PING.exe [Closed]

. DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29 Run by [removed] at 19:20:31 on 2011-12-03 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8174.6792 [GMT -7:00] . AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Program Files\IDT\WDM\STacSV64.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\Hpservice.exe C:\Windows\system32\vcsFPService.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\atieclxx.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\IDT\WDM\AESTSr64.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe C:\Windows\system32\taskhost.exe C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt C:\Windows\system32\Dwm.exe C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\System32\svchost.exe -k HPZ12 c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files\IDT\WDM\sttray64.exe C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Windows\SysWOW64\RunDll32.exe C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe C:\Program Files\iPod\bin\iPodService.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\svchost.exe -k bthsvcs C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe C:\Windows\system32\taskeng.exe C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe C:\Windows\system32\DllHost.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ uInternet Settings,ProxyOverride = *.local uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden uRun: [Corel Photo Downloader] "C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BTTray.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SNAPFI~1.LNK - C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll Trusted Zone: apexfitness.com\my DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab TCP: Interfaces\{1D586EF4-8011-4DD6-BAD2-3280827F2C4D} : DhcpNameServer = 192.168.1.1 Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe" BHO-X64: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll BHO-X64: 0x1 - No File BHO-X64: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll BHO-X64: HP Print Enhancer - No File BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO-X64: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll BHO-X64: HP Smart BHO Class - No File TB-X64: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe mRun-x64: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe mRun-x64: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm Hosts: 217.23.4.166 www.google-analytics.com. Hosts: 217.23.4.166 ad-emea.doubleclick.net. Hosts: 217.23.4.166 www.statcounter.com. Hosts: 178.250.45.15 www.google-analytics.com. Hosts: 178.250.45.15 ad-emea.doubleclick.net. . Note: multiple HOSTS entries found. Please refer to Attach.txt . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\b57io866.default\ FF - prefs.js: browser.startup.homepage - hxxp://forum.bodybuilding.com/forumdisplay.php?f=19 FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\Users\Default\AppData\Local\HuluDesktop\instances\0.9.13.1\nphdplg.dll FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll . ============= SERVICES / DRIVERS =============== . R0 Lbd;Lbd;C:\Windows\system32\DRIVERS\Lbd.sys –> C:\Windows\system32\DRIVERS\Lbd.sys [?] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys –> C:\Windows\system32\DRIVERS\vwififlt.sys [?] R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2011-11-18 89600] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe –> C:\Windows\system32\atiesrxx.exe [?] R2 HPAuto;HP Auto;C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [2010-8-5 681528] R2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-8-5 291896] R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-5-21 103992] R2 hpsrv;HP Service;C:\Windows\system32\Hpservice.exe –> C:\Windows\system32\Hpservice.exe [?] R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-9-28 26680] R2 RoxioNow Service;RoxioNow Service;C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-9-11 399344] R2 vcsFPService;Validity VCS Fingerprint Service;C:\Windows\System32\vcsFPService.exe [2010-2-23 1799472] R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys –> C:\Windows\system32\DRIVERS\atikmdag.sys [?] R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys –> C:\Windows\system32\DRIVERS\atikmpag.sys [?] R3 btwampfl;Bluetooth AMP USB Filter;C:\Windows\system32\drivers\btwampfl.sys –> C:\Windows\system32\drivers\btwampfl.sys [?] R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\system32\DRIVERS\btwl2cap.sys –> C:\Windows\system32\DRIVERS\btwl2cap.sys [?] R3 clwvd;HP Webcam Splitter;C:\Windows\system32\DRIVERS\clwvd.sys –> C:\Windows\system32\DRIVERS\clwvd.sys [?] R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys –> C:\Windows\system32\DRIVERS\HECIx64.sys [?] R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\system32\DRIVERS\NETwNs64.sys –> C:\Windows\system32\DRIVERS\NETwNs64.sys [?] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys –> C:\Windows\system32\DRIVERS\Rt64win7.sys [?] