDSAgent.exe RadialpointIDSAgent [x]
S2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [2011-11-07 931640]
S2 ServicepointService;ServicepointService;c:\program files\Virgin Media\Service Manager\ServicepointService.exe [2011-03-25 689464]
S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.SYS [2009-06-03 171032]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.SYS [2009-06-03 1324056]
S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.SYS [2009-06-03 72728]
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2005-03-09 33792]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
S3 RadialpointIDSDriver;RadialpointIDSDriver;c:\program files\Virgin Media\Security\AVG\Identity Protection\agent\drivers\AVGIDSDriver.sys [2009-11-02 122376]
S3 RadialpointIDSFilter;RadialpointIDSFilter;c:\program files\Virgin Media\Security\AVG\Identity Protection\agent\drivers\AVGIDSFilter.sys [2009-11-02 30216]
S3 RadialpointIDSShim;RadialpointIDSShim;c:\program files\Virgin Media\Security\AVG\Identity Protection\agent\drivers\AVGIDSShim.sys [2009-11-02 27800]
S3 RapportIaso;RapportIaso;c:\programdata\trusteer\rapport\store\exts\rapportms\28896\rapportiaso.sys [2011-08-08 21520]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - 7F3C49DF
*NewlyCreated* - FDA6EFDF
*Deregistered* - 7f3c49df
*Deregistered* - fda6efdf
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
bdx REG_MULTI_SZ scan sysagent
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-30 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-09-25 09:20]
.
2011-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-22 20:41]
.
2011-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-22 20:41]
.
2011-11-30 c:\windows\Tasks\Norton Security Scan for DOM&EDYTA.job
- c:\progra~1\NORTON~2\Engine\360~1.31\Nss.exe [2011-11-07 23:47]
.
2011-11-03 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-06-21 18:08]
.
2011-12-01 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-06-21 18:08]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.bbc.co.uk/news/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = [removed] [removed]
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-01 18:39
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTxfiHlp = CTXFIHLP.EXE?
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2c,3c,b5,c0,31,b4,5e,47,aa,c4,d4,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2c,3c,b5,c0,31,b4,5e,47,aa,c4,d4,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-12-01 19:01:02
ComboFix-quarantined-files.txt 2011-12-01 19:00
.
Pre-Run: 610,056,839,168 bytes free
Post-Run: 609,966,428,160 bytes free
.
- - End Of File - - 8B64D93F294BD9CE9C5800BF399A1D4A
Hi dom,

I see that you have remnants of both Norton Internet Security and McAfee on your system. You can use the tools below to remove these completely. :) Let me know when you have finished and we can continue.

Norton

McAfee
Hi dom,

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
    File::
     c:\program files\Ask.com\GenericAskToolbar.dll
     C:\Windows\System32\BMXStateBkp-{00000003-00000000-00000007-00001102-00000005-60021102}.rfx
     C:\Windows\System32\BMXState-{00000003-00000000-00000007-00001102-00000005-60021102}.rfx
     C:\Windows\System32\DVCState-{00000003-00000000-00000007-00001102-00000005-60021102}.rfx
     C:\Users\DOM&EDYTA\AppData\Roaming\inst.exe
     C:\Users\DOM&EDYTA\AppData\Roaming\pcouffin.cat
     C:\Users\DOM&EDYTA\AppData\Roaming\pcouffin.inf
     C:\Users\DOM&EDYTA\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
     
     Folder::
     c:\program files\Ask.com
     
     Registry::
     [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
     [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
     "{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
     [-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
     [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
     [-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
     [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
     [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
     "{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
     [-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
     [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
     [-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
     [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
     
     RegLock::
     [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
     [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
     [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
     [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI