Spyware / Malware / Virus Removal
PING.exe [Closed]
33 min read
Page 1 of 6
Next →
This thread's last reply is from December 22, 2011, 10:13 PM UTC . Advice, software, and links
below may be out of date — treat specific steps and download links with caution.
Looking for the outcome? ✨ Ask AI
ok.. so i got a current HjT log this is like right after it started running i started the HjT program… what do i do to fix this?:
ok.. so i got a current HjT log this is like right after it started running i started the HjT program… what do i do to fix this?:
ok.. so i got a current HjT log this is like right after it started running i started the HjT program… what do i do to fix this?:
Do not start any new topics, just reply to this one using
ADD REPLY
Download
aswMBR.exe ( 511KB ) to your desktop.
Double click the aswMBR.exe to run it
Click the "Scan" button to start scan
[external image: Posted Image]
On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]
Download
DDS from one of the links below to your desktop
Link 1 Link 2 Double click the tool to run it.A black Screen will open, just read the contents and do nothing. When the tool finishes, it will open 2 reports, DDS.txt and attach.txt Copy/Paste the contents of 'DDS.txt' into your post. 'attach.txt' should be zipped using Windows native zip utility and attached to your post. Compress and uncompress files (zip files)
A) thankyou for taking the time to look at this with me. i appreciate it. and sorry about the tripple posts… my internet is acting a little screwy.
I have an option to update virus definitions with online avast… i am doing that. i will post logs in just moment.
BAD_POOL_HEADER error… blue screen of death mid scan… comp crashed… lots of red lines before it crashed… will rescan.
aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-12-01 00:29:28
—————————–
00:29:28.544 OS Version: Windows x64 6.1.7601 Service Pack 1
00:29:28.544 Number of processors: 8 586 0x2A07
00:29:28.544 ComputerName: TONY-HP UserName: Tony
00:29:30.806 Initialize success
00:29:34.613 AVAST engine defs: 11113001
00:29:40.525 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
00:29:40.525 Disk 0 Vendor: TOSHIBA_ GL00 Size: 953869MB BusType: 3
00:29:40.541 Disk 0 MBR read successfully
00:29:40.541 Disk 0 MBR scan
00:29:40.541 Disk 0 unknown MBR code
00:29:40.541 Service scanning
00:29:42.553 Modules scanning
00:29:42.553 Disk 0 trace - called modules:
00:29:42.615 ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys iaStor.sys hal.dll
00:29:42.615 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800804d790]
00:29:42.615 3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa8007f59b10]
00:29:42.615 5 hpdskflt.sys[fffff88001b9b189] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8007a4e050]
00:29:52.350 AVAST engine scan C:\
00:54:24.975 File: C:\Users\Tony\AppData\Local\Temp\Low\msimg32.dll **INFECTED** Win32:MalOb-HP [Cryp]
00:55:01.245 File: C:\Windows\assembly\GAC_64\Desktop.ini **INFECTED** Win32:Malware-gen
00:55:55.923 File: C:\Windows\assembly\temp\U\80000032.@ **INFECTED** Win32:DNSChanger-VJ [Trj]
01:00:42.602 File: C:\Windows\System32\consrv.dll **INFECTED** Win32:Malware-gen
01:19:03.874 Disk 0 MBR has been saved successfully to "C:\Users\Tony\Desktop\MBR.dat"
01:19:03.875 The log file has been saved successfully to "C:\Users\Tony\Desktop\aswMBR.txt"
there is also and MBR.dat file saved to my desk top.. gonna leave it alone for now.
uh… this is wrong… it is apparently still scanning? ~ it stopped and started on me again? *sighs* i'm probably an idiot and just hit restart or something lol. - there isn't a delete option on here is there?
Just let it finish scanning. MBR.dat is a back up of your master boot record in case we need to reinstall it, dont fool with it, just leave it be.
This system is heavily infected, can you get DDS to run and post the log
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29
Run by [removed] at 2:39:50 on 2011-12-01
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8174.6285 [GMT -7:00]
.
AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Lavasoft Ad-Watch Live! *Enabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\IDT\WDM\STacSV64.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Hpservice.exe
C:\Windows\system32\vcsFPService.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atieclxx.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Program Files\IDT\WDM\AESTSr64.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\SysWOW64\RunDll32.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Windows\system32\taskmgr.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uSearch Bar = Preserve
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
mWinlogon: Userinit=userinit.exe
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
uRun: [Corel Photo Downloader] "C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
mRun: []
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
mRun: [Corel File Shell Monitor] c:\Program Files (x86)\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\CorelIOMonitor.exe
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BTTray.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SNAPFI~1.LNK - C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
LSP: mswsock.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{1D586EF4-8011-4DD6-BAD2-3280827F2C4D} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{1D586EF4-8011-4DD6-BAD2-3280827F2C4D}\E4544574541425D22343D274 : DhcpNameServer = 192.168.1.1
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2 sxssrv,4
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
BHO-X64: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
BHO-X64: 0x1 - No File
BHO-X64: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO-X64: HP Print Enhancer - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO-X64: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
BHO-X64: HP Smart BHO Class - No File
TB-X64: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File
mRun-x64: [(Default)]
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
mRun-x64: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun-x64: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
mRun-x64: [Corel File Shell Monitor] c:\Program Files (x86)\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\CorelIOMonitor.exe
mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Hosts: 217.23.4.166 www.google-analytics.com.
Hosts: 217.23.4.166 ad-emea.doubleclick.net.
Hosts: 217.23.4.166 www.statcounter.com.
Hosts: 178.250.45.15 www.google-analytics.com.
Hosts: 178.250.45.15 ad-emea.doubleclick.net.
.
Note: multiple HOSTS entries found. Please refer to Attach.txt
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\b57io866.default\
FF - prefs.js: browser.startup.homepage - hxxp://forum.bodybuilding.com/forumdisplay.php?f=19
FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\Default\AppData\Local\HuluDesktop\instances\0.9.13.1\nphdplg.dll
FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R0 Lbd;Lbd;C:\Windows\system32\DRIVERS\Lbd.sys –> C:\Windows\system32\DRIVERS\Lbd.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys –> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2011-11-18 89600]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe –> C:\Windows\system32\atiesrxx.exe [?]
R2 HP Wireless Assistant Service;HP Wireless Assistant Service;C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-7-21 103992]
R2 HPAuto;HP Auto;C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [2010-8-5 681528]
R2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-8-5 291896]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-5-21 103992]
R2 hpsrv;HP Service;C:\Windows\system32\Hpservice.exe –> C:\Windows\system32\Hpservice.exe [?]
R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-9-28 26680]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-18 13336]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-8-18 2152152]
R2 RoxioNow Service;RoxioNow Service;C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-9-11 399344]
R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-11-18 2655768]
R2 vcsFPService;Validity VCS Fingerprint Service;C:\Windows\System32\vcsFPService.exe [2010-2-23 1799472]
R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys –> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys –> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
R3 btwampfl;Bluetooth AMP USB Filter;C:\Windows\system32\drivers\btwampfl.sys –> C:\Windows\system32\drivers\btwampfl.sys [?]
R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\system32\DRIVERS\btwl2cap.sys –> C:\Windows\system32\DRIVERS\btwl2cap.sys [?]
R3 clwvd;HP Webcam Splitter;C:\Windows\system32\DRIVERS\clwvd.sys –> C:\Windows\system32\DRIVERS\clwvd.sys [?]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys [2011-11-24 17152]
R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys –> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\system32\DRIVERS\NETwNs64.sys –> C:\Windows\system32\DRIVERS\NETwNs64.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys –> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys –> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
S2 CLKMSVC10_C6F09094;CyberLink Product - 2011/11/18 13:57:59;C:\Program Files (x86)\Hewlett-Packard\Media\DVD\Kernel\HDDVD\NavFilter\kmsvc.exe [2011-11-18 245232]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys –> C:\Windows\system32\DRIVERS\netw5v64.sys [?]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys –> C:\Windows\system32\Drivers\RtsUStor.sys [?]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS –> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS –> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS –> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys –> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys –> C:\Windows\system32\Drivers\usbaapl64.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys –> C:\Windows\system32\DRIVERS\yk62x64.sys [?]
.
=============== Created Last 30 ================
.
2011-12-01 08:37:06 ——– d—–w- C:\Users\Tony\AppData\Local\ElevatedDiagnostics
2011-12-01 06:08:56 69000 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A29B3BF3-542B-448B-B800-A3440CDF3F2E}\offreg.dll
2011-12-01 05:51:36 ——– d—–w- C:\Users\Tony\AppData\Roaming\Visan
2011-12-01 05:51:36 ——– d—–w- C:\ProgramData\Visan
2011-12-01 05:49:48 ——– d—–w- C:\ProgramData\WEBREG
2011-12-01 05:47:01 230400 —-a-w- C:\Windows\System32\Spool\prtprocs\x64\hpzppw71.dll
2011-12-01 05:37:25 ——– d—–w- C:\Windows\pss
2011-12-01 05:30:33 902656 —-a-w- C:\Windows\System32\d2d1.dll
2011-12-01 05:30:33 739840 —-a-w- C:\Windows\SysWow64\d2d1.dll
2011-12-01 05:30:33 1544192 —-a-w- C:\Windows\System32\DWrite.dll
2011-12-01 05:30:33 1139200 —-a-w- C:\Windows\System32\FntCache.dll
2011-12-01 05:30:33 1076736 —-a-w- C:\Windows\SysWow64\DWrite.dll
2011-12-01 05:22:47 ——– d—–w- C:\Program Files (x86)\Yahoo!
2011-12-01 05:22:43 ——– d—–w- C:\Users\Tony\AppData\Roaming\HpUpdate
2011-12-01 05:22:34 ——– d—–w- C:\Program Files (x86)\Coupons
2011-12-01 05:21:42 ——– d—–w- C:\Program Files (x86)\Common Files\HP
2011-12-01 05:21:30 ——– d—–w- C:\Program Files (x86)\Common Files\Hewlett-Packard
2011-11-29 11:22:03 8570192 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A29B3BF3-542B-448B-B800-A3440CDF3F2E}\mpengine.dll
2011-11-29 02:42:08 ——– d—–w- C:\Users\Tony\AppData\Local\Apple Computer
2011-11-29 02:41:40 34152 —-a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys
2011-11-29 02:41:40 126312 —-a-w- C:\Windows\System32\GEARAspi64.dll
2011-11-29 02:41:40 107368 —-a-w- C:\Windows\SysWow64\GEARAspi.dll
2011-11-29 02:40:51 ——– d—–w- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2011-11-29 02:40:51 ——– d—–w- C:\Program Files\iTunes
2011-11-29 02:40:51 ——– d—–w- C:\Program Files\iPod
2011-11-29 02:40:51 ——– d—–w- C:\Program Files (x86)\iTunes
2011-11-29 02:40:29 ——– d—–w- C:\Users\Tony\AppData\Local\Apple
2011-11-29 02:40:03 ——– d—–w- C:\Program Files\Bonjour
2011-11-29 02:40:03 ——– d—–w- C:\Program Files (x86)\Bonjour
2011-11-29 02:38:48 ——– d—–w- C:\itunes
2011-11-27 07:05:27 ——– d—–w- C:\Users\Tony\AppData\Local\CyberLink
2011-11-27 07:05:26 ——– d—–w- C:\Users\Tony\AppData\Local\PowerCinema
2011-11-26 02:13:25 8507392 —-a-w- C:\Windows\System32\drivers\NETwNs64.sys
2011-11-26 02:13:25 799232 —-a-w- C:\Windows\System32\NETwNc64.dll
2011-11-26 02:13:25 2750464 —-a-w- C:\Windows\System32\NETwNr64.dll
2011-11-24 14:02:48 16432 —-a-w- C:\Windows\System32\lsdelete.exe
2011-11-24 13:55:32 55384 —-a-w- C:\Windows\System32\drivers\SBREDrv.sys
2011-11-24 13:54:10 69376 —-a-w- C:\Windows\System32\drivers\Lbd.sys
2011-11-24 13:54:08 ——– d—–w- C:\Program Files (x86)\Lavasoft
2011-11-24 13:24:17 ——– d—–w- C:\f7bf4a5b04f1dad3f79b7d80c634b0c3
2011-11-24 11:39:27 ——– d—–w- C:\Windows\en
2011-11-24 11:17:16 ——– d—–w- C:\Users\Tony\AppData\Local\Windows Live
2011-11-24 11:16:47 ——– d—–w- C:\Users\Tony\AppData\Roaming\Windows Live Writer
2011-11-24 11:16:47 ——– d—–w- C:\Users\Tony\AppData\Local\Windows Live Writer
2011-11-22 13:12:24 8570192 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-11-21 04:01:50 ——– d—–w- C:\Windows\System32\SPReview
2011-11-21 04:01:27 ——– d—–w- C:\Windows\System32\EventProviders
2011-11-20 20:34:35 203264 —-a-w- C:\Windows\System32\unrar.dll
2011-11-20 20:34:34 86016 —-a-w- C:\Windows\System32\ff_vfw.dll
2011-11-20 20:34:34 ——– d—–w- C:\Program Files\K-Lite Codec Pack x64
2011-11-20 20:29:30 ——– d—–w- C:\Program Files (x86)\FoxTabFLVPlayer
2011-11-20 16:29:38 ——– d—–w- C:\Users\Tony\AppData\Local\FVD Suite
2011-11-20 16:24:16 ——– d—–w- C:\Program Files (x86)\FVD Suite
2011-11-20 14:24:42 ——– d—–w- C:\firefox
2011-11-20 14:22:11 ——– d—–w- C:\Users\Tony\AppData\Local\Adobe
2011-11-20 13:47:56 414368 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-20 13:34:41 ——– d—–w- C:\Users\Tony\AppData\Local\Mozilla
2011-11-20 13:25:30 ——– d—–w- C:\direct x files
2011-11-20 13:16:08 ——– d—–w- C:\Windows\SysWow64\directx
2011-11-20 13:13:52 ——– d—–w- C:\Program Files\Media Player Classic - Home Cinema
2011-11-20 13:11:12 ——– d—–w- C:\Users\Tony\AppData\Local\Programs
2011-11-20 13:01:16 48976 —-a-w- C:\Windows\System32\netfxperf.dll
2011-11-20 13:01:16 1942856 —-a-w- C:\Windows\System32\dfshim.dll
2011-11-20 13:01:08 1130824 —-a-w- C:\Windows\SysWow64\dfshim.dll
2011-11-20 13:01:02 59392 —-a-w- C:\Windows\System32\drivers\TsUsbFlt.sys
2011-11-20 13:01:02 3715584 —-a-w- C:\Windows\System32\mstscax.dll
2011-11-20 13:01:02 1838080 —-a-w- C:\Windows\System32\d3d10warp.dll
2011-11-20 13:01:02 12288 —-a-w- C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll
2011-11-20 13:01:01 14967808 —-a-w- C:\Program Files\DVD Maker\OmdBase.dll
2011-11-20 12:59:59 705024 —-a-w- C:\Windows\System32\BFE.DLL
2011-11-20 12:58:59 856576 —-a-w- C:\Windows\SysWow64\FirewallControlPanel.dll
2011-11-20 12:57:58 3072 —-a-w- C:\Windows\System32\drivers\en-US\tsusbflt.sys.mui
2011-11-20 12:57:58 2560 —-a-w- C:\Windows\System32\drivers\en-US\rdpwd.sys.mui
2011-11-20 12:57:56 6144 —-a-w- C:\Windows\System32\drivers\en-US\IPMIDrv.sys.mui
2011-11-20 12:57:56 4608 —-a-w- C:\Windows\System32\drivers\en-US\kbdclass.sys.mui
2011-11-20 12:57:55 399872 —-a-w- C:\Windows\System32\dpx.dll
2011-11-20 12:57:55 189952 —-a-w- C:\Windows\SysWow64\wdscore.dll
2011-11-20 12:57:49 189952 —-a-w- C:\Windows\SysWow64\sqmapi.dll
2011-11-20 12:57:40 606208 —-a-w- C:\Windows\SysWow64\wbem\fastprox.dll
2011-11-20 12:57:40 363008 —-a-w- C:\Windows\SysWow64\wbemcomn.dll
2011-11-20 12:57:40 189952 —-a-w- C:\Program Files (x86)\Windows Portable Devices\sqmapi.dll
2011-11-20 12:55:56 529408 —-a-w- C:\Windows\System32\wbemcomn.dll
2011-11-20 12:55:56 244736 —-a-w- C:\Program Files\Windows Portable Devices\sqmapi.dll
2011-11-20 12:55:45 244736 —-a-w- C:\Windows\System32\sqmapi.dll
2011-11-20 12:44:54 ——– d–h–w- C:\ProgramData\Common Files
2011-11-20 12:44:53 ——– d—–w- C:\Program Files (x86)\AVG
2011-11-20 12:42:12 ——– d—–w- C:\ProgramData\MFAData
2011-11-20 12:33:03 1659776 —-a-w- C:\Windows\System32\drivers\ntfs.sys
2011-11-20 12:33:02 96768 —-a-w- C:\Windows\System32\fsutil.exe
2011-11-20 12:33:02 74240 —-a-w- C:\Windows\SysWow64\fsutil.exe
2011-11-20 12:33:02 410496 —-a-w- C:\Windows\System32\drivers\iaStorV.sys
2011-11-20 12:33:02 27008 —-a-w- C:\Windows\System32\drivers\amdxata.sys
2011-11-20 12:33:02 2565632 —-a-w- C:\Windows\System32\esent.dll
2011-11-20 12:33:02 189824 —-a-w- C:\Windows\System32\drivers\storport.sys
2011-11-20 12:33:02 1699328 —-a-w- C:\Windows\SysWow64\esent.dll
2011-11-20 12:33:02 166272 —-a-w- C:\Windows\System32\drivers\nvstor.sys
2011-11-20 12:33:02 148352 —-a-w- C:\Windows\System32\drivers\nvraid.sys
2011-11-20 12:33:02 107904 —-a-w- C:\Windows\System32\drivers\amdsata.sys
2011-11-20 12:32:56 98816 —-a-w- C:\Windows\System32\drivers\usbccgp.sys
2011-11-20 12:32:56 7936 —-a-w- C:\Windows\System32\drivers\usbd.sys
2011-11-20 12:32:56 52736 —-a-w- C:\Windows\System32\drivers\usbehci.sys
2011-11-20 12:32:56 343040 —-a-w- C:\Windows\System32\drivers\usbhub.sys
2011-11-20 12:32:56 325120 —-a-w- C:\Windows\System32\drivers\usbport.sys
2011-11-20 12:32:56 30720 —-a-w- C:\Windows\System32\drivers\usbuhci.sys
2011-11-20 12:32:56 25600 —-a-w- C:\Windows\System32\drivers\usbohci.sys
2011-11-20 12:32:55 80384 —-a-w- C:\Windows\System32\drivers\BTHUSB.SYS
2011-11-20 12:32:55 552960 —-a-w- C:\Windows\System32\drivers\bthport.sys
2011-11-20 12:32:55 229376 —-a-w- C:\Windows\System32\fsquirt.exe
2011-11-20 12:29:57 ——– d—–w- C:\Users\Tony\AppData\Local\Diagnostics
2011-11-20 12:02:40 ——– d—–w- C:\Program Files (x86)\uTorrent
2011-11-20 12:02:05 ——– d—–w- C:\Users\Tony\AppData\Roaming\uTorrent
2011-11-20 12:02:05 ——– d—–w- C:\Users\Tony\AppData\Local\uTorrent
2011-11-20 11:44:21 673048 —-a-w- C:\Program Files (x86)\iexplore.exe
2011-11-20 11:26:26 ——– d—–w- C:\Users\Tony\AppData\Local\CrashDumps
2011-11-20 11:24:38 ——– d—–we C:\Windows\system64
2011-11-20 10:31:58 ——– d—–w- C:\Windows\SysWow64\Wat
2011-11-20 10:31:58 ——– d—–w- C:\Windows\System32\Wat
2011-11-20 10:04:22 ——– d—–w- C:\Program Files (x86)\MSXML 4.0
2011-11-20 05:10:08 ——– d—–w- C:\Program Files (x86)\Apex Fitness
2011-11-20 05:01:00 ——– d—–w- C:\ProgramData\Blizzard Entertainment
2011-11-20 05:01:00 ——– d—–w- C:\Program Files (x86)\StarCraft II
2011-11-20 05:01:00 ——– d—–w- C:\Program Files (x86)\Common Files\Blizzard Entertainment
2011-11-20 04:22:59 86528 —-a-w- C:\Windows\SysWow64\SearchFilterHost.exe
2011-11-20 04:20:46 30208 —-a-w- C:\Windows\System32\dnscacheugc.exe
2011-11-20 04:20:46 28672 —-a-w- C:\Windows\SysWow64\dnscacheugc.exe
2011-11-20 04:20:46 183296 —-a-w- C:\Windows\System32\dnsrslvr.dll
2011-11-20 04:20:03 467456 —-a-w- C:\Windows\System32\drivers\srv.sys
2011-11-20 04:20:03 410112 —-a-w- C:\Windows\System32\drivers\srv2.sys
2011-11-20 04:20:03 168448 —-a-w- C:\Windows\System32\drivers\srvnet.sys
2011-11-20 04:20:01 321024 —-a-w- C:\Windows\System32\d3d10_1core.dll
2011-11-20 04:20:01 219136 —-a-w- C:\Windows\SysWow64\d3d10_1core.dll
2011-11-20 04:20:01 197120 —-a-w- C:\Windows\System32\d3d10_1.dll
2011-11-20 04:20:01 161792 —-a-w- C:\Windows\SysWow64\d3d10_1.dll
2011-11-20 04:15:40 270720 ——w- C:\Windows\System32\MpSigStub.exe
2011-11-20 03:59:15 ——– d—–w- C:\Users\Tony\AppData\Roaming\Blio
2011-11-20 03:52:42 ——– d—–w- C:\Users\Tony\AppData\Local\ATI
2011-11-20 03:52:29 ——– d—–w- C:\Users\Tony\AppData\Roaming\PictureMover
2011-11-20 02:54:16 ——– d—–w- C:\Users\Tony\AppData\Local\Broadcom
2011-11-20 02:54:13 ——– d—–w- C:\Users\Tony\AppData\Roaming\Intel Corporation
2011-11-20 02:54:12 ——– d—–w- C:\Users\Tony\AppData\Roaming\Stardock
2011-11-20 02:54:11 ——– d—–w- C:\Users\Tony\AppData\Roaming\hpqLog
2011-11-20 02:53:24 ——– d—–w- C:\Users\Tony\AppData\Local\RemEngine
2011-11-20 02:48:58 ——– d—–w- C:\Users\Tony\AppData\Local\Hewlett-Packard
2011-11-20 02:48:41 ——– d—–w- C:\Users\Tony\AppData\Local\Hewlett-Packard_Company
2011-11-18 22:15:54 39464 —-a-w- C:\Windows\System32\drivers\btwl2cap.sys
2011-11-18 22:15:54 344616 —-a-w- C:\Windows\System32\drivers\btwampfl.sys
2011-11-18 22:15:54 21544 —-a-w- C:\Windows\System32\drivers\btwrchid.sys
2011-11-18 22:15:54 135720 —-a-w- C:\Windows\System32\drivers\btwavdt.sys
2011-11-18 22:15:54 102952 —-a-w- C:\Windows\System32\drivers\btwaudio.sys
2011-11-18 22:15:28 ——– d—–w- C:\Program Files\WIDCOMM
2011-11-18 22:15:20 ——– d—–w- C:\Program Files (x86)\Microsoft
2011-11-18 22:14:49 ——– d—–w- C:\ProgramData\Downloaded Installations
2011-11-18 22:10:15 ——– d—–w- C:\Program Files (x86)\HP Games
2011-11-18 22:10:12 ——– d—–w- C:\ProgramData\WildTangent
2011-11-18 22:09:26 ——– d—–w- C:\ProgramData\Norton
2011-11-18 22:09:05 ——– d—–w- C:\ProgramData\NortonInstaller
2011-11-18 22:08:39 ——– d—–w- C:\ProgramData\Uninstall
2011-11-18 22:08:21 ——– d—–w- C:\Program Files (x86)\Microsoft WSE
2011-11-18 22:08:16 ——– d—–w- C:\ProgramData\RoxioNow
2011-11-18 22:08:13 ——– d—–w- C:\Program Files (x86)\Roxio
2011-11-18 22:08:01 ——– d—–w- C:\ProgramData\PictureMover
2011-11-18 22:08:01 ——– d—–w- C:\Program Files (x86)\PictureMover
2011-11-18 22:05:44 ——– d—–w- C:\Program Files (x86)\Times Reader
2011-11-18 22:05:31 ——– dc-h–w- C:\ProgramData\{05971B75-B620-4D64-9985-7971BEF763A2}
2011-11-18 22:05:30 ——– d—–w- C:\Program Files\Stardock
2011-11-18 21:55:41 0 —-a-w- C:\Windows\ativpsrm.bin
2011-11-18 21:54:26 53248 —-a-w- C:\Windows\SysWow64\CSVer.dll
2011-11-18 21:54:19 ——– d—–w- C:\Windows\Hewlett-Packard
2011-11-18 21:53:27 ——– d—–w- C:\Windows\Driver Cache
2011-11-18 21:53:27 ——– d—–w- C:\Program Files (x86)\HP
2011-11-18 21:50:56 9112168 —-a-w- C:\Windows\SysWow64\RtsUStoricon.dll
2011-11-18 21:50:56 422504 —-a-w- C:\Windows\System32\RtsUStor.dll
2011-11-18 21:50:56 246376 —-a-w- C:\Windows\System32\drivers\RtsUStor.sys
2011-11-18 21:50:56 ——– d—–w- C:\Program Files (x86)\Realtek
2011-11-18 21:50:22 ——– d—–w- C:\Program Files\Validity Sensors
2011-11-18 21:49:59 437272 —-a-w- C:\Windows\System32\drivers\iaStor.sys
2011-11-18 21:49:56 8192 —-a-w- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll
2011-11-18 21:49:56 8192 —-a-w- C:\Windows\System32\drivers\IntelMEFWVer.dll
2011-11-18 21:49:50 ——– d—–w- C:\Program Files (x86)\Common Files\postureAgent
2011-11-18 21:49:38 ——– d—–w- C:\Program Files\Synaptics
2011-11-18 21:48:11 ——– d—–w- C:\Program Files\ATI
2011-11-18 21:48:09 ——– d—–w- C:\Program Files (x86)\ATI Technologies
2011-11-18 21:38:29 ——– d—–w- C:\Windows\ehome
.