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys –> C:\Windows\system32\DRIVERS\vwifimp.sys [?] S2 CLKMSVC10_C6F09094;CyberLink Product - 2011/11/18 13:57:59;C:\Program Files (x86)\Hewlett-Packard\Media\DVD\Kernel\HDDVD\NavFilter\kmsvc.exe [2011-11-18 245232] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 HP Wireless Assistant Service;HP Wireless Assistant Service;C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-7-21 103992] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-18 13336] S2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-11-18 2655768] S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-8-18 2152152] S3 Lavasoft Kernexplorer;Lavasoft helper driver;C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys [2011-11-24 17152] S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys –> C:\Windows\system32\DRIVERS\netw5v64.sys [?] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys –> C:\Windows\system32\Drivers\RtsUStor.sys [?] S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS –> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?] S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS –> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?] S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS –> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys –> C:\Windows\system32\drivers\tsusbflt.sys [?] S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys –> C:\Windows\system32\Drivers\usbaapl64.sys [?] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys –> C:\Windows\system32\DRIVERS\yk62x64.sys [?] . =============== Created Last 30 ================ . 2011-12-03 13:32:24 ——– d—–w- C:\Program Files (x86)\VS Revo Group 2011-12-03 03:04:21 ——– d—–w- C:\_OTM 2011-12-02 10:26:59 8822856 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{47FE8B84-6A46-4D2F-9EAD-8F56F40E0767}\mpengine.dll 2011-12-02 01:10:39 ——– d—–w- C:\Program Files (x86)\ESET 2011-12-01 22:46:23 ——– d—–w- C:\_OTL 2011-12-01 17:14:11 ——– d—–w- C:\Users\Tony\AppData\Local\Corel 2011-12-01 16:13:14 ——– d-sh–w- C:\$RECYCLE.BIN 2011-12-01 15:41:42 ——– d—–w- C:\Users\Tony\AppData\Roaming\Malwarebytes 2011-12-01 15:41:39 ——– d—–w- C:\ProgramData\Malwarebytes 2011-12-01 15:41:36 25416 —-a-w- C:\Windows\System32\drivers\mbam.sys 2011-12-01 15:41:36 ——– d—–w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2011-12-01 12:16:54 98816 —-a-w- C:\Windows\sed.exe 2011-12-01 12:16:54 518144 —-a-w- C:\Windows\SWREG.exe 2011-12-01 12:16:54 256000 —-a-w- C:\Windows\PEV.exe 2011-12-01 12:16:54 208896 —-a-w- C:\Windows\MBR.exe 2011-12-01 08:37:06 ——– d—–w- C:\Users\Tony\AppData\Local\ElevatedDiagnostics 2011-12-01 05:51:36 ——– d—–w- C:\Users\Tony\AppData\Roaming\Visan 2011-12-01 05:51:36 ——– d—–w- C:\ProgramData\Visan 2011-12-01 05:49:48 ——– d—–w- C:\ProgramData\WEBREG 2011-12-01 05:47:01 230400 —-a-w- C:\Windows\System32\Spool\prtprocs\x64\hpzppw71.dll 2011-12-01 05:37:25 ——– d—–w- C:\Windows\pss 2011-12-01 05:30:33 902656 —-a-w- C:\Windows\System32\d2d1.dll 2011-12-01 05:30:33 739840 —-a-w- C:\Windows\SysWow64\d2d1.dll 2011-12-01 05:30:33 1544192 —-a-w- C:\Windows\System32\DWrite.dll 2011-12-01 05:30:33 1139200 —-a-w- C:\Windows\System32\FntCache.dll 2011-12-01 05:30:33 1076736 —-a-w- C:\Windows\SysWow64\DWrite.dll 2011-12-01 05:22:47 ——– d—–w- C:\Program Files (x86)\Yahoo! 2011-12-01 05:22:43 ——– d—–w- C:\Users\Tony\AppData\Roaming\HpUpdate 2011-12-01 05:22:34 ——– d—–w- C:\Program Files (x86)\Coupons 2011-12-01 05:21:42 ——– d—–w- C:\Program Files (x86)\Common Files\HP 2011-12-01 05:21:30 ——– d—–w- C:\Program Files (x86)\Common Files\Hewlett-Packard 2011-11-29 02:42:08 ——– d—–w- C:\Users\Tony\AppData\Local\Apple Computer 2011-11-29 02:41:40 34152 —-a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys 2011-11-29 02:41:40 126312 —-a-w- C:\Windows\System32\GEARAspi64.dll 2011-11-29 02:41:40 107368 —-a-w- C:\Windows\SysWow64\GEARAspi.dll 2011-11-29 02:40:51 ——– d—–w- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001} 2011-11-29 02:40:51 ——– d—–w- C:\Program Files\iTunes 2011-11-29 02:40:51 ——– d—–w- C:\Program Files\iPod 2011-11-29 02:40:51 ——– d—–w- C:\Program Files (x86)\iTunes 2011-11-29 02:40:29 ——– d—–w- C:\Users\Tony\AppData\Local\Apple 2011-11-29 02:40:03 ——– d—–w- C:\Program Files\Bonjour 2011-11-29 02:40:03 ——– d—–w- C:\Program Files (x86)\Bonjour 2011-11-29 02:38:48 ——– d—–w- C:\itunes 2011-11-27 07:05:27 ——– d—–w- C:\Users\Tony\AppData\Local\CyberLink 2011-11-27 07:05:26 ——– d—–w- C:\Users\Tony\AppData\Local\PowerCinema 2011-11-26 02:13:25 8507392 —-a-w- C:\Windows\System32\drivers\NETwNs64.sys 2011-11-26 02:13:25 799232 —-a-w- C:\Windows\System32\NETwNc64.dll 2011-11-26 02:13:25 2750464 —-a-w- C:\Windows\System32\NETwNr64.dll 2011-11-24 14:02:48 16432 —-a-w- C:\Windows\System32\lsdelete.exe 2011-11-24 13:55:32 55384 —-a-w- C:\Windows\System32\drivers\SBREDrv.sys 2011-11-24 13:54:10 69376 —-a-w- C:\Windows\System32\drivers\Lbd.sys 2011-11-24 13:54:08 ——– d—–w- C:\Program Files (x86)\Lavasoft 2011-11-24 13:24:17 ——– d—–w- C:\f7bf4a5b04f1dad3f79b7d80c634b0c3 2011-11-24 11:39:27 ——– d—–w- C:\Windows\en 2011-11-24 11:17:16 ——– d—–w- C:\Users\Tony\AppData\Local\Windows Live 2011-11-24 11:16:47 ——– d—–w- C:\Users\Tony\AppData\Roaming\Windows Live Writer 2011-11-24 11:16:47 ——– d—–w- C:\Users\Tony\AppData\Local\Windows Live Writer 2011-11-22 13:12:24 8570192 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll 2011-11-21 04:01:50 ——– d—–w- C:\Windows\System32\SPReview 2011-11-21 04:01:27 ——– d—–w- C:\Windows\System32\EventProviders 2011-11-20 20:34:35 203264 —-a-w- C:\Windows\System32\unrar.dll 2011-11-20 20:34:34 86016 —-a-w- C:\Windows\System32\ff_vfw.dll 2011-11-20 20:34:34 ——– d—–w- C:\Program Files\K-Lite Codec Pack x64 2011-11-20 16:29:38 ——– d—–w- C:\Users\Tony\AppData\Local\FVD Suite 2011-11-20 16:24:16 ——– d—–w- C:\Program Files (x86)\FVD Suite 2011-11-20 14:24:42 ——– d—–w- C:\firefox 2011-11-20 14:22:11 ——– d—–w- C:\Users\Tony\AppData\Local\Adobe 2011-11-20 13:47:56 414368 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2011-11-20 13:34:41 ——– d—–w- C:\Users\Tony\AppData\Local\Mozilla 2011-11-20 13:25:30 ——– d—–w- C:\direct x files 2011-11-20 13:16:08 ——– d—–w- C:\Windows\SysWow64\directx 2011-11-20 13:13:52 ——– d—–w- C:\Program Files\Media Player Classic - Home Cinema 2011-11-20 13:11:12 ——– d—–w- C:\Users\Tony\AppData\Local\Programs 2011-11-20 13:01:16 48976 —-a-w- C:\Windows\System32\netfxperf.dll 2011-11-20 13:01:16 1942856 —-a-w- C:\Windows\System32\dfshim.dll 2011-11-20 13:01:08 1130824 —-a-w- C:\Windows\SysWow64\dfshim.dll 2011-11-20 13:01:02 59392 —-a-w- C:\Windows\System32\drivers\TsUsbFlt.sys 2011-11-20 13:01:02 3715584 —-a-w- C:\Windows\System32\mstscax.dll 2011-11-20 13:01:02 1838080 —-a-w- C:\Windows\System32\d3d10warp.dll 2011-11-20 13:01:02 12288 —-a-w- C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll 2011-11-20 13:01:01 14967808 —-a-w- C:\Program Files\DVD Maker\OmdBase.dll 2011-11-20 12:59:59 705024 —-a-w- C:\Windows\System32\BFE.DLL 2011-11-20 12:58:59 856576 —-a-w- C:\Windows\SysWow64\FirewallControlPanel.dll 2011-11-20 12:57:58 3072 —-a-w- C:\Windows\System32\drivers\en-US\tsusbflt.sys.mui 2011-11-20 12:57:58 2560 —-a-w- C:\Windows\System32\drivers\en-US\rdpwd.sys.mui 2011-11-20 12:57:56 6144 —-a-w- C:\Windows\System32\drivers\en-US\IPMIDrv.sys.mui 2011-11-20 12:57:56 4608 —-a-w- C:\Windows\System32\drivers\en-US\kbdclass.sys.mui 2011-11-20 12:57:55 399872 —-a-w- C:\Windows\System32\dpx.dll 2011-11-20 12:57:55 189952 —-a-w- C:\Windows\SysWow64\wdscore.dll 2011-11-20 12:57:49 189952 —-a-w- C:\Windows\SysWow64\sqmapi.dll 2011-11-20 12:57:40 606208 —-a-w- C:\Windows\SysWow64\wbem\fastprox.dll 2011-11-20 12:57:40 363008 —-a-w- C:\Windows\SysWow64\wbemcomn.dll 2011-11-20 12:57:40 189952 —-a-w- C:\Program Files (x86)\Windows Portable Devices\sqmapi.dll 2011-11-20 12:55:56 529408 —-a-w- C:\Windows\System32\wbemcomn.dll 2011-11-20 12:55:56 244736 —-a-w- C:\Program Files\Windows Portable Devices\sqmapi.dll 2011-11-20 12:55:45 244736 —-a-w- C:\Windows\System32\sqmapi.dll 2011-11-20 12:44:54 ——– d–h–w- C:\ProgramData\Common Files 2011-11-20 12:44:53 ——– d—–w- C:\Program Files (x86)\AVG 2011-11-20 12:42:12 ——– d—–w- C:\ProgramData\MFAData 2011-11-20 12:33:03 1659776 —-a-w- C:\Windows\System32\drivers\ntfs.sys 2011-11-20 12:33:02 96768 —-a-w- C:\Windows\System32\fsutil.exe 2011-11-20 12:33:02 74240 —-a-w- C:\Windows\SysWow64\fsutil.exe 2011-11-20 12:33:02 410496 —-a-w- C:\Windows\System32\drivers\iaStorV.sys 2011-11-20 12:33:02 27008 —-a-w- C:\Windows\System32\drivers\amdxata.sys 2011-11-20 12:33:02 2565632 —-a-w- C:\Windows\System32\esent.dll 2011-11-20 12:33:02 189824 —-a-w- C:\Windows\System32\drivers\storport.sys 2011-11-20 12:33:02 1699328 —-a-w- C:\Windows\SysWow64\esent.dll 2011-11-20 12:33:02 166272 —-a-w- C:\Windows\System32\drivers\nvstor.sys 2011-11-20 12:33:02 148352 —-a-w- C:\Windows\System32\drivers\nvraid.sys 2011-11-20 12:33:02 107904 —-a-w- C:\Windows\System32\drivers\amdsata.sys 2011-11-20 12:32:56 98816 —-a-w- C:\Windows\System32\drivers\usbccgp.sys 2011-11-20 12:32:56 7936 —-a-w- C:\Windows\System32\drivers\usbd.sys 2011-11-20 12:32:56 52736 —-a-w- C:\Windows\System32\drivers\usbehci.sys 2011-11-20 12:32:56 343040 —-a-w- C:\Windows\System32\drivers\usbhub.sys 2011-11-20 12:32:56 325120 —-a-w- C:\Windows\System32\drivers\usbport.sys 2011-11-20 12:32:56 30720 —-a-w- C:\Windows\System32\drivers\usbuhci.sys 2011-11-20 12:32:56 25600 —-a-w- C:\Windows\System32\drivers\usbohci.sys 2011-11-20 12:32:55 80384 —-a-w- C:\Windows\System32\drivers\BTHUSB.SYS 2011-11-20 12:32:55 552960 —-a-w- C:\Windows\System32\drivers\bthport.sys 2011-11-20 12:32:55 229376 —-a-w- C:\Windows\System32\fsquirt.exe 2011-11-20 12:29:57 ——– d—–w- C:\Users\Tony\AppData\Local\Diagnostics 2011-11-20 12:02:40 ——– d—–w- C:\Program Files (x86)\uTorrent 2011-11-20 12:02:05 ——– d—–w- C:\Users\Tony\AppData\Roaming\uTorrent 2011-11-20 12:02:05 ——– d—–w- C:\Users\Tony\AppData\Local\uTorrent 2011-11-20 11:26:26 ——– d—–w- C:\Users\Tony\AppData\Local\CrashDumps 2011-11-20 10:31:58 ——– d—–w- C:\Windows\SysWow64\Wat 2011-11-20 10:31:58 ——– d—–w- C:\Windows\System32\Wat 2011-11-20 10:04:22 ——– d—–w- C:\Program Files (x86)\MSXML 4.0 2011-11-20 05:01:00 ——– d—–w- C:\ProgramData\Blizzard