Virus - Can't Get Online

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post





Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
• Press Start Scan
  
  • Only if Malicious objects are found then ensure Cure is selected
    If suspicious objects are found select skip
  • Then click Continue > Reboot now
• Copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)

• Download OTL to your desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• Check the boxes beside LOP Check and Purity Check.
• Under Custom Scan paste this in
  
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  /md5stop
  C:\Windows\assembly\tmp\U\*.* /s
  CREATERESTOREPOINT
  
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
• You may need two posts to fit them both in.

OTL logfile created on: 12/6/2011 5:05:18 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Matt\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.63 Gb Available Physical Memory | 80.99% Memory free
5.09 Gb Paging File | 4.68 Gb Available in Paging File | 91.79% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 389.59 Gb Free Space | 83.65% Space Free | Partition Type: NTFS
Drive E: | 74.52 Gb Total Space | 46.13 Gb Free Space | 61.90% Space Free | Partition Type: NTFS
Drive H: | 408.99 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF
Drive I: | 395.81 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF
Drive J: | 411.96 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: MSTEIN | User Name: Matt | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Matt\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCoreGecko8.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\[removed]\platform\WINNT_x86-msvc\components\lpxpcom.dll ()
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()


========== Win32 Services (SafeList) ==========

SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (nvUpdatusService) – C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (LBTServ) – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (UMVPFSrv) – C:\Program Files\Common Files\Logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV - (nosGetPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (nSvcIp) – C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe ()
SRV - (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM) – C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe ()
SRV - (PCToolsSSDMonitorSvc) – C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe (PC Tools)
SRV - (IntuitUpdateService) – C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)


========== Driver Services (SafeList) ==========

DRV - (MpKsle4ef30a9) – c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{805F10F0-B9B2-44A3-AD06-8E9C52C60BFD}\MpKsle4ef30a9.sys (Microsoft Corporation)
DRV - (MpKsld9bea51d) – c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{805F10F0-B9B2-44A3-AD06-8E9C52C60BFD}\MpKsld9bea51d.sys (Microsoft Corporation)
DRV - (LMouFilt) – C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LBeepKE) – C:\WINDOWS\system32\drivers\LBeepKE.sys (Logitech, Inc.)
DRV - (MBAMProtector) – C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (LVUVC) Logitech Webcam Pro 9000(UVC) – C:\WINDOWS\system32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVRS) – C:\WINDOWS\system32\drivers\lvrs.sys (Logitech Inc.)
DRV - (ssadmdm) – C:\WINDOWS\system32\drivers\ssadmdm.sys (MCCI Corporation)
DRV - (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) – C:\WINDOWS\system32\drivers\ssadbus.sys (MCCI Corporation)
DRV - (ssadmdfl) SAMSUNG Android USB Modem (Filter) – C:\WINDOWS\system32\drivers\ssadmdfl.sys (MCCI Corporation)
DRV - (androidusb) – C:\WINDOWS\system32\drivers\ssadadb.sys (Google Inc)
DRV - (L8042Kbd) – C:\WINDOWS\system32\drivers\L8042Kbd.sys (Logitech, Inc.)
DRV - (nvgts) – C:\WINDOWS\system32\DRIVERS\nvgts.sys (NVIDIA Corporation)
DRV - (nvnetbus) – C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (sscdmdfl) – C:\WINDOWS\system32\drivers\sscdmdfl.sys (MCCI Corporation)
DRV - (sscdmdm) – C:\WINDOWS\system32\drivers\sscdmdm.sys (MCCI Corporation)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) – C:\WINDOWS\system32\drivers\sscdbus.sys (MCCI Corporation)
DRV - (Revoflt) – C:\WINDOWS\system32\drivers\revoflt.sys (VS Revo Group)
DRV - (Monfilt) – C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)
DRV - (Ambfilt) – C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (BVRPMPR5) – C:\WINDOWS\system32\drivers\BVRPMPR5.SYS (Avanquest Software)
DRV - (pavboot) – C:\WINDOWS\system32\drivers\pavboot.sys (Panda Security, S.L.)
DRV - (mcdbus) – C:\WINDOWS\system32\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (AsIO) – C:\WINDOWS\system32\drivers\AsIO.sys ()
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ASACPI.sys ()
DRV - (ICAM5USB) Intel® – C:\WINDOWS\system32\drivers\ICAM5D2.sys (Intel Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=Z192&install;_date=20111202
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = B1 86 26 38 64 E7 E0 48 A4 0F AC 5A 55 5B 4E 47 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://rivals.yahoo.com/ncaa/football"
FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.51
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.72.0
FF - prefs.js..extensions.enabledItems: {37fa1426-b82d-11db-8314-0800200c9a66}:2.7.7
FF - prefs.js..extensions.enabledItems: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3}:2.0.12
FF - prefs.js..extensions.enabledItems: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:2.9.3
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:3.3.5.1
FF - prefs.js..extensions.enabledItems: [removed]:5.0.1
FF - prefs.js..extensions.enabledItems: [removed]:3.9.10
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.3
FF - prefs.js..extensions.enabledItems: [removed]:1.0.4
FF - prefs.js..extensions.enabledItems: [removed]:1.21.0.11
FF - prefs.js..keyword.URL: "chrome://browser-region/locale/region.properties"


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandasecurity.com/activescan: C:\Program Files\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security, S.L.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\Matt\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Documents and Settings\Matt\Application Data\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Documents and Settings\Matt\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Matt\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Matt\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[removed]: C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2011/08/18 17:02:04 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/12/05 18:17:25 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/12/05 18:24:22 | 000,000,000 | —D | M]

[2011/11/29 08:17:17 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Matt\Application Data\Mozilla\Extensions
[2011/12/06 04:22:14 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions
[2011/07/26 14:36:43 | 000,000,000 | —D | M] (Forecastfox) – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
[2011/08/25 15:11:05 | 000,000,000 | —D | M] (Garmin Communicator) – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2011/11/05 07:44:40 | 000,000,000 | —D | M] (WebMail Notifier) – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\{37fa1426-b82d-11db-8314-0800200c9a66}
[2011/12/06 04:22:14 | 000,000,000 | —D | M] (Zynga Community Toolbar) – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
[2011/08/09 19:17:00 | 000,000,000 | —D | M] (Разпознаване на устройство Logitech) – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\[removed]
[2010/10/25 03:34:55 | 000,000,000 | —D | M] (United States English Spellchecker) – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\[removed]
[2011/10/16 07:57:05 | 000,000,000 | —D | M] ("Xmarks") – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\[removed]
[2011/11/29 18:06:43 | 000,000,000 | —D | M] (LastPass) – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\extensions\[removed]
[2010/01/16 19:24:59 | 000,002,172 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\searchplugins\bing.xml
[2011/11/29 07:33:53 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/10/20 19:04:20 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}
() (No name found) – C:\DOCUMENTS AND SETTINGS\MATT\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\TF8574LJ.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\MATT\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\TF8574LJ.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\MATT\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\TF8574LJ.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\MATT\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\TF8574LJ.DEFAULT\EXTENSIONS\[removed]
[2011/12/04 06:13:04 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2009/11/19 17:16:28 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2011/10/20 19:04:06 | 000,611,224 | —- | M] (Oracle Corporation) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2008/12/23 11:06:38 | 000,072,960 | —- | M] (Foxit Software Company) – C:\Program Files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2009/11/19 17:16:29 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2011/12/04 06:13:02 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/11/15 07:44:17 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml.old
[2011/12/04 06:13:01 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2011/12/05 19:01:25 | 000,440,331 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 adobe.activate.com
O1 - Hosts: 127.0.0.1 125.252.224.90
O1 - Hosts: 127.0.0.1 125.252.224.91
O1 - Hosts: 127.0.0.1 3dns.adobe.com
O1 - Hosts: 127.0.0.1 3dns-1.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-4.adobe.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip1.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip2.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip4.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-1.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-4.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 practivate.adobe
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.newoa
O1 - Hosts: 15145 more lines…
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (LastPass Browser Helper Object) - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (LastPass Toolbar) - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [CCEnhancer] C:\Documents and Settings\Matt\My Documents\My Stuff\My Downloads\Spy\CCEnhancer.exe ()
O4 - HKLM..\Run: [CPU Power Monitor] C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe ()
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe ()
O4 - HKCU..\Run: [Facebook Update] C:\Documents and Settings\Matt\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKCU..\Run: [FileHippo.com] C:\Program Files\FileHippo.com\UpdateChecker.exe (FileHippo.com)
O4 - HKCU..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe (PC Tools)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Documents and Settings\Matt\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: LastPass - file://C:\Program Files\LastPass\context.html?cmd=lastpass File not found