==================== Find3M ====================
.
2011-11-21 04:34:49 175616 —-a-w- C:\Windows\System32\msclmd.dll
2011-11-21 04:34:49 152576 —-a-w- C:\Windows\SysWow64\msclmd.dll
2011-10-03 12:06:03 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll
2011-09-29 16:29:28 1923952 —-a-w- C:\Windows\System32\drivers\tcpip.sys
2011-09-29 04:03:32 3144704 —-a-w- C:\Windows\System32\win32k.sys
.
============= FINISH: 2:43:13.68 ===============
do you want the attach file too?
- also as a side note. i've noticed something about a "console host" pops up and then the PING.exe pops up… i've so far found that supsending the process in resource manager has been most effective method of dealing with it… it only puts it out of comission for about 20-30 minutes though.
while i am here…are these trojans the reason why my windows firewall is also not working?
thanks again for helping me. I appreciate it.
Yes, most likely, you have a real mess going on. We have a lot of work to do
Download
ComboFix from one of these locations:
Link 1 Link 2 * IMPORTANT !!! Save ComboFix.exe to your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our toolsSee this Link Remember to re-enable them when we're done. Double click on ComboFix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
[external image: Posted Image]
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
[external image: Posted Image]
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the
C:\ComboFix.txt in your next reply.
*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
you sir. are awesome btw. and thankyou for the speedy replys at 5am! Here is what it produced:
ComboFix 11-12-01.01 - Tony 12/01/2011 5:18.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8174.6444 [GMT -7:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\iexplore.exe
c:\windows\system32\consrv.dll
c:\windows\System64
.
.
((((((((((((((((((((((((( Files Created from 2011-11-01 to 2011-12-01 )))))))))))))))))))))))))))))))
.
.
2011-12-01 12:24 . 2011-12-01 12:24 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-12-01 05:51 . 2011-12-01 05:51 ——– d—–w- c:\programdata\Visan
2011-12-01 05:49 . 2011-12-01 05:49 ——– d—–w- c:\programdata\WEBREG
2011-12-01 05:47 . 2009-07-14 01:41 230400 —-a-w- c:\windows\system32\Spool\prtprocs\x64\hpzppw71.dll
2011-12-01 05:30 . 2011-02-19 12:05 1139200 —-a-w- c:\windows\system32\FntCache.dll
2011-12-01 05:30 . 2011-02-19 12:04 1544192 —-a-w- c:\windows\system32\DWrite.dll
2011-12-01 05:30 . 2011-02-19 12:04 902656 —-a-w- c:\windows\system32\d2d1.dll
2011-12-01 05:30 . 2011-02-19 06:30 1076736 —-a-w- c:\windows\SysWow64\DWrite.dll
2011-12-01 05:30 . 2011-02-19 06:30 739840 —-a-w- c:\windows\SysWow64\d2d1.dll
2011-12-01 05:22 . 2011-12-01 05:22 ——– d—–w- c:\program files (x86)\Yahoo!
2011-12-01 05:22 . 2011-12-01 05:22 ——– d—–w- c:\programdata\Yahoo! Companion
2011-12-01 05:22 . 2011-12-01 05:22 ——– d—–w- c:\program files (x86)\Coupons
2011-12-01 05:22 . 2011-12-01 05:22 ——– d—–w- c:\programdata\HP Product Assistant
2011-12-01 05:21 . 2011-12-01 05:21 ——– d—–w- c:\program files (x86)\Common Files\HP
2011-12-01 05:21 . 2011-12-01 05:21 ——– d—–w- c:\program files (x86)\Common Files\Hewlett-Packard
2011-12-01 05:20 . 2011-12-01 05:22 ——– d—–w- c:\programdata\HP
2011-11-29 11:22 . 2011-10-18 08:27 8570192 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A29B3BF3-542B-448B-B800-A3440CDF3F2E}\mpengine.dll
2011-11-29 02:41 . 2009-05-18 20:17 34152 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2011-11-29 02:41 . 2008-04-17 19:12 126312 —-a-w- c:\windows\system32\GEARAspi64.dll
2011-11-29 02:41 . 2008-04-17 19:12 107368 —-a-w- c:\windows\SysWow64\GEARAspi.dll
2011-11-29 02:40 . 2011-11-29 02:41 ——– d—–w- c:\programdata\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2011-11-29 02:40 . 2011-11-29 02:41 ——– d—–w- c:\program files\iTunes
2011-11-29 02:40 . 2011-11-29 02:41 ——– d—–w- c:\program files (x86)\iTunes
2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\programdata\Apple Computer
2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files\iPod
2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files (x86)\Apple Software Update
2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files\Common Files\Apple
2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files\Bonjour
2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files (x86)\Bonjour
2011-11-29 02:39 . 2011-11-29 02:40 ——– d—–w- c:\program files (x86)\Common Files\Apple
2011-11-29 02:39 . 2011-11-29 02:40 ——– d—–w- c:\programdata\Apple
2011-11-29 02:38 . 2011-11-29 02:38 ——– d—–w- C:\itunes
2011-11-26 02:13 . 2011-11-26 02:13 8507392 —-a-w- c:\windows\system32\drivers\NETwNs64.sys
2011-11-26 02:13 . 2011-11-26 02:13 799232 —-a-w- c:\windows\system32\NETwNc64.dll
2011-11-26 02:13 . 2011-11-26 02:13 2750464 —-a-w- c:\windows\system32\NETwNr64.dll
2011-11-24 14:02 . 2011-11-24 13:55 16432 —-a-w- c:\windows\system32\lsdelete.exe
2011-11-24 13:55 . 2011-11-24 13:55 55384 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-11-24 13:54 . 2011-11-29 02:41 ——– dc—-w- c:\windows\system32\DRVSTORE
2011-11-24 13:54 . 2011-08-18 22:25 69376 —-a-w- c:\windows\system32\drivers\Lbd.sys
2011-11-24 13:54 . 2011-11-24 13:54 ——– d—–w- c:\programdata\Lavasoft
2011-11-24 13:54 . 2011-11-24 13:54 ——– d—–w- c:\program files (x86)\Lavasoft
2011-11-24 13:24 . 2011-11-24 13:47 ——– d—–w- C:\f7bf4a5b04f1dad3f79b7d80c634b0c3
2011-11-24 11:39 . 2011-11-24 11:39 ——– d—–w- c:\windows\en
2011-11-24 11:37 . 2011-11-24 11:37 ——– d—–w- c:\program files\Windows Live
2011-11-21 05:30 . 2011-11-21 05:30 ——– d—–w- c:\windows\Sun
2011-11-21 04:01 . 2011-11-21 04:01 ——– d—–w- c:\windows\system32\SPReview
2011-11-21 04:01 . 2011-11-21 04:01 ——– d—–w- c:\windows\system32\EventProviders
2011-11-20 20:34 . 2011-03-02 10:43 203264 —-a-w- c:\windows\system32\unrar.dll
2011-11-20 20:34 . 2011-11-20 20:34 ——– d—–w- c:\program files\K-Lite Codec Pack x64
2011-11-20 20:34 . 2011-10-04 18:00 86016 —-a-w- c:\windows\system32\ff_vfw.dll
2011-11-20 20:29 . 2011-11-20 20:29 ——– d—–w- c:\program files (x86)\FoxTabFLVPlayer
2011-11-20 16:24 . 2011-11-20 16:24 ——– d—–w- c:\program files (x86)\FVD Suite
2011-11-20 16:12 . 2011-11-20 16:12 ——– d—–w- c:\program files (x86)\Common Files\Java
2011-11-20 14:24 . 2011-11-20 14:24 ——– d—–w- C:\firefox
2011-11-20 13:47 . 2011-11-20 16:10 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-20 13:47 . 2011-11-20 13:47 ——– d—–w- c:\windows\system32\Macromed
2011-11-20 13:47 . 2011-11-20 13:47 ——– d—–w- c:\programdata\McAfee
2011-11-20 13:25 . 2011-11-20 13:25 ——– d—–w- C:\direct x files
2011-11-20 13:13 . 2011-11-20 13:13 ——– d—–w- c:\program files\Media Player Classic - Home Cinema
2011-11-20 13:01 . 2010-11-05 01:57 48976 —-a-w- c:\windows\system32\netfxperf.dll
2011-11-20 13:01 . 2010-11-05 01:57 1942856 —-a-w- c:\windows\system32\dfshim.dll
2011-11-20 13:01 . 2010-11-05 01:58 1130824 —-a-w- c:\windows\SysWow64\dfshim.dll
2011-11-20 13:01 . 2010-11-20 13:27 12288 —-a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2011-11-20 13:01 . 2010-11-20 13:27 3715584 —-a-w- c:\windows\system32\mstscax.dll
2011-11-20 13:01 . 2010-11-20 13:26 1838080 —-a-w- c:\windows\system32\d3d10warp.dll
2011-11-20 13:01 . 2010-11-20 11:07 59392 —-a-w- c:\windows\system32\drivers\TsUsbFlt.sys
2011-11-20 13:01 . 2010-11-20 13:27 14967808 —-a-w- c:\program files\DVD Maker\OmdBase.dll