Entertainment 2011-11-20 05:01:00 ——– d—–w- C:\Program Files (x86)\StarCraft II 2011-11-20 05:01:00 ——– d—–w- C:\Program Files (x86)\Common Files\Blizzard Entertainment 2011-11-20 04:22:59 86528 —-a-w- C:\Windows\SysWow64\SearchFilterHost.exe 2011-11-20 04:20:46 30208 —-a-w- C:\Windows\System32\dnscacheugc.exe 2011-11-20 04:20:46 28672 —-a-w- C:\Windows\SysWow64\dnscacheugc.exe 2011-11-20 04:20:46 183296 —-a-w- C:\Windows\System32\dnsrslvr.dll 2011-11-20 04:20:03 467456 —-a-w- C:\Windows\System32\drivers\srv.sys 2011-11-20 04:20:03 410112 —-a-w- C:\Windows\System32\drivers\srv2.sys 2011-11-20 04:20:03 168448 —-a-w- C:\Windows\System32\drivers\srvnet.sys 2011-11-20 04:20:01 321024 —-a-w- C:\Windows\System32\d3d10_1core.dll 2011-11-20 04:20:01 219136 —-a-w- C:\Windows\SysWow64\d3d10_1core.dll 2011-11-20 04:20:01 197120 —-a-w- C:\Windows\System32\d3d10_1.dll 2011-11-20 04:20:01 161792 —-a-w- C:\Windows\SysWow64\d3d10_1.dll 2011-11-20 04:15:40 270720 ——w- C:\Windows\System32\MpSigStub.exe 2011-11-20 03:59:15 ——– d—–w- C:\Users\Tony\AppData\Roaming\Blio 2011-11-20 03:52:42 ——– d—–w- C:\Users\Tony\AppData\Local\ATI 2011-11-20 03:52:29 ——– d—–w- C:\Users\Tony\AppData\Roaming\PictureMover 2011-11-20 02:54:16 ——– d—–w- C:\Users\Tony\AppData\Local\Broadcom 2011-11-20 02:54:13 ——– d—–w- C:\Users\Tony\AppData\Roaming\Intel Corporation 2011-11-20 02:54:12 ——– d—–w- C:\Users\Tony\AppData\Roaming\Stardock 2011-11-20 02:54:11 ——– d—–w- C:\Users\Tony\AppData\Roaming\hpqLog 2011-11-20 02:53:24 ——– d—–w- C:\Users\Tony\AppData\Local\RemEngine 2011-11-20 02:48:58 ——– d—–w- C:\Users\Tony\AppData\Local\Hewlett-Packard 2011-11-20 02:48:41 ——– d—–w- C:\Users\Tony\AppData\Local\Hewlett-Packard_Company 2011-11-18 22:15:54 39464 —-a-w- C:\Windows\System32\drivers\btwl2cap.sys 2011-11-18 22:15:54 344616 —-a-w- C:\Windows\System32\drivers\btwampfl.sys 2011-11-18 22:15:54 21544 —-a-w- C:\Windows\System32\drivers\btwrchid.sys 2011-11-18 22:15:54 135720 —-a-w- C:\Windows\System32\drivers\btwavdt.sys 2011-11-18 22:15:54 102952 —-a-w- C:\Windows\System32\drivers\btwaudio.sys 2011-11-18 22:15:28 ——– d—–w- C:\Program Files\WIDCOMM 2011-11-18 22:15:20 ——– d—–w- C:\Program Files (x86)\Microsoft 2011-11-18 22:14:49 ——– d—–w- C:\ProgramData\Downloaded Installations 2011-11-18 22:10:15 ——– d—–w- C:\Program Files (x86)\HP Games 2011-11-18 22:10:12 ——– d—–w- C:\ProgramData\WildTangent 2011-11-18 22:09:26 ——– d—–w- C:\ProgramData\Norton 2011-11-18 22:09:05 ——– d—–w- C:\ProgramData\NortonInstaller 2011-11-18 22:08:39 ——– d—–w- C:\ProgramData\Uninstall 2011-11-18 22:08:21 ——– d—–w- C:\Program Files (x86)\Microsoft WSE 2011-11-18 22:08:16 ——– d—–w- C:\ProgramData\RoxioNow 2011-11-18 22:08:13 ——– d—–w- C:\Program Files (x86)\Roxio 2011-11-18 22:08:01 ——– d—–w- C:\ProgramData\PictureMover 2011-11-18 22:08:01 ——– d—–w- C:\Program Files (x86)\PictureMover 2011-11-18 22:05:44 ——– d—–w- C:\Program Files (x86)\Times Reader 2011-11-18 22:05:31 ——– dc-h–w- C:\ProgramData\{05971B75-B620-4D64-9985-7971BEF763A2} 2011-11-18 22:05:30 ——– d—–w- C:\Program Files\Stardock 2011-11-18 21:55:41 0 —-a-w- C:\Windows\ativpsrm.bin 2011-11-18 21:54:26 53248 —-a-w- C:\Windows\SysWow64\CSVer.dll 2011-11-18 21:54:19 ——– d—–w- C:\Windows\Hewlett-Packard 2011-11-18 21:53:27 ——– d—–w- C:\Windows\Driver Cache 2011-11-18 21:53:27 ——– d—–w- C:\Program Files (x86)\HP 2011-11-18 21:50:56 9112168 —-a-w- C:\Windows\SysWow64\RtsUStoricon.dll 2011-11-18 21:50:56 422504 —-a-w- C:\Windows\System32\RtsUStor.dll 2011-11-18 21:50:56 246376 —-a-w- C:\Windows\System32\drivers\RtsUStor.sys 2011-11-18 21:50:56 ——– d—–w- C:\Program Files (x86)\Realtek 2011-11-18 21:50:22 ——– d—–w- C:\Program Files\Validity Sensors 2011-11-18 21:49:59 437272 —-a-w- C:\Windows\System32\drivers\iaStor.sys 2011-11-18 21:49:56 8192 —-a-w- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll 2011-11-18 21:49:56 8192 —-a-w- C:\Windows\System32\drivers\IntelMEFWVer.dll 2011-11-18 21:49:50 ——– d—–w- C:\Program Files (x86)\Common Files\postureAgent 2011-11-18 21:49:38 ——– d—–w- C:\Program Files\Synaptics 2011-11-18 21:48:11 ——– d—–w- C:\Program Files\ATI 2011-11-18 21:48:09 ——– d—–w- C:\Program Files (x86)\ATI Technologies 2011-11-18 21:38:29 ——– d—–w- C:\Windows\ehome . ==================== Find3M ==================== . 2011-11-21 04:34:49 175616 —-a-w- C:\Windows\System32\msclmd.dll 2011-11-21 04:34:49 152576 —-a-w- C:\Windows\SysWow64\msclmd.dll 2011-10-03 12:06:03 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2011-09-29 16:29:28 1923952 —-a-w- C:\Windows\System32\drivers\tcpip.sys 2011-09-29 04:03:32 3144704 —-a-w- C:\Windows\System32\win32k.sys . ============= FINISH: 19:24:03.06 ===============