O8 - Extra context menu item: LastPass Fill Forms - file://C:\Program Files\LastPass\context.html?cmd=fillforms File not found
O9 - Extra Button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1263443305593 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A5FDCD83-6516-490F-8578-7EE35E0E650C}: DhcpNameServer = 10.0.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop WallPaper: C:\WINDOWS\Guardian Angels.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Guardian Angels.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/01/13 10:16:06 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/12/06 16:27:15 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Matt\Desktop\OTL.exe
[2011/12/06 16:24:59 | 001,566,512 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Matt\Desktop\TDSSKiller.exe
[2011/12/06 05:10:58 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Matt\Recent
[2011/12/05 18:17:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\QuickTime
[2011/12/05 18:17:02 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2011/12/05 18:17:02 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Apple Computer
[2011/12/05 18:06:09 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\Local Settings\Application Data\Apple
[2011/12/03 11:39:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\My Documents\My Music
[2011/12/02 18:00:46 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\My Documents\MBA Classes
[2011/12/02 17:32:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\Application Data\Reviversoft
[2011/12/02 17:32:03 | 000,000,000 | —D | C] – C:\Program Files\Reviversoft
[2011/12/02 16:26:40 | 000,000,000 | –SD | C] – C:\ComboFix
[2011/12/02 16:15:46 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\Application Data\ElevatedDiagnostics
[2011/12/02 05:43:58 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NVIDIA Corporation
[2011/12/02 05:43:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NVIDIA
[2011/12/02 05:43:32 | 016,744,256 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvcpl.dll
[2011/12/02 05:43:32 | 000,220,992 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvcolor.exe
[2011/12/02 05:43:32 | 000,203,072 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvmctray.dll
[2011/12/02 05:43:30 | 000,602,432 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\easyupdatusapiu.dll
[2011/12/02 05:43:30 | 000,054,272 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvwddi.dll
[2011/12/02 05:18:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\Local Settings\Application Data\Microsoft Help
[2011/12/01 23:22:37 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/12/01 22:52:50 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\TEMP
[2011/12/01 22:48:11 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2011/12/01 22:32:25 | 000,069,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ztvcabinet.dll
[2011/12/01 22:32:25 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\My Documents\Simply Super Software
[2011/12/01 22:15:46 | 000,000,000 | R–D | C] – C:\Documents and Settings\Matt\My Documents\My Videos
[2011/12/01 22:15:46 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Matt\PrintHood
[2011/12/01 22:15:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Favorites
[2011/12/01 18:40:20 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\Application Data\Malwarebytes
[2011/12/01 18:40:06 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/12/01 18:40:02 | 000,022,216 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/12/01 18:40:02 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/12/01 18:37:00 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\Local Settings\Application Data\uTorrent
[2011/12/01 16:59:03 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth
[2011/12/01 16:13:34 | 000,000,000 | —D | C] – C:\WINDOWS\System32\CatRoot2
[2011/11/30 15:54:16 | 000,200,976 | —- | C] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\tmcomm.sys
[2011/11/30 15:43:49 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\Application Data\Registry Mechanic
[2011/11/30 05:21:01 | 000,000,000 | —D | C] – C:\WINDOWS\System32\CatRoot2_2011121161327
[2011/11/30 04:56:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Templates
[2011/11/29 18:50:44 | 000,000,000 | —D | C] – C:\WINDOWS\System32\CatRoot2_2011113052054
[2011/11/29 18:44:50 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Matt\NetHood
[2011/11/29 18:06:38 | 010,135,584 | —- | C] (LastPass) – C:\Program Files\Common Files\lpuninstall.exe
[2011/11/29 18:06:33 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\Start Menu\Programs\LastPass
[2011/11/29 18:06:33 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\LastPass
[2011/11/29 17:22:49 | 000,000,000 | —D | C] – C:\Program Files\Belarc
[2011/11/29 05:57:37 | 000,000,000 | —D | C] – C:\Documents and Settings\Matt\Local Settings\Application Data\SlimWare Utilities Inc
[2011/11/25 15:00:16 | 000,000,000 | —D | C] – C:\Program Files\CCleaner