2011-11-20 12:59 . 2010-11-20 13:27 266240 —-a-w- c:\windows\system32\QAGENT.DLL
2011-11-20 12:58 . 2010-11-20 13:27 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll
2011-11-20 12:57 . 2010-11-20 13:01 2560 —-a-w- c:\windows\system32\drivers\en-US\rdpwd.sys.mui
2011-11-20 12:57 . 2010-11-20 12:57 3072 —-a-w- c:\windows\system32\drivers\en-US\tsusbflt.sys.mui
2011-11-20 12:57 . 2010-11-20 13:11 6144 —-a-w- c:\windows\system32\drivers\en-US\IPMIDrv.sys.mui
2011-11-20 12:57 . 2010-11-20 13:10 4608 —-a-w- c:\windows\system32\drivers\en-US\kbdclass.sys.mui
2011-11-20 12:57 . 2010-11-20 13:26 399872 —-a-w- c:\windows\system32\dpx.dll
2011-11-20 12:57 . 2010-11-20 12:21 189952 —-a-w- c:\windows\SysWow64\wdscore.dll
2011-11-20 12:57 . 2010-11-20 12:21 189952 —-a-w- c:\windows\SysWow64\sqmapi.dll
2011-11-20 12:57 . 2010-11-20 12:21 363008 —-a-w- c:\windows\SysWow64\wbemcomn.dll
2011-11-20 12:57 . 2010-11-20 12:21 189952 —-a-w- c:\program files (x86)\Windows Portable Devices\sqmapi.dll
2011-11-20 12:57 . 2010-11-20 12:19 606208 —-a-w- c:\windows\SysWow64\wbem\fastprox.dll
2011-11-20 12:55 . 2010-11-20 13:27 529408 —-a-w- c:\windows\system32\wbemcomn.dll
2011-11-20 12:55 . 2010-11-20 13:27 244736 —-a-w- c:\program files\Windows Portable Devices\sqmapi.dll
2011-11-20 12:55 . 2010-11-20 13:27 244736 —-a-w- c:\windows\system32\sqmapi.dll
2011-11-20 12:44 . 2011-11-20 12:44 ——– d–h–w- c:\programdata\Common Files
2011-11-20 12:44 . 2011-11-20 12:44 ——– d—–w- c:\program files (x86)\AVG
2011-11-20 12:42 . 2011-11-20 12:44 ——– d—–w- c:\programdata\MFAData
2011-11-20 12:33 . 2011-03-11 06:41 1659776 —-a-w- c:\windows\system32\drivers\ntfs.sys
2011-11-20 12:33 . 2011-03-11 06:41 189824 —-a-w- c:\windows\system32\drivers\storport.sys
2011-11-20 12:33 . 2011-03-11 06:41 166272 —-a-w- c:\windows\system32\drivers\nvstor.sys
2011-11-20 12:33 . 2011-03-11 06:41 148352 —-a-w- c:\windows\system32\drivers\nvraid.sys
2011-11-20 12:33 . 2011-03-11 06:41 410496 —-a-w- c:\windows\system32\drivers\iaStorV.sys
2011-11-20 12:33 . 2011-03-11 06:41 27008 —-a-w- c:\windows\system32\drivers\amdxata.sys
2011-11-20 12:33 . 2011-03-11 06:41 107904 —-a-w- c:\windows\system32\drivers\amdsata.sys
2011-11-20 12:33 . 2011-03-11 06:33 2565632 —-a-w- c:\windows\system32\esent.dll
2011-11-20 12:33 . 2011-03-11 06:30 96768 —-a-w- c:\windows\system32\fsutil.exe
2011-11-20 12:33 . 2011-03-11 05:33 1699328 —-a-w- c:\windows\SysWow64\esent.dll
2011-11-20 12:33 . 2011-03-11 05:31 74240 —-a-w- c:\windows\SysWow64\fsutil.exe
2011-11-20 12:32 . 2011-03-25 03:29 343040 —-a-w- c:\windows\system32\drivers\usbhub.sys
2011-11-20 12:32 . 2011-03-25 03:29 98816 —-a-w- c:\windows\system32\drivers\usbccgp.sys
2011-11-20 12:32 . 2011-03-25 03:29 325120 —-a-w- c:\windows\system32\drivers\usbport.sys
2011-11-20 12:32 . 2011-03-25 03:29 52736 —-a-w- c:\windows\system32\drivers\usbehci.sys
2011-11-20 12:32 . 2011-03-25 03:29 25600 —-a-w- c:\windows\system32\drivers\usbohci.sys
2011-11-20 12:32 . 2011-03-25 03:29 30720 —-a-w- c:\windows\system32\drivers\usbuhci.sys
2011-11-20 12:32 . 2011-03-25 03:28 7936 —-a-w- c:\windows\system32\drivers\usbd.sys
2011-11-20 12:32 . 2011-04-28 03:55 552960 —-a-w- c:\windows\system32\drivers\bthport.sys
2011-11-20 12:32 . 2011-04-28 03:54 80384 —-a-w- c:\windows\system32\drivers\BTHUSB.SYS
2011-11-20 12:32 . 2010-11-20 13:24 229376 —-a-w- c:\windows\system32\fsquirt.exe
2011-11-20 12:02 . 2011-11-20 12:02 ——– d—–w- c:\program files (x86)\uTorrent
2011-11-20 10:31 . 2011-11-20 10:31 ——– d—–w- c:\windows\SysWow64\Wat
2011-11-20 10:31 . 2011-11-20 10:31 ——– d—–w- c:\windows\system32\Wat
2011-11-20 10:04 . 2011-11-20 10:04 ——– d—–w- c:\program files (x86)\MSXML 4.0
2011-11-20 05:10 . 2011-11-20 05:10 ——– d—–w- c:\program files (x86)\Apex Fitness
2011-11-20 05:01 . 2011-11-20 06:23 ——– d—–w- c:\programdata\Blizzard Entertainment
2011-11-20 05:01 . 2011-11-20 06:23 ——– d—–w- c:\program files (x86)\StarCraft II
2011-11-20 05:01 . 2011-11-20 05:25 ——– d—–w- c:\program files (x86)\Common Files\Blizzard Entertainment
2011-11-20 04:22 . 2011-09-29 16:29 1923952 —-a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-20 04:20 . 2011-03-03 06:24 183296 —-a-w- c:\windows\system32\dnsrslvr.dll
2011-11-20 04:20 . 2011-03-03 06:21 30208 —-a-w- c:\windows\system32\dnscacheugc.exe
2011-11-20 04:20 . 2011-03-03 05:36 28672 —-a-w- c:\windows\SysWow64\dnscacheugc.exe
2011-11-20 04:20 . 2011-04-29 03:06 467456 —-a-w- c:\windows\system32\drivers\srv.sys
2011-11-20 04:20 . 2011-04-29 03:05 410112 —-a-w- c:\windows\system32\drivers\srv2.sys
2011-11-20 04:20 . 2011-04-29 03:05 168448 —-a-w- c:\windows\system32\drivers\srvnet.sys
2011-11-20 04:20 . 2011-01-17 11:09 197120 —-a-w- c:\windows\system32\d3d10_1.dll
2011-11-20 04:20 . 2011-01-17 05:47 161792 —-a-w- c:\windows\SysWow64\d3d10_1.dll
2011-11-20 04:20 . 2010-11-20 13:26 321024 —-a-w- c:\windows\system32\d3d10_1core.dll
2011-11-20 04:20 . 2010-11-20 12:18 219136 —-a-w- c:\windows\SysWow64\d3d10_1core.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-24 11:36 . 2010-06-24 18:33 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-11-21 04:34 . 2009-07-14 02:36 175616 —-a-w- c:\windows\system32\msclmd.dll
2011-11-21 04:34 . 2009-07-14 02:36 152576 —-a-w- c:\windows\SysWow64\msclmd.dll
2011-10-03 12:06 . 2010-10-26 22:01 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-08-16 2736128]
"Corel Photo Downloader"="c:\program files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2010-09-07 525968]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-09-09 98304]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-11-13 421736]
"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-09-14 283160]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2009-11-18 54576]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-09-29 584760]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-7-29 1132320]
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
Snapfish PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe [2010-9-28 1040952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
R2 CLKMSVC10_C6F09094;CyberLink Product - 2011/11/18 13:57;c:\program files (x86)\Hewlett-Packard\Media\DVD\Kernel\HDDVD\NavFilter\kmsvc.exe [2010-09-21 245232]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-07-21 103992]
R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-11-24 2152152]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys [2011-11-24 17152]
R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-03 89600]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 HPAuto;HP Auto;c:\program files\Hewlett-Packard\HP Auto\HPAuto.exe [2010-08-06 681528]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-08-06 291896]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-05-21 103992]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-09-29 26680]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-09-14 13336]
S2 RoxioNow Service;RoxioNow Service;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-09-11 399344]
S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-09-30 2655768]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2010-02-23 2192176]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
S3 clwvd;HP Webcam Splitter;c:\windows\system32\DRIVERS\clwvd.sys [x]
S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
— Other Services/Drivers In Memory —
.