So I started the combo fix program… and walked off for a bit… when I got back this is what I saw: ComboFix 11-12-10.01 - Tony 12/10/2011 5:50.3.8 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8174.6780 [GMT -7:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((( Files Created from 2011-11-10 to 2011-12-10 ))))))))))))))))))))))))))))))) . . 2011-12-01 05:51 . 2011-12-01 05:51 ——– d—–w- c:\programdata\Visan 2011-12-01 05:49 . 2011-12-01 05:49 ——– d—–w- c:\programdata\WEBREG 2011-12-01 05:47 . 2009-07-14 01:41 230400 —-a-w- c:\windows\system32\Spool\prtprocs\x64\hpzppw71.dll 2011-12-01 05:30 . 2011-02-19 12:05 1139200 —-a-w- c:\windows\system32\FntCache.dll 2011-12-01 05:30 . 2011-02-19 12:04 1544192 —-a-w- c:\windows\system32\DWrite.dll 2011-12-01 05:30 . 2011-02-19 12:04 902656 —-a-w- c:\windows\system32\d2d1.dll 2011-12-01 05:30 . 2011-02-19 06:30 1076736 —-a-w- c:\windows\SysWow64\DWrite.dll 2011-12-01 05:30 . 2011-02-19 06:30 739840 —-a-w- c:\windows\SysWow64\d2d1.dll 2011-12-01 05:22 . 2011-12-01 05:22 ——– d—–w- c:\program files (x86)\Yahoo! 2011-12-01 05:22 . 2011-12-01 05:22 ——– d—–w- c:\programdata\Yahoo! Companion 2011-12-01 05:22 . 2011-12-01 05:22 ——– d—–w- c:\program files (x86)\Coupons 2011-12-01 05:22 . 2011-12-01 05:22 ——– d—–w- c:\programdata\HP Product Assistant 2011-12-01 05:21 . 2011-12-01 05:21 ——– d—–w- c:\program files (x86)\Common Files\HP 2011-12-01 05:21 . 2011-12-01 05:21 ——– d—–w- c:\program files (x86)\Common Files\Hewlett-Packard 2011-12-01 05:20 . 2011-12-01 05:22 ——– d—–w- c:\programdata\HP 2011-11-29 02:41 . 2009-05-18 20:17 34152 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2011-11-29 02:41 . 2008-04-17 19:12 126312 —-a-w- c:\windows\system32\GEARAspi64.dll 2011-11-29 02:41 . 2008-04-17 19:12 107368 —-a-w- c:\windows\SysWow64\GEARAspi.dll 2011-11-29 02:40 . 2011-11-29 02:41 ——– d—–w- c:\programdata\{93E26451-CD9A-43A5-A2FA-C42392EA4001} 2011-11-29 02:40 . 2011-11-29 02:41 ——– d—–w- c:\program files\iTunes 2011-11-29 02:40 . 2011-11-29 02:41 ——– d—–w- c:\program files (x86)\iTunes 2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\programdata\Apple Computer 2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files\iPod 2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files (x86)\Apple Software Update 2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files\Common Files\Apple 2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files\Bonjour 2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files (x86)\Bonjour 2011-11-29 02:39 . 2011-11-29 02:40 ——– d—–w- c:\program files (x86)\Common Files\Apple 2011-11-29 02:39 . 2011-11-29 02:40 ——– d—–w- c:\programdata\Apple 2011-11-29 02:38 . 2011-11-29 02:38 ——– d—–w- C:\itunes 2011-11-26 02:13 . 2011-11-26 02:13 8507392 —-a-w- c:\windows\system32\drivers\NETwNs64.sys 2011-11-26 02:13 . 2011-11-26 02:13 799232 —-a-w- c:\windows\system32\NETwNc64.dll 2011-11-26 02:13 . 2011-11-26 02:13 2750464 —-a-w- c:\windows\system32\NETwNr64.dll 2011-11-24 13:55 . 2011-11-24 13:55 55384 —-a-w- c:\windows\system32\drivers\SBREDrv.sys 2011-11-24 13:54 . 2011-12-07 07:51 ——– dc—-w- c:\windows\system32\DRVSTORE 2011-11-24 13:54 . 2011-11-24 13:54 ——– d—–w- c:\programdata\Lavasoft 2011-11-24 13:54 . 2011-11-24 13:54 ——– d—–w- c:\program files (x86)\Lavasoft 2011-11-24 13:24 . 2011-11-24 13:47 ——– d—–w- C:\f7bf4a5b04f1dad3f79b7d80c634b0c3 2011-11-24 11:39 . 2011-11-24 11:39 ——– d—–w- c:\windows\en 2011-11-24 11:37 . 2011-11-24 11:37 ——– d—–w- c:\program files\Windows Live 2011-11-21 05:30 . 2011-11-21 05:30 ——– d—–w- c:\windows\Sun 2011-11-21 04:01 . 2011-11-21 04:01 ——– d—–w- c:\windows\system32\SPReview 2011-11-21 04:01 . 2011-11-21 04:01 ——– d—–w- c:\windows\system32\EventProviders 2011-11-20 20:34 . 2011-03-02 10:43 203264 —-a-w- c:\windows\system32\unrar.dll 2011-11-20 20:34 . 2011-11-20 20:34 ——– d—–w- c:\program files\K-Lite Codec Pack x64 2011-11-20 20:34 . 2011-10-04 18:00 86016 —-a-w- c:\windows\system32\ff_vfw.dll 2011-11-20 16:24 . 2011-11-20 16:24 ——– d—–w- c:\program files (x86)\FVD Suite 2011-11-20 16:12 . 2011-11-20 16:12 ——– d—–w- c:\program files (x86)\Common Files\Java 2011-11-20 14:24 . 2011-11-20 14:24 ——– d—–w- C:\firefox 2011-11-20 13:47 . 2011-11-20 16:10 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2011-11-20 13:47 . 2011-11-20 13:47 ——– d—–w- c:\windows\system32\Macromed 2011-11-20 13:47 . 2011-11-20 13:47 ——– d—–w- c:\programdata\McAfee 2011-11-20 13:25 . 2011-11-20 13:25 ——– d—–w- C:\direct x files 2011-11-20 13:13 . 2011-11-20 13:13 ——– d—–w- c:\program files\Media Player Classic - Home Cinema 2011-11-20 13:01 . 2010-11-05 01:57 48976 —-a-w- c:\windows\system32\netfxperf.dll 2011-11-20 13:01 . 2010-11-05 01:57 1942856 —-a-w- c:\windows\system32\dfshim.dll 2011-11-20 13:01 . 2010-11-05 01:58 1130824 —-a-w- c:\windows\SysWow64\dfshim.dll 2011-11-20 13:01 . 2010-11-20 13:27 12288 —-a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll 2011-11-20 13:01 . 2010-11-20 13:27 3715584 —-a-w- c:\windows\system32\mstscax.dll 2011-11-20 13:01 . 2010-11-20 13:26 1838080 —-a-w- c:\windows\system32\d3d10warp.dll 2011-11-20 13:01 . 2010-11-20 11:07 59392 —-a-w- c:\windows\system32\drivers\TsUsbFlt.sys 2011-11-20 13:01 . 2010-11-20 13:27 14967808 —-a-w- c:\program files\DVD Maker\OmdBase.dll 2011-11-20 12:59 . 2010-11-20 13:27 266240 —-a-w- c:\windows\system32\QAGENT.DLL 2011-11-20 12:58 . 2010-11-20 13:27 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2011-11-20 12:57 . 