========== Files - Modified Within 30 Days ==========

[2011/12/06 16:36:31 | 000,000,424 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/12/06 16:31:26 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/12/06 16:31:02 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/12/06 16:27:17 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Matt\Desktop\OTL.exe
[2011/12/06 15:34:38 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\lvuvc.hs
[2011/12/06 04:37:01 | 000,001,604 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickTime Player.lnk
[2011/12/06 04:32:17 | 000,000,974 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1004336348-926492609-682003330-1003UA.job
[2011/12/05 20:38:01 | 000,000,994 | —- | M] () – C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1004336348-926492609-682003330-1003UA.job
[2011/12/05 20:38:00 | 000,000,972 | —- | M] () – C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1004336348-926492609-682003330-1003Core.job
[2011/12/05 19:01:25 | 000,440,331 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/12/05 18:46:31 | 000,418,195 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.bak
[2011/12/05 17:50:40 | 000,000,943 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
[2011/12/05 17:32:00 | 000,000,922 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1004336348-926492609-682003330-1003Core.job
[2011/12/04 09:01:56 | 000,000,865 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\CCEnhancer.lnk
[2011/12/03 11:39:20 | 000,022,016 | —- | M] () – C:\Documents and Settings\Matt\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/02 17:39:25 | 000,001,809 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\Driver Reviver.lnk
[2011/12/02 16:23:35 | 000,001,624 | —- | M] () – C:\Documents and Settings\Matt\Desktop\Microsoft Fix it.lnk
[2011/12/02 10:51:31 | 000,428,860 | —- | M] () – C:\Documents and Settings\Matt\Local Settings\Application Data\census.cache
[2011/12/02 10:51:23 | 000,203,297 | —- | M] () – C:\Documents and Settings\Matt\Local Settings\Application Data\ars.cache
[2011/12/02 08:05:48 | 000,298,618 | —- | M] () – C:\Documents and Settings\Matt\Desktop\Netdiag 02122011 080548.htm
[2011/12/02 06:30:21 | 000,285,176 | —- | M] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2011/12/02 06:30:21 | 000,000,001 | —- | M] () – C:\WINDOWS\System32\nvdrssel.bin
[2011/12/02 06:30:14 | 000,285,176 | —- | M] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2011/12/02 05:57:54 | 000,438,048 | R— | M] () – C:\Documents and Settings\Matt\Desktop\hosts
[2011/12/02 05:43:26 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\nvdrswr.lk
[2011/12/02 04:51:02 | 000,008,128 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/12/01 22:49:43 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20111202-055754.backup
[2011/12/01 18:40:06 | 000,000,802 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/12/01 05:07:53 | 013,987,840 | —- | M] () – C:\Documents and Settings\Matt\ntuser.bak
[2011/12/01 05:05:23 | 000,300,466 | —- | M] () – C:\Documents and Settings\Matt\Desktop\Netdiag 01122011 050523.htm
[2011/12/01 04:44:29 | 000,012,984 | —- | M] () – C:\WINDOWS\System32\drivers\SWDUMon.sys
[2011/11/29 18:06:49 | 010,135,584 | —- | M] (LastPass) – C:\Program Files\Common Files\lpuninstall.exe
[2011/11/29 17:39:17 | 000,482,267 | —- | M] () – C:\Documents and Settings\Matt\Desktop\Rebate - Macy's.pdf
[2011/11/29 17:25:33 | 000,001,705 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\Belarc Advisor.lnk
[2011/11/29 07:33:56 | 000,000,742 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/11/29 07:33:56 | 000,000,724 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/11/29 07:32:21 | 000,000,648 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2011/11/25 15:43:38 | 000,444,185 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20111130-152538.backup
[2011/11/25 15:42:06 | 000,000,694 | —- | M] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\CCleaner.lnk
[2011/11/25 14:52:58 | 000,444,185 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20111125-154337.backup
[2011/11/25 14:09:00 | 000,057,711 | —- | M] () – C:\Documents and Settings\Matt\Desktop\Order Confirmation - Kohls.pdf
[2011/11/24 12:33:42 | 001,566,512 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Matt\Desktop\TDSSKiller.exe
[2011/11/23 14:26:53 | 000,061,358 | —- | M] () – C:\Documents and Settings\Matt\Desktop\Toshiba Satellite L755-S53 Receipt.pdf
[2011/11/19 10:52:55 | 000,444,133 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20111125-145258.backup
[2011/11/17 20:25:13 | 000,444,133 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20111119-105255.backup
[2011/11/17 18:57:27 | 000,051,920 | —- | M] () – C:\Documents and Settings\Matt\Desktop\Netflix Online DVD Rental Antitrust Litigation.pdf
[2011/11/12 11:09:56 | 000,443,874 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20111117-202512.backup
[2011/11/11 18:14:46 | 000,414,368 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/11/11 18:09:38 | 000,023,513 | —- | M] () – C:\WINDOWS\Americn Pride.jpg
[2011/11/11 09:55:02 | 000,021,126 | —- | M] () – C:\WINDOWS\Home of the Free.jpg
[2011/11/11 09:51:04 | 000,025,106 | —- | M] () – C:\WINDOWS\VDay.jpg
[2011/11/08 16:46:36 | 000,443,590 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20111112-110956.backup
[2011/11/07 09:25:48 | 000,443,590 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20111108-164636.backup
[2011/11/07 09:25:32 | 000,443,590 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20111107-092548.backup