*Deregistered* - CLKMDRV10_C6F09094
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-08-16 21:43 451872 —-a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-01 c:\windows\Tasks\HP Photo Creations Communicator.job
- c:\programdata\HP Photo Creations\MessageCheck.exe [2011-12-01 05:51]
.
2011-11-26 c:\windows\Tasks\HPCeeScheduleForTony.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter]
@="{D25B32FE-CB96-491A-98FF-AD59DA382D69}"
[HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter]
@="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}"
[HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter]
@="{B3C78E40-6B64-47C3-AE34-60B770881EB8}"
[HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter]
@="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}"
[HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter]
@="{855156F0-2A0F-11DE-8C30-0800200C9A66}"
[HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-07-22 487424]
"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2010-09-01 611896]
"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-07-21 8192]
"combofix"="c:\combofix\CF7657.3XE" [2010-11-20 345088]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences Pro\FencesMenu64.dll" [2010-09-16 464744]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\b57io866.default\
FF - prefs.js: browser.startup.homepage - hxxp://forum.bodybuilding.com/forumdisplay.php?f=19
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-Corel File Shell Monitor - c:\program files (x86)\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\CorelIOMonitor.exe
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-{B24A0E12-5775-4F9D-85B6-2306EE637CCB} - c:\program files (x86)\InstallShield Installation Information\{B24A0E12-5775-4F9D-85B6-2306EE637CCB}\setup.exe
AddRemove-FoxTab FLV Player - c:\program files (x86)\FoxTabFLVPlayer\Uninstall\Uninstall.exe
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
———————— Other Running Processes ————————
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\windows\SysWOW64\RunDll32.exe
c:\program files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
c:\program files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Completion time: 2011-12-01 05:31:49 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-01 12:31
.
Pre-Run: 877,465,120,768 bytes free
Post-Run: 880,313,073,664 bytes free
.
- - End Of File - - 8E0C109A9453D5E44764DD21C7420602
I didn't realize i had windows defender as a software app on this machine… i reran the program with it off here is the log:
ComboFix 11-12-01.01 - Tony 12/01/2011 5:50.2.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8174.6493 [GMT -7:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-11-01 to 2011-12-01 )))))))))))))))))))))))))))))))
.
.
2011-12-01 12:55 . 2011-12-01 12:55 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-12-01 05:51 . 2011-12-01 05:51 ——– d—–w- c:\programdata\Visan
2011-12-01 05:49 . 2011-12-01 05:49 ——– d—–w- c:\programdata\WEBREG
2011-12-01 05:47 . 2009-07-14 01:41 230400 —-a-w- c:\windows\system32\Spool\prtprocs\x64\hpzppw71.dll
2011-12-01 05:30 . 2011-02-19 12:05 1139200 —-a-w- c:\windows\system32\FntCache.dll
2011-12-01 05:30 . 2011-02-19 12:04 1544192 —-a-w- c:\windows\system32\DWrite.dll
2011-12-01 05:30 . 2011-02-19 12:04 902656 —-a-w- c:\windows\system32\d2d1.dll
2011-12-01 05:30 . 2011-02-19 06:30 1076736 —-a-w- c:\windows\SysWow64\DWrite.dll
2011-12-01 05:30 . 2011-02-19 06:30 739840 —-a-w- c:\windows\SysWow64\d2d1.dll
2011-12-01 05:22 . 2011-12-01 05:22 ——– d—–w- c:\program files (x86)\Yahoo!
2011-12-01 05:22 . 2011-12-01 05:22 ——– d—–w- c:\programdata\Yahoo! Companion
2011-12-01 05:22 . 2011-12-01 05:22 ——– d—–w- c:\program files (x86)\Coupons
2011-12-01 05:22 . 2011-12-01 05:22 ——– d—–w- c:\programdata\HP Product Assistant
2011-12-01 05:21 . 2011-12-01 05:21 ——– d—–w- c:\program files (x86)\Common Files\HP
2011-12-01 05:21 . 2011-12-01 05:21 ——– d—–w- c:\program files (x86)\Common Files\Hewlett-Packard
2011-12-01 05:20 . 2011-12-01 05:22 ——– d—–w- c:\programdata\HP
2011-11-29 11:22 . 2011-10-18 08:27 8570192 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A29B3BF3-542B-448B-B800-A3440CDF3F2E}\mpengine.dll
2011-11-29 02:41 . 2009-05-18 20:17 34152 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2011-11-29 02:41 . 2008-04-17 19:12 126312 —-a-w- c:\windows\system32\GEARAspi64.dll
2011-11-29 02:41 . 2008-04-17 19:12 107368 —-a-w- c:\windows\SysWow64\GEARAspi.dll
2011-11-29 02:40 . 2011-11-29 02:41 ——– d—–w- c:\programdata\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2011-11-29 02:40 . 2011-11-29 02:41 ——– d—–w- c:\program files\iTunes
2011-11-29 02:40 . 2011-11-29 02:41 ——– d—–w- c:\program files (x86)\iTunes
2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\programdata\Apple Computer
2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files\iPod
2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files (x86)\Apple Software Update
2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files\Common Files\Apple
2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files\Bonjour
2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files (x86)\Bonjour
2011-11-29 02:39 . 2011-11-29 02:40 ——– d—–w- c:\program files (x86)\Common Files\Apple
2011-11-29 02:39 . 2011-11-29 02:40 ——– d—–w- c:\programdata\Apple
2011-11-29 02:38 . 2011-11-29 02:38 ——– d—–w- C:\itunes
2011-11-26 02:13 . 2011-11-26 02:13 8507392 —-a-w- c:\windows\system32\drivers\NETwNs64.sys
2011-11-26 02:13 . 2011-11-26 02:13 799232 —-a-w- c:\windows\system32\NETwNc64.dll
2011-11-26 02:13 . 2011-11-26 02:13 2750464 —-a-w- c:\windows\system32\NETwNr64.dll
2011-11-24 14:02 . 2011-11-24 13:55 16432 —-a-w- c:\windows\system32\lsdelete.exe
2011-11-24 13:55 . 2011-11-24 13:55 55384 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-11-24 13:54 . 2011-11-29 02:41 ——– dc—-w- c:\windows\system32\DRVSTORE
2011-11-24 13:54 . 2011-08-18 22:25 69376 —-a-w- c:\windows\system32\drivers\Lbd.sys
2011-11-24 13:54 . 2011-11-24 13:54 ——– d—–w- c:\programdata\Lavasoft
2011-11-24 13:54 . 2011-11-24 13:54 ——– d—–w- c:\program files (x86)\Lavasoft
2011-11-24 13:24 . 2011-11-24 13:47 ——– d—–w- C:\f7bf4a5b04f1dad3f79b7d80c634b0c3
2011-11-24 11:39 . 2011-11-24 11:39 ——– d—–w- c:\windows\en
2011-11-24 11:37 . 2011-11-24 11:37 ——– d—–w- c:\program files\Windows Live
2011-11-21 05:30 . 2011-11-21 05:30 ——– d—–w- c:\windows\Sun
2011-11-21 04:01 . 2011-11-21 04:01 ——– d—–w- c:\windows\system32\SPReview
2011-11-21 04:01 . 2011-11-21 04:01 ——– d—–w- c:\windows\system32\EventProviders
2011-11-20 20:34 . 2011-03-02 10:43 203264 —-a-w- c:\windows\system32\unrar.dll
2011-11-20 20:34 . 2011-11-20 20:34 ——– d—–w- c:\program files\K-Lite Codec Pack x64
2011-11-20 20:34 . 2011-10-04 18:00 86016 —-a-w- c:\windows\system32\ff_vfw.dll
2011-11-20 20:29 . 2011-11-20 20:29 ——– d—–w- c:\program files (x86)\FoxTabFLVPlayer
2011-11-20 16:24 . 2011-11-20 16:24 ——– d—–w- c:\program files (x86)\FVD Suite