2010-11-20 13:01 2560 —-a-w- c:\windows\system32\drivers\en-US\rdpwd.sys.mui 2011-11-20 12:57 . 2010-11-20 12:57 3072 —-a-w- c:\windows\system32\drivers\en-US\tsusbflt.sys.mui 2011-11-20 12:57 . 2010-11-20 13:11 6144 —-a-w- c:\windows\system32\drivers\en-US\IPMIDrv.sys.mui 2011-11-20 12:57 . 2010-11-20 13:10 4608 —-a-w- c:\windows\system32\drivers\en-US\kbdclass.sys.mui 2011-11-20 12:57 . 2010-11-20 13:26 399872 —-a-w- c:\windows\system32\dpx.dll 2011-11-20 12:57 . 2010-11-20 12:21 189952 —-a-w- c:\windows\SysWow64\wdscore.dll 2011-11-20 12:57 . 2010-11-20 12:21 189952 —-a-w- c:\windows\SysWow64\sqmapi.dll 2011-11-20 12:57 . 2010-11-20 12:21 363008 —-a-w- c:\windows\SysWow64\wbemcomn.dll 2011-11-20 12:57 . 2010-11-20 12:21 189952 —-a-w- c:\program files (x86)\Windows Portable Devices\sqmapi.dll 2011-11-20 12:57 . 2010-11-20 12:19 606208 —-a-w- c:\windows\SysWow64\wbem\fastprox.dll 2011-11-20 12:55 . 2010-11-20 13:27 529408 —-a-w- c:\windows\system32\wbemcomn.dll 2011-11-20 12:55 . 2010-11-20 13:27 244736 —-a-w- c:\program files\Windows Portable Devices\sqmapi.dll 2011-11-20 12:55 . 2010-11-20 13:27 244736 —-a-w- c:\windows\system32\sqmapi.dll 2011-11-20 12:44 . 2011-11-20 12:44 ——– d–h–w- c:\programdata\Common Files 2011-11-20 12:44 . 2011-11-20 12:44 ——– d—–w- c:\program files (x86)\AVG 2011-11-20 12:42 . 2011-11-20 12:44 ——– d—–w- c:\programdata\MFAData 2011-11-20 12:33 . 2011-03-11 06:41 1659776 —-a-w- c:\windows\system32\drivers\ntfs.sys 2011-11-20 12:33 . 2011-03-11 06:41 189824 —-a-w- c:\windows\system32\drivers\storport.sys 2011-11-20 12:33 . 2011-03-11 06:41 166272 —-a-w- c:\windows\system32\drivers\nvstor.sys 2011-11-20 12:33 . 2011-03-11 06:41 148352 —-a-w- c:\windows\system32\drivers\nvraid.sys 2011-11-20 12:33 . 2011-03-11 06:41 410496 —-a-w- c:\windows\system32\drivers\iaStorV.sys 2011-11-20 12:33 . 2011-03-11 06:41 27008 —-a-w- c:\windows\system32\drivers\amdxata.sys 2011-11-20 12:33 . 2011-03-11 06:41 107904 —-a-w- c:\windows\system32\drivers\amdsata.sys 2011-11-20 12:33 . 2011-03-11 06:33 2565632 —-a-w- c:\windows\system32\esent.dll 2011-11-20 12:33 . 2011-03-11 06:30 96768 —-a-w- c:\windows\system32\fsutil.exe 2011-11-20 12:33 . 2011-03-11 05:33 1699328 —-a-w- c:\windows\SysWow64\esent.dll 2011-11-20 12:33 . 2011-03-11 05:31 74240 —-a-w- c:\windows\SysWow64\fsutil.exe 2011-11-20 12:32 . 2011-03-25 03:29 343040 —-a-w- c:\windows\system32\drivers\usbhub.sys 2011-11-20 12:32 . 2011-03-25 03:29 98816 —-a-w- c:\windows\system32\drivers\usbccgp.sys 2011-11-20 12:32 . 2011-03-25 03:29 325120 —-a-w- c:\windows\system32\drivers\usbport.sys 2011-11-20 12:32 . 2011-03-25 03:29 52736 —-a-w- c:\windows\system32\drivers\usbehci.sys 2011-11-20 12:32 . 2011-03-25 03:29 25600 —-a-w- c:\windows\system32\drivers\usbohci.sys 2011-11-20 12:32 . 2011-03-25 03:29 30720 —-a-w- c:\windows\system32\drivers\usbuhci.sys 2011-11-20 12:32 . 2011-03-25 03:28 7936 —-a-w- c:\windows\system32\drivers\usbd.sys 2011-11-20 12:32 . 2011-04-28 03:55 552960 —-a-w- c:\windows\system32\drivers\bthport.sys 2011-11-20 12:32 . 2011-04-28 03:54 80384 —-a-w- c:\windows\system32\drivers\BTHUSB.SYS 2011-11-20 12:32 . 2010-11-20 13:24 229376 —-a-w- c:\windows\system32\fsquirt.exe 2011-11-20 12:02 . 2011-11-20 12:02 ——– d—–w- c:\program files (x86)\uTorrent 2011-11-20 10:31 . 2011-11-20 10:31 ——– d—–w- c:\windows\SysWow64\Wat 2011-11-20 10:31 . 2011-11-20 10:31 ——– d—–w- c:\windows\system32\Wat 2011-11-20 10:04 . 2011-11-20 10:04 ——– d—–w- c:\program files (x86)\MSXML 4.02011-11-20 05:01 . 2011-11-20 06:23 ——– d—–w- c:\programdata\Blizzard Entertainment 2011-11-20 05:01 . 2011-11-20 06:23 ——– d—–w- c:\program files (x86)\StarCraft II 2011-11-20 05:01 . 2011-11-20 05:25 ——– d—–w- c:\program files (x86)\Common Files\Blizzard Entertainment 2011-11-20 04:22 . 2011-09-29 16:29 1923952 —-a-w- c:\windows\system32\drivers\tcpip.sys 2011-11-20 04:20 . 2011-03-03 06:24 183296 —-a-w- c:\windows\system32\dnsrslvr.dll 2011-11-20 04:20 . 2011-03-03 06:21 30208 —-a-w- c:\windows\system32\dnscacheugc.exe 2011-11-20 04:20 . 2011-03-03 05:36 28672 —-a-w- c:\windows\SysWow64\dnscacheugc.exe 2011-11-20 04:20 . 2011-04-29 03:06 467456 —-a-w- c:\windows\system32\drivers\srv.sys 2011-11-20 04:20 . 2011-04-29 03:05 410112 —-a-w- c:\windows\system32\drivers\srv2.sys 2011-11-20 04:20 . 2011-04-29 03:05 168448 —-a-w- c:\windows\system32\drivers\srvnet.sys 2011-11-20 04:20 . 2011-01-17 11:09 197120 —-a-w- c:\windows\system32\d3d10_1.dll 2011-11-20 04:20 . 2011-01-17 05:47 161792 —-a-w- c:\windows\SysWow64\d3d10_1.dll 2011-11-20 04:20 . 2010-11-20 13:26 321024 —-a-w- c:\windows\system32\d3d10_1core.dll 2011-11-20 04:20 . 2010-11-20 12:18 219136 —-a-w- c:\windows\SysWow64\d3d10_1core.dll 2011-11-20 04:15 . 2011-05-25 01:14 270720 ——w- c:\windows\system32\MpSigStub.exe 2011-11-20 02:49 . 2011-11-20 02:49 ——– d—–w- c:\users\Public\Symantec 2011-11-20 02:47 . 2011-11-20 02:53 ——– d—–w- c:\users\Tony 2011-11-18 22:24 . 2011-11-18 22:24 ——– d—–w- c:\programdata\ATI 2011-11-18 22:14 . 2011-11-18 22:14 ——– d—–w- c:\programdata\Downloaded Installations 2011-11-18 22:10 . 2011-11-18 22:14 ——– d—–w- c:\program files (x86)\HP Games . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-12-04 03:52 . 2010-10-26 22:01 627600 —-a-w- c:\windows\system32\deployJava1.dll 2011-11-24 11:36 . 2010-06-24 18:33 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-11-21 04:34 . 2009-07-14 02:36 175616 —-a-w- c:\windows\system32\msclmd.dll 2011-11-21 04:34 . 2009-07-14 02:36 152576 —-a-w- c:\windows\SysWow64\msclmd.dll 2011-10-03 12:06 . 2010-10-26 22:01 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll . . ((((((((((((((((((((((((((((( SnapShot@2011-12-01_12.26.19 ))))))))))))))))))))))))))))))))))))))))) . + 2010-08-06 18:13 . 2010-08-06 18:13 34816 c:\windows\SysWOW64\HPZipr12.dll + 2010-08-06 18:13 . 2010-08-06 18:13 50688 c:\windows\SysWOW64\HPZidr12.dll + 2010-10-26 21:43 . 2011-12-10 12:49 46592 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2011-12-10 12:49 32444 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2010-08-06 18:15 . 2010-08-06 18:15 30208 c:\windows\system32\hpzisn12.dll + 2010-08-06 18:15 . 2010-08-06 18:15 45056 c:\windows\system32\hpzipt12.dll - 2008-12-04 03:05 . 2008-12-04 03:05 45056 c:\windows\system32\hpzipt12.dll + 2010-08-06 18:15 . 2010-08-06 18:15 54784 c:\windows\system32\HPZipr12.dll + 2010-08-06 18:15 . 2010-08-06 18:15 89600 c:\windows\system32\HPZipm12.dll - 2008-12-04 03:05 . 2008-12-04 03:05 89600 c:\windows\system32\HPZipm12.dll + 2010-08-06 18:15 . 2010-08-06 18:15 71680 c:\windows\system32\HPZinw12.dll - 2008-12-04 03:05 . 2008-12-04 03:05 71680 c:\windows\system32\HPZinw12.dll + 2010-08-06 18:15 . 2010-08-06 18:15 79872 c:\windows\system32\HPZidr12.dll + 2010-01-19 22:12 . 2010-01-19 22:12 70144 c:\windows\system32\HPBWSDR.DLL + 2010-07-23 16:55 . 2010-07-23 16:55 57344 c:\windows\system32\hpbpro.dll + 2010-07-23 16:55 . 2010-07-23 16:55 33280 c:\windows\system32\hpboid.dll - 2008-03-05 04:45 . 2008-03-05 04:45 33280 c:\windows\system32\hpboid.dll + 2010-07-23 16:55 . 2010-07-23 16:55 32768 c:\windows\system32\hpbmiapi.dll - 2008-03-05 04:45 . 2008-03-05 04:45 32768 c:\windows\system32\hpbmiapi.dll + 2011-12-01 15:41 . 2011-09-01 00:00 25416 c:\windows\system32\drivers\mbam.sys - 2011-11-18 23:31 . 2011-12-01 12:11 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-11-18 23:31 . 2011-12-10 12:51 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-12-04 00:27 . 2011-12-10 12:51 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2011-11-18 23:31 . 2011-12-01 12:11 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2011-12-10 12:51 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2011-12-01 12:11 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:46 . 2011-12-03 16:03 94472 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat - 2011-11-20 05:10 . 2011-11-20 05:10 10134 c:\windows\Installer\{CB706270-54EA-4E48-9FFB-0B95FA04DBE6}\ARPPRODUCTICON.exe + 2011-12-04 04:00 . 2011-12-04 04:00 10134 c:\windows\Installer\{CB706270-54EA-4E48-9FFB-0B95FA04DBE6}\ARPPRODUCTICON.exe + 2011-11-20 11:30 . 2011-12-01 16:12 4954 c:\windows\system32\wdi\ERCQueuedResolutions.dat + 2011-11-20 02:48 . 2011-12-10 12:49 7486 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-95099818-689510529-2622086942-1000_UserData.bin + 2010-07-23 16:55 . 2010-07-23 16:55 9728 c:\windows\system32\hpbprops.dll - 2008-03-05 04:45 . 2008-03-05 04:45 9728 c:\windows\system32\hpbprops.dll - 2008-03-05 04:45 . 2008-03-05 04:45 9216 c:\windows\system32\hpboidps.dll + 2010-07-23 16:55 . 2010-07-23 16:55 9216 c:\windows\system32\hpboidps.dll + 2011-12-10 12:47 . 2011-12-10 12:47 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2011-12-01 12:26 . 2011-12-01 12:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2011-12-10 12:47 . 2011-12-10 12:47 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-07-14 04:54 . 2011-12-09 01:11 983040 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-07-14 04:54 . 2011-12-01 12:17 983040 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-11-20 02:45 . 2011-12-10 07:57 274824 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2009-07-14 02:36 . 2011-12-10 12:54 624178 c:\windows\system32\perfh009.dat - 2009-07-14 02:36 . 2011-12-01 12:01 624178 c:\windows\system32\perfh009.dat + 2009-07-14 02:36 . 2011-12-10 12:54 106522 c:\windows\system32\perfc009.dat - 2009-07-14 02:36 . 2011-12-01 12:01 106522 c:\windows\system32\perfc009.dat + 2010-10-26 22:01 . 2011-12-04 03:52 252296 c:\windows\system32\javaws.exe + 2010-10-26 22:01 . 2011-12-04 03:52 188808 c:\windows\system32\javaw.exe + 2010-10-26 22:01 . 2011-12-04 03:52 188808 c:\windows\system32\java.exe + 2009-11-27 19:15 . 2009-11-27 19:15 228864 c:\windows\system32\hplbddrv.dll - 2009-07-14 05:01 . 2011-12-01 12:25 256404 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 05:01 . 2011-12-10 12:46 256404 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2011-12-09 01:11 . 2011-12-09 01:11 583168 c:\windows\Installer\8dc2a9a.msi + 2011-12-04 03:51 . 2011-12-04 03:51 973312 c:\windows\Installer\56289d.msi + 2011-04-25 18:17 . 2011-04-25 18:17 502784 c:\windows\Installer\538810e.msi + 2011-11-18 22:25 . 