========== Files Created - No Company Name ==========

[2011/12/06 04:37:01 | 000,001,604 | —- | C] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickTime Player.lnk
[2011/12/05 18:49:10 | 000,438,048 | R— | C] () – C:\Documents and Settings\Matt\Desktop\hosts
[2011/12/04 09:01:56 | 000,000,865 | —- | C] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\CCEnhancer.lnk
[2011/12/02 17:32:06 | 000,001,809 | —- | C] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\Driver Reviver.lnk
[2011/12/02 16:23:35 | 000,001,624 | —- | C] () – C:\Documents and Settings\Matt\Desktop\Microsoft Fix it.lnk
[2011/12/02 08:05:48 | 000,298,618 | —- | C] () – C:\Documents and Settings\Matt\Desktop\Netdiag 02122011 080548.htm
[2011/12/02 04:59:59 | 000,285,176 | —- | C] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2011/12/02 04:59:59 | 000,285,176 | —- | C] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2011/12/02 04:59:59 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\nvdrssel.bin
[2011/12/02 04:59:59 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\nvdrswr.lk
[2011/12/01 22:32:25 | 000,162,304 | —- | C] () – C:\WINDOWS\System32\ztvunrar36.dll
[2011/12/01 22:32:25 | 000,153,088 | —- | C] () – C:\WINDOWS\System32\unrar3.dll
[2011/12/01 22:32:25 | 000,077,312 | —- | C] () – C:\WINDOWS\System32\ztvunace26.dll
[2011/12/01 22:32:25 | 000,075,264 | —- | C] () – C:\WINDOWS\System32\unacev2.dll
[2011/12/01 18:40:06 | 000,000,802 | —- | C] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/12/01 05:05:23 | 000,300,466 | —- | C] () – C:\Documents and Settings\Matt\Desktop\Netdiag 01122011 050523.htm
[2011/11/29 17:25:33 | 000,001,705 | —- | C] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\Belarc Advisor.lnk
[2011/11/29 17:22:49 | 000,003,840 | —- | C] () – C:\WINDOWS\System32\drivers\BANTExt.sys
[2011/11/29 05:57:40 | 000,012,984 | —- | C] () – C:\WINDOWS\System32\drivers\SWDUMon.sys
[2011/11/25 15:42:06 | 000,000,694 | —- | C] () – C:\Documents and Settings\Matt\Application Data\Microsoft\Internet Explorer\Quick Launch\CCleaner.lnk
[2011/11/25 14:08:42 | 000,057,711 | —- | C] () – C:\Documents and Settings\Matt\Desktop\Order Confirmation - Kohls.pdf
[2011/11/25 12:50:29 | 000,482,267 | —- | C] () – C:\Documents and Settings\Matt\Desktop\Rebate - Macy's.pdf
[2011/11/23 14:26:53 | 000,061,358 | —- | C] () – C:\Documents and Settings\Matt\Desktop\Toshiba Satellite L755-S53 Receipt.pdf
[2011/11/17 18:57:27 | 000,051,920 | —- | C] () – C:\Documents and Settings\Matt\Desktop\Netflix Online DVD Rental Antitrust Litigation.pdf
[2011/11/11 18:09:37 | 000,023,513 | —- | C] () – C:\WINDOWS\Americn Pride.jpg
[2011/11/11 09:55:01 | 000,021,126 | —- | C] () – C:\WINDOWS\Home of the Free.jpg
[2011/11/11 09:51:03 | 000,025,106 | —- | C] () – C:\WINDOWS\VDay.jpg
[2011/11/06 07:33:58 | 000,000,455 | —- | C] () – C:\WINDOWS\System32\nvUnsupRes.dat
[2011/10/22 07:43:05 | 000,175,616 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2011/09/04 07:02:00 | 000,299,774 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2011/08/12 19:55:10 | 000,428,860 | —- | C] () – C:\Documents and Settings\Matt\Local Settings\Application Data\census.cache
[2011/08/12 19:55:07 | 000,203,297 | —- | C] () – C:\Documents and Settings\Matt\Local Settings\Application Data\ars.cache
[2011/08/12 19:39:18 | 000,000,036 | —- | C] () – C:\Documents and Settings\Matt\Local Settings\Application Data\housecall.guid.cache
[2011/08/12 12:20:14 | 000,015,896 | —- | C] () – C:\WINDOWS\System32\drivers\iKeyLFT2.dll
[2011/08/09 15:39:14 | 002,130,002 | —- | C] () – C:\WINDOWS\System32\nvdata.data
[2011/03/03 20:14:50 | 000,028,418 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2011/02/24 18:02:11 | 000,187,728 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/09/10 11:56:20 | 000,022,016 | —- | C] () – C:\Documents and Settings\Matt\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/08/17 13:58:53 | 000,000,426 | —- | C] () – C:\WINDOWS\BRWMARK.INI
[2010/08/17 13:55:51 | 000,000,998 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2010/08/17 13:55:51 | 000,000,153 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2010/08/17 13:55:51 | 000,000,065 | —- | C] () – C:\WINDOWS\System32\bd7340.dat
[2010/08/17 13:55:25 | 000,000,114 | —- | C] () – C:\WINDOWS\System32\BRLMW03A.INI
[2010/08/17 13:54:58 | 000,000,118 | —- | C] () – C:\WINDOWS\Brfaxrx.ini
[2010/08/17 13:54:57 | 000,000,000 | —- | C] () – C:\WINDOWS\brdfxspd.dat
[2010/08/17 13:54:56 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\BrMuSNMP.dll
[2010/08/17 13:52:16 | 000,031,567 | —- | C] () – C:\WINDOWS\maxlink.ini
[2010/08/14 09:22:15 | 000,000,484 | —- | C] () – C:\WINDOWS\wininit.ini
[2010/08/02 20:47:27 | 000,001,157 | —- | C] () – C:\WINDOWS\checkip.dat
[2010/08/02 20:42:39 | 000,001,157 | —- | C] () – C:\WINDOWS\ipconfig.dat
[2010/05/14 16:56:06 | 010,898,456 | —- | C] () – C:\WINDOWS\System32\LogiDPP.dll
[2010/05/14 16:56:06 | 000,104,472 | —- | C] () – C:\WINDOWS\System32\LogiDPPApp.exe
[2010/05/14 16:55:58 | 000,336,408 | —- | C] () – C:\WINDOWS\System32\DevManagerCore.dll
[2010/04/19 14:55:12 | 000,008,128 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/03/18 16:58:46 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/01/27 21:46:53 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\custmon32.dll
[2010/01/16 13:52:54 | 000,002,657 | —- | C] () – C:\WINDOWS\DevMgr.ini