2011-11-20 16:12 . 2011-11-20 16:12 ——– d—–w- c:\program files (x86)\Common Files\Java
2011-11-20 14:24 . 2011-11-20 14:24 ——– d—–w- C:\firefox
2011-11-20 13:47 . 2011-11-20 16:10 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-20 13:47 . 2011-11-20 13:47 ——– d—–w- c:\windows\system32\Macromed
2011-11-20 13:47 . 2011-11-20 13:47 ——– d—–w- c:\programdata\McAfee
2011-11-20 13:25 . 2011-11-20 13:25 ——– d—–w- C:\direct x files
2011-11-20 13:13 . 2011-11-20 13:13 ——– d—–w- c:\program files\Media Player Classic - Home Cinema
2011-11-20 13:01 . 2010-11-05 01:57 48976 —-a-w- c:\windows\system32\netfxperf.dll
2011-11-20 13:01 . 2010-11-05 01:57 1942856 —-a-w- c:\windows\system32\dfshim.dll
2011-11-20 13:01 . 2010-11-05 01:58 1130824 —-a-w- c:\windows\SysWow64\dfshim.dll
2011-11-20 13:01 . 2010-11-20 13:27 12288 —-a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2011-11-20 13:01 . 2010-11-20 13:27 3715584 —-a-w- c:\windows\system32\mstscax.dll
2011-11-20 13:01 . 2010-11-20 13:26 1838080 —-a-w- c:\windows\system32\d3d10warp.dll
2011-11-20 13:01 . 2010-11-20 11:07 59392 —-a-w- c:\windows\system32\drivers\TsUsbFlt.sys
2011-11-20 13:01 . 2010-11-20 13:27 14967808 —-a-w- c:\program files\DVD Maker\OmdBase.dll
2011-11-20 12:59 . 2010-11-20 13:27 266240 —-a-w- c:\windows\system32\QAGENT.DLL
2011-11-20 12:58 . 2010-11-20 13:27 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll
2011-11-20 12:57 . 2010-11-20 13:01 2560 —-a-w- c:\windows\system32\drivers\en-US\rdpwd.sys.mui
2011-11-20 12:57 . 2010-11-20 12:57 3072 —-a-w- c:\windows\system32\drivers\en-US\tsusbflt.sys.mui
2011-11-20 12:57 . 2010-11-20 13:11 6144 —-a-w- c:\windows\system32\drivers\en-US\IPMIDrv.sys.mui
2011-11-20 12:57 . 2010-11-20 13:10 4608 —-a-w- c:\windows\system32\drivers\en-US\kbdclass.sys.mui
2011-11-20 12:57 . 2010-11-20 13:26 399872 —-a-w- c:\windows\system32\dpx.dll
2011-11-20 12:57 . 2010-11-20 12:21 189952 —-a-w- c:\windows\SysWow64\wdscore.dll
2011-11-20 12:57 . 2010-11-20 12:21 189952 —-a-w- c:\windows\SysWow64\sqmapi.dll
2011-11-20 12:57 . 2010-11-20 12:21 363008 —-a-w- c:\windows\SysWow64\wbemcomn.dll
2011-11-20 12:57 . 2010-11-20 12:21 189952 —-a-w- c:\program files (x86)\Windows Portable Devices\sqmapi.dll
2011-11-20 12:57 . 2010-11-20 12:19 606208 —-a-w- c:\windows\SysWow64\wbem\fastprox.dll
2011-11-20 12:55 . 2010-11-20 13:27 529408 —-a-w- c:\windows\system32\wbemcomn.dll
2011-11-20 12:55 . 2010-11-20 13:27 244736 —-a-w- c:\program files\Windows Portable Devices\sqmapi.dll
2011-11-20 12:55 . 2010-11-20 13:27 244736 —-a-w- c:\windows\system32\sqmapi.dll
2011-11-20 12:44 . 2011-11-20 12:44 ——– d–h–w- c:\programdata\Common Files
2011-11-20 12:44 . 2011-11-20 12:44 ——– d—–w- c:\program files (x86)\AVG
2011-11-20 12:42 . 2011-11-20 12:44 ——– d—–w- c:\programdata\MFAData
2011-11-20 12:33 . 2011-03-11 06:41 1659776 —-a-w- c:\windows\system32\drivers\ntfs.sys
2011-11-20 12:33 . 2011-03-11 06:41 189824 —-a-w- c:\windows\system32\drivers\storport.sys
2011-11-20 12:33 . 2011-03-11 06:41 166272 —-a-w- c:\windows\system32\drivers\nvstor.sys
2011-11-20 12:33 . 2011-03-11 06:41 148352 —-a-w- c:\windows\system32\drivers\nvraid.sys
2011-11-20 12:33 . 2011-03-11 06:41 410496 —-a-w- c:\windows\system32\drivers\iaStorV.sys
2011-11-20 12:33 . 2011-03-11 06:41 27008 —-a-w- c:\windows\system32\drivers\amdxata.sys
2011-11-20 12:33 . 2011-03-11 06:41 107904 —-a-w- c:\windows\system32\drivers\amdsata.sys
2011-11-20 12:33 . 2011-03-11 06:33 2565632 —-a-w- c:\windows\system32\esent.dll
2011-11-20 12:33 . 2011-03-11 06:30 96768 —-a-w- c:\windows\system32\fsutil.exe
2011-11-20 12:33 . 2011-03-11 05:33 1699328 —-a-w- c:\windows\SysWow64\esent.dll
2011-11-20 12:33 . 2011-03-11 05:31 74240 —-a-w- c:\windows\SysWow64\fsutil.exe
2011-11-20 12:32 . 2011-03-25 03:29 343040 —-a-w- c:\windows\system32\drivers\usbhub.sys
2011-11-20 12:32 . 2011-03-25 03:29 98816 —-a-w- c:\windows\system32\drivers\usbccgp.sys
2011-11-20 12:32 . 2011-03-25 03:29 325120 —-a-w- c:\windows\system32\drivers\usbport.sys
2011-11-20 12:32 . 2011-03-25 03:29 52736 —-a-w- c:\windows\system32\drivers\usbehci.sys
2011-11-20 12:32 . 2011-03-25 03:29 25600 —-a-w- c:\windows\system32\drivers\usbohci.sys
2011-11-20 12:32 . 2011-03-25 03:29 30720 —-a-w- c:\windows\system32\drivers\usbuhci.sys
2011-11-20 12:32 . 2011-03-25 03:28 7936 —-a-w- c:\windows\system32\drivers\usbd.sys
2011-11-20 12:32 . 2011-04-28 03:55 552960 —-a-w- c:\windows\system32\drivers\bthport.sys
2011-11-20 12:32 . 2011-04-28 03:54 80384 —-a-w- c:\windows\system32\drivers\BTHUSB.SYS
2011-11-20 12:32 . 2010-11-20 13:24 229376 —-a-w- c:\windows\system32\fsquirt.exe
2011-11-20 12:02 . 2011-11-20 12:02 ——– d—–w- c:\program files (x86)\uTorrent
2011-11-20 10:31 . 2011-11-20 10:31 ——– d—–w- c:\windows\SysWow64\Wat
2011-11-20 10:31 . 2011-11-20 10:31 ——– d—–w- c:\windows\system32\Wat
2011-11-20 10:04 . 2011-11-20 10:04 ——– d—–w- c:\program files (x86)\MSXML 4.0
2011-11-20 05:10 . 2011-11-20 05:10 ——– d—–w- c:\program files (x86)\Apex Fitness
2011-11-20 05:01 . 2011-11-20 06:23 ——– d—–w- c:\programdata\Blizzard Entertainment
2011-11-20 05:01 . 2011-11-20 06:23 ——– d—–w- c:\program files (x86)\StarCraft II
2011-11-20 05:01 . 2011-11-20 05:25 ——– d—–w- c:\program files (x86)\Common Files\Blizzard Entertainment
2011-11-20 04:22 . 2011-09-29 16:29 1923952 —-a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-20 04:20 . 2011-03-03 06:24 183296 —-a-w- c:\windows\system32\dnsrslvr.dll
2011-11-20 04:20 . 2011-03-03 06:21 30208 —-a-w- c:\windows\system32\dnscacheugc.exe
2011-11-20 04:20 . 2011-03-03 05:36 28672 —-a-w- c:\windows\SysWow64\dnscacheugc.exe
2011-11-20 04:20 . 2011-04-29 03:06 467456 —-a-w- c:\windows\system32\drivers\srv.sys
2011-11-20 04:20 . 2011-04-29 03:05 410112 —-a-w- c:\windows\system32\drivers\srv2.sys
2011-11-20 04:20 . 2011-04-29 03:05 168448 —-a-w- c:\windows\system32\drivers\srvnet.sys
2011-11-20 04:20 . 2011-01-17 11:09 197120 —-a-w- c:\windows\system32\d3d10_1.dll
2011-11-20 04:20 . 2011-01-17 05:47 161792 —-a-w- c:\windows\SysWow64\d3d10_1.dll
2011-11-20 04:20 . 2010-11-20 13:26 321024 —-a-w- c:\windows\system32\d3d10_1core.dll
2011-11-20 04:20 . 2010-11-20 12:18 219136 —-a-w- c:\windows\SysWow64\d3d10_1core.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-24 11:36 . 2010-06-24 18:33 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-11-21 04:34 . 2009-07-14 02:36 175616 —-a-w- c:\windows\system32\msclmd.dll
2011-11-21 04:34 . 2009-07-14 02:36 152576 —-a-w- c:\windows\SysWow64\msclmd.dll
2011-10-03 12:06 . 2010-10-26 22:01 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-12-01_12.26.19 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 05:10 . 2011-12-01 12:27 32234 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-11-18 23:31 . 2011-12-01 12:44 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-11-18 23:31 . 2011-12-01 12:11 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-11-18 23:31 . 2011-12-01 12:44 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-11-18 23:31 . 2011-12-01 12:11 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-12-01 12:11 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-12-01 12:44 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-11-20 02:48 . 2011-12-01 12:27 6986 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-95099818-689510529-2622086942-1000_UserData.bin