2011-12-09 10:07 1160224 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2011-12-04 03:59 . 2011-12-04 03:59 4528128 c:\windows\Installer\5628a1.msi - 2009-07-14 04:54 . 2011-12-01 12:17 14860288 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2011-12-09 01:11 14860288 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2011-12-01 12:17 16187392 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:54 . 2011-12-09 01:11 16187392 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-11-21 04:26 . 2011-12-10 12:46 24198180 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-95099818-689510529-2622086942-1000-12288.dat . – Snapshot reset to current date – . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-08-16 2736128] "Corel Photo Downloader"="c:\program files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2010-09-07 525968] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-09-09 98304] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-11-13 421736] "IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-09-14 283160] "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2009-11-18 54576] "HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-09-29 584760] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-7-29 1132320] HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072] Snapfish PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe [2010-9-28 1040952] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . R2 CLKMSVC10_C6F09094;CyberLink Product - 2011/11/18 13:57;c:\program files (x86)\Hewlett-Packard\Media\DVD\Kernel\HDDVD\NavFilter\kmsvc.exe [2010-09-21 245232] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-07-21 103992] R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys [x] R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-03 89600] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 HPAuto;HP Auto;c:\program files\Hewlett-Packard\HP Auto\HPAuto.exe [2010-08-06 681528] S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-08-06 291896] S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-05-21 103992] S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x] S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-09-29 26680] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-09-14 13336] S2 RoxioNow Service;RoxioNow Service;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-09-11 399344] S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-09-30 2655768] S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2010-02-23 2192176] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x] S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x] S3 clwvd;HP Webcam Splitter;c:\windows\system32\DRIVERS\clwvd.sys [x] S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x] S3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x] . . — Other Services/Drivers In Memory — . *Deregistered* - CLKMDRV10_C6F09094 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2010-08-16 21:43 451872 —-a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder . 2011-12-10 c:\windows\Tasks\HP Photo Creations Communicator.job - c:\programdata\HP Photo Creations\MessageCheck.exe [2011-12-01 05:51] . 2011-11-26 c:\windows\Tasks\HPCeeScheduleForTony.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter] @="{D25B32FE-CB96-491A-98FF-AD59DA382D69}" [HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}] 2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter] @="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}" [HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}] 2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter] @="{B3C78E40-6B64-47C3-AE34-60B770881EB8}" [HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}] 2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter] @="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}" [HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}] 2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter] @="{855156F0-2A0F-11DE-8C30-0800200C9A66}" [HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}] 2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-07-22 487424] "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU] "SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2010-09-01 611896] "HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-07-21 8192] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler] "{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences Pro\FencesMenu64.dll" [2010-09-16 464744] . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com/ uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\b57io866.default\ FF - prefs.js: browser.search.selectedEngine - Google Custom Search FF - prefs.js: browser.startup.homepage - hxxp://my.apexfitness.com/ . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2011-12-10 05:59:53 ComboFix-quarantined-files.txt 2011-12-10 12:59 ComboFix2.txt 2011-12-01 12:56 ComboFix3.txt 2011-12-01 12:31 . Pre-Run: 886,072,459,264 bytes free Post-Run: 885,908,115,456 bytes free . - - End Of File - - 4E8EC28AA3BB60D1000B9178A30BA132