[2010/01/16 13:51:39 | 000,000,020 | —- | C] () – C:\WINDOWS\Hposcv07.INI
[2010/01/14 17:22:53 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2010/01/13 23:59:04 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2010/01/13 23:05:22 | 000,024,576 | R— | C] () – C:\WINDOWS\System32\AsIO.dll
[2010/01/13 23:05:22 | 000,012,400 | R— | C] () – C:\WINDOWS\System32\drivers\AsIO.sys
[2010/01/13 23:05:19 | 000,011,832 | —- | C] () – C:\WINDOWS\System32\drivers\AsInsHelp64.sys
[2010/01/13 23:05:19 | 000,010,216 | —- | C] () – C:\WINDOWS\System32\drivers\AsInsHelp32.sys
[2010/01/13 10:56:48 | 000,004,984 | R— | C] () – C:\WINDOWS\System32\drivers\nvphy.bin
[2010/01/13 10:56:13 | 000,019,691 | —- | C] () – C:\WINDOWS\Ascd_log.ini
[2010/01/13 10:54:58 | 000,005,810 | R— | C] () – C:\WINDOWS\System32\drivers\ASACPI.sys
[2010/01/13 10:54:48 | 000,015,738 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2010/01/13 10:54:48 | 000,010,296 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2010/01/13 10:17:48 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2010/01/13 10:12:59 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2010/01/13 05:02:13 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2010/01/13 04:59:25 | 000,312,376 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:\WINDOWS\System32\OGAEXEC.exe
[2008/10/07 08:13:22 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 08:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008/10/07 08:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008/10/07 08:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 08:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008/10/07 08:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelKorean.dll
[2008/10/07 08:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008/10/07 08:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelGerman.dll
[2008/10/07 08:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelFrench.dll
[2008/04/14 07:00:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2008/04/14 07:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2008/04/14 07:00:00 | 000,484,852 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2008/04/14 07:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2008/04/14 07:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2008/04/14 07:00:00 | 000,080,674 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2008/04/14 07:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2008/04/14 07:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2008/04/14 07:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2008/04/14 07:00:00 | 000,004,461 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2008/04/14 07:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2008/04/14 07:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2011/03/14 15:19:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/12/05 17:46:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe
[2010/10/21 15:44:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Rosetta Stone
[2010/10/06 17:46:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Samsung
[2011/11/29 07:49:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ScanSoft
[2011/12/06 05:10:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/06/19 17:44:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/11/29 07:49:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\DVDVideoSoft
[2011/12/02 16:23:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\ElevatedDiagnostics
[2011/11/29 07:49:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\Foxit Software
[2011/03/21 18:19:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\Gradkell Systems, Inc
[2010/01/13 23:59:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\Leadertech
[2011/02/15 04:35:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\mjusbsp
[2010/03/03 18:59:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\MyScribe
[2011/11/23 06:29:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\Notepad++
[2010/10/24 09:38:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\OpenCandy
[2010/08/18 16:11:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\PC-FAX TX
[2011/11/30 15:43:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\Registry Mechanic
[2011/12/02 17:32:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\Reviversoft
[2010/08/17 14:11:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\ScanSoft
[2010/08/17 10:18:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\Spam Monitor
[2011/12/02 18:14:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\uTorrent
[2010/04/18 18:38:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Matt\Application Data\webex
[2011/12/05 20:38:00 | 000,000,972 | —- | M] () – C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-1004336348-926492609-682003330-1003Core.job
[2011/12/05 20:38:01 | 000,000,994 | —- | M] () – C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-1004336348-926492609-682003330-1003UA.job
[2011/12/06 16:36:31 | 000,000,424 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2011/12/06 16:15:16 | 000,032,568 | —- | M] () – C:\WINDOWS\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: EXPLORER.EXE >
[2008/04/14 07:00:00 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ERDNT\cache\explorer.exe
[2008/04/14 07:00:00 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/14 07:00:00 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\system32\dllcache\explorer.exe