+ 2011-12-01 12:26 . 2011-12-01 12:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-08-16 2736128]
"Corel Photo Downloader"="c:\program files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2010-09-07 525968]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-09-09 98304]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-11-13 421736]
"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-09-14 283160]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2009-11-18 54576]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-09-29 584760]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-7-29 1132320]
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
Snapfish PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe [2010-9-28 1040952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
R2 CLKMSVC10_C6F09094;CyberLink Product - 2011/11/18 13:57;c:\program files (x86)\Hewlett-Packard\Media\DVD\Kernel\HDDVD\NavFilter\kmsvc.exe [2010-09-21 245232]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-07-21 103992]
R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-11-24 2152152]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys [2011-11-24 17152]
R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-03 89600]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 HPAuto;HP Auto;c:\program files\Hewlett-Packard\HP Auto\HPAuto.exe [2010-08-06 681528]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-08-06 291896]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-05-21 103992]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-09-29 26680]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-09-14 13336]
S2 RoxioNow Service;RoxioNow Service;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-09-11 399344]
S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-09-30 2655768]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2010-02-23 2192176]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
S3 clwvd;HP Webcam Splitter;c:\windows\system32\DRIVERS\clwvd.sys [x]
S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
— Other Services/Drivers In Memory —
.
*Deregistered* - CLKMDRV10_C6F09094
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-08-16 21:43 451872 —-a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-01 c:\windows\Tasks\HP Photo Creations Communicator.job
- c:\programdata\HP Photo Creations\MessageCheck.exe [2011-12-01 05:51]
.
2011-11-26 c:\windows\Tasks\HPCeeScheduleForTony.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter]
@="{D25B32FE-CB96-491A-98FF-AD59DA382D69}"
[HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter]
@="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}"
[HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter]
@="{B3C78E40-6B64-47C3-AE34-60B770881EB8}"
[HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter]
@="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}"
[HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter]
@="{855156F0-2A0F-11DE-8C30-0800200C9A66}"
[HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-07-22 487424]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2010-09-01 611896]
"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-07-21 8192]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences Pro\FencesMenu64.dll" [2010-09-16 464744]
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\b57io866.default\
FF - prefs.js: browser.startup.homepage - hxxp://forum.bodybuilding.com/forumdisplay.php?f=19
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-12-01 05:56:17
ComboFix-quarantined-files.txt 2011-12-01 12:56
ComboFix2.txt 2011-12-01 12:31
.
Pre-Run: 880,374,673,408 bytes free
Post-Run: 880,323,973,120 bytes free
.
- - End Of File - - 6E4061CBB6987ACC6D0E19D6E9A54B0C
I need to look over your log real close, I may not be back until noon. In the meantime run these scans and post the logs.
First, rerun aswMBR and post just the new log.
Then
Please download
Malwarebytes from
Here or
Here Double-click mbam-setup.exe and follow the prompts to install the program. At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware , then click Finish . If an update is found, it will download and install the latest version. Once the program has loaded, select Perform quick scan , then click Scan .[external image: Posted Image] When the scan is complete, click OK , then Show Results to view the results. Be sure that everything is checked , and click Remove Selected . When completed, a log will open in Notepad. Please save it to a convenient location and post the results. Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot. Post the report please
Download
CKScanner by
askey127 from
Here &
save it to your Desktop .
Doubleclick CKScanner.exe then click Search For Files When the cursor hourglass disappears, click Save List To File A message box will verify the file saved just run this program once Double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply
here is the first one:
aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-12-01 07:37:32
—————————–
07:37:32.236 OS Version: Windows x64 6.1.7601 Service Pack 1
07:37:32.236 Number of processors: 8 586 0x2A07
07:37:32.236 ComputerName: TONY-HP UserName: Tony
07:37:34.030 Initialize success
07:38:50.712 AVAST engine defs: 11120100
07:39:23.877 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
07:39:23.877 Disk 0 Vendor: TOSHIBA_ GL00 Size: 953869MB BusType: 3
07:39:23.893 Disk 0 MBR read successfully
07:39:23.893 Disk 0 MBR scan
07:39:23.893 Disk 0 unknown MBR code
07:39:23.893 Service scanning
07:39:24.876 Modules scanning
07:39:24.876 Disk 0 trace - called modules:
07:39:24.907 ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys iaStor.sys hal.dll
07:39:24.907 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8008030790]
07:39:24.907 3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa8007f3ab10]
07:39:24.907 5 hpdskflt.sys[fffff88001b98189] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8007a2f050]
07:39:26.248 AVAST engine scan C:\
07:56:47.655 File: C:\Qoobox\Quarantine\C\Windows\System32\consrv.dll.vir **INFECTED** Win32:Malware-gen
08:00:01.758 File: C:\Windows\assembly\GAC_64\Desktop.ini **INFECTED** Win32:Malware-gen
08:00:51.548 File: C:\Windows\assembly\temp\U\80000032.@ **INFECTED** Win32:DNSChanger-VJ [Trj]
08:39:49.449 Scan finished successfully
08:39:53.817 Disk 0 MBR has been saved successfully to "C:\Users\Tony\Desktop\MBR.dat"
08:39:53.817 The log file has been saved successfully to "C:\Users\Tony\Desktop\aswMBR.txt"
I have an option to update virus definitions with online avast… i am doing that. i will post logs in just moment.