< MD5 for: SVCHOST.EXE >
[2008/04/14 07:00:00 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\ERDNT\cache\svchost.exe
[2008/04/14 07:00:00 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\system32\dllcache\svchost.exe
[2008/04/14 07:00:00 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\system32\svchost.exe

< MD5 for: USERINIT.EXE >
[2008/04/14 07:00:00 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\ERDNT\cache\userinit.exe
[2008/04/14 07:00:00 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\system32\dllcache\userinit.exe
[2008/04/14 07:00:00 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2008/04/14 07:00:00 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008/04/14 07:00:00 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\dllcache\winlogon.exe
[2008/04/14 07:00:00 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >

========== Alternate Data Streams ==========

@Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 148 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB0AACC9
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

< End of report >


OTL Extras logfile created on: 12/6/2011 5:05:18 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Matt\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.63 Gb Available Physical Memory | 80.99% Memory free
5.09 Gb Paging File | 4.68 Gb Available in Paging File | 91.79% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 389.59 Gb Free Space | 83.65% Space Free | Partition Type: NTFS
Drive E: | 74.52 Gb Total Space | 46.13 Gb Free Space | 61.90% Space Free | Partition Type: NTFS
Drive H: | 408.99 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF
Drive I: | 395.81 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF
Drive J: | 411.96 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: MSTEIN | User Name: Matt | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Documents and Settings\Matt\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe" = C:\Documents and Settings\Matt\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin – (Google)
"C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe" = C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe:*:Enabled:Daemonu.exe – (NVIDIA Corporation)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{148E08FF-D7C4-46ED-8D4D-601C67FE0AFD}" = Rosetta Stone Version 3
"{1D7CE340-70C3-4848-BCCF-215950328A4C}" = Facebook Video Calling 1.0.0.8953
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2445981B-A23B-4A0E-AD15-3D391BDAEC3E}" = HDD Regenerator
"{26A24AE4-039D-4CA4-87B4-2F83217001FF}" = Java™ 7 Update 1
"{2BC2781A-F7F6-452E-95EB-018A522F1B2C}" = PaperPort Image Printer
"{310BC5E2-31AF-49BB-904D-E71EB93645DC}" = AI Suite
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3881DB80-EAA2-012B-ADAE-000000000000}" = TurboTax 2009 WinPerFedFormset
"{38975F50-EAA2-012B-ADB4-000000000000}" = TurboTax 2009 WinPerReleaseEngine
"{38A34630-EAA2-012B-ADB6-000000000000}" = TurboTax 2009 WinPerTaxSupport
"{3BAC6780-EAA2-012B-AE74-000000000000}" = TurboTax 2009 wohiper
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3C5A81D0-EAA2-012B-AE9F-000000000000}" = TurboTax 2009 wrapper
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{46E1B1F2-A279-4356-9B17-029F9CC72EAE}" = Brother MFL-Pro Suite
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4ED7D297-58F7-45C3-A9BA-A7CD6FA0D373}_is1" = SureThing CD Labeler Deluxe 5
"{4F93ABBE-5A1D-4D56-94CB-022F109FDE4D}" = Adobe Presenter 7
"{519C4DB6-B53B-4F5C-8297-89B2BE949FA5}_is1" = Data Lifeguard Diagnostic for Windows 1.21
"{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.5.7
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7A73EFB4-C362-4395-83D5-E0C6C53677FE}" = LightScribe Diagnostic Utility
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{9170B2A2-FC44-4ec2-AEB6-9052626B2A2E}_is1" = Driver Reviver
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.1.6
"{97E988A2-0834-4284-B12B-991835E7CB70}" = SamsungSimpleDL
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{A66DBCC6-8802-3D15-9FDF-9552742C08B0}" = Google Talk Plugin
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{a9264802-8a7a-40fe-a135-5c6d204aed7a}.sdb" = Internet Explorer (Enable DEP)
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-1033-F400-7760-000000000005}" = Adobe Acrobat X Pro - English, Français, Deutsch
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 285.58
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 285.58
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 135.95
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.5.20
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam Software
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F3CA9611-CD42-4562-ADAB-A554CF8E17F1}" = Microsoft WSE 2.0 SP3 Runtime
"{FD71E2F7-B9FC-4072-88DB-AC19E2464D82}" = LightScribe System Software
"ActiveScan 2.0" = Panda ActiveScan 2.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"CCleaner" = CCleaner
"CodeStuff Starter" = CodeStuff Starter
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"Defraggler" = Defraggler
"ENTERPRISER" = Microsoft Office Enterprise 2007
"ERUNT_is1" = ERUNT 1.1j
"FileHippo.com" = FileHippo.com Update Checker
"ie8" = Windows Internet Explorer 8
"InstallShield_{97E988A2-0834-4284-B12B-991835E7CB70}" = SamsungSimpleDL
"Magic ISO Maker v5.5 (build 0281)" = Magic ISO Maker v5.5 (build 0281)
"MagicDisc 2.7.106" = MagicDisc 2.7.106
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 8.0.1 (x86 en-US)" = Mozilla Firefox 8.0.1 (x86 en-US)
"Notepad++" = Notepad++
"NVIDIA Drivers" = NVIDIA Drivers
"PDFCreator" = PDFCreator
"Registry Mechanic_is1" = Registry Mechanic 9.0
"sp6" = Logitech SetPoint 6.32
"SpywareBlaster_is1" = SpywareBlaster 4.4
"TurboTax 2009" = TurboTax 2009
"uTorrent" = µTorrent
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"LastPass" = LastPass (uninstall only)

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/4/2011 7:12:34 AM | Computer Name = MSTEIN | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 2152759308, P2 unspecified, P3 scanfile,
P4 3.0.8402.0, P5 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10 NIL.

Error - 12/4/2011 7:32:10 AM | Computer Name = MSTEIN | Source = MsiInstaller | ID = 11714
Description = Product: Google Talk Plugin – Error 1714. The older version of Google
Talk Plugin cannot be removed. Contact your technical support group. System Error
1612.

Error - 12/4/2011 12:32:11 PM | Computer Name = MSTEIN | Source = MsiInstaller | ID = 11714
Description = Product: Google Talk Plugin – Error 1714. The older version of Google
Talk Plugin cannot be removed. Contact your technical support group. System Error
1612.

Error - 12/4/2011 5:32:09 PM | Computer Name = MSTEIN | Source = MsiInstaller | ID = 11714
Description = Product: Google Talk Plugin – Error 1714. The older version of Google
Talk Plugin cannot be removed. Contact your technical support group. System Error
1612.

Error - 12/5/2011 6:32:11 AM | Computer Name = MSTEIN | Source = MsiInstaller | ID = 11714
Description = Product: Google Talk Plugin – Error 1714. The older version of Google
Talk Plugin cannot be removed. Contact your technical support group. System Error
1612.

Error - 12/5/2011 11:32:08 AM | Computer Name = MSTEIN | Source = MsiInstaller | ID = 11714
Description = Product: Google Talk Plugin – Error 1714. The older version of Google
Talk Plugin cannot be removed. Contact your technical support group. System Error
1612.

Error - 12/5/2011 4:32:08 PM | Computer Name = MSTEIN | Source = MsiInstaller | ID = 11714
Description = Product: Google Talk Plugin – Error 1714. The older version of Google
Talk Plugin cannot be removed. Contact your technical support group. System Error
1612.

Error - 12/5/2011 9:32:09 PM | Computer Name = MSTEIN | Source = MsiInstaller | ID = 11714
Description = Product: Google Talk Plugin – Error 1714. The older version of Google
Talk Plugin cannot be removed. Contact your technical support group. System Error
1612.

Error - 12/6/2011 5:32:11 AM | Computer Name = MSTEIN | Source = MsiInstaller | ID = 11714
Description = Product: Google Talk Plugin – Error 1714. The older version of Google
Talk Plugin cannot be removed. Contact your technical support group. System Error
1612.

Error - 12/6/2011 5:05:57 PM | Computer Name = MSTEIN | Source = Application Hang | ID = 1002
Description = Hanging application explorer.exe, version 6.0.2900.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ OSession Events ]
Error - 1/15/2010 6:55:55 PM | Computer Name = HOME-AD798B7B7F | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 19196
seconds with 13320 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 12/6/2011 5:15:08 PM | Computer Name = MSTEIN | Source = Service Control Manager | ID = 7034
Description = The ForceWare Intelligent Application Manager (IAM) service terminated
unexpectedly. It has done this 1 time(s).

Error - 12/6/2011 5:15:09 PM | Computer Name = MSTEIN | Source = Service Control Manager | ID = 7034
Description = The ForceWare IP service service terminated unexpectedly. It has
done this 1 time(s).

Error - 12/6/2011 5:17:17 PM | Computer Name = MSTEIN | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 12/6/2011 5:18:32 PM | Computer Name = MSTEIN | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AsIO Fips intelppm MpFilter pavboot TfFsMon TfSysMon

Error - 12/6/2011 5:26:55 PM | Computer Name = MSTEIN | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 12/6/2011 5:27:18 PM | Computer Name = MSTEIN | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 12/6/2011 5:28:30 PM | Computer Name = MSTEIN | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 12/6/2011 5:30:11 PM | Computer Name = MSTEIN | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 12/6/2011 5:31:35 PM | Computer Name = MSTEIN | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 12/6/2011 5:32:49 PM | Computer Name = MSTEIN | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AsIO Fips intelppm MpFilter pavboot TfFsMon TfSysMon


< End of report >

FYI – before you started helping me, I was only able to work in safe mode and when I scanned with Malwarebytes' Anti-Malware it found several items; once that was finished, I was able to get online regularly and right after I read your post, I shut down for the night and in the morning I was back in trouble again and not sure what is going on… Tried doing several scans and no luck this time so I am only able to work in safe mode to get online…




ComboFix 11-12-06.02 - Matt 12/07/2011 16:26:42.5.2 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2413 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\windows\CSC\d6
c:\windows\system32\drivers\etc\hosts.txt
.
.
((((((((((((((((((((((((( Files Created from 2011-11-07 to 2011-12-07 )))))))))))))))))))))))))))))))
.
.
2011-12-07 21:03 . 2011-12-07 21:03 56200 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{805F10F0-B9B2-44A3-AD06-8E9C52C60BFD}\offreg.dll
2011-12-06 09:23 . 2011-11-30 07:21 6823496 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{805F10F0-B9B2-44A3-AD06-8E9C52C60BFD}\mpengine.dll
2011-12-05 23:06 . 2011-12-05 23:06 ——– d—–w- c:\documents and settings\Matt\Local Settings\Application Data\Apple
2011-12-02 22:32 . 2011-12-02 22:32 ——– d—–w- c:\documents and settings\Matt\Application Data\Reviversoft
2011-12-02 22:32 . 2011-12-02 22:32 ——– d—–w- c:\program files\Reviversoft
2011-12-02 21:15 . 2011-12-02 21:23 ——– d—–w- c:\documents and settings\Matt\Application Data\ElevatedDiagnostics
2011-12-02 10:43 . 2011-12-02 10:43 ——– d—–w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2011-12-02 10:43 . 2011-12-02 10:43 ——– d—–w- c:\documents and settings\UpdatusUser.MSTEIN
2011-12-02 10:43 . 2011-12-02 10:43 ——– d—–w- c:\documents and settings\All Users\Application Data\NVIDIA
2011-12-02 10:43 . 2011-10-08 04:50 298304 —-a-w- c:\windows\system32\nvsvc32.exe
2011-12-02 10:43 . 2011-10-08 04:50 220992 —-a-w- c:\windows\system32\nvcolor.exe
2011-12-02 10:43 . 2011-10-08 04:50 203072 —-a-w- c:\windows\system32\nvmctray.dll
2011-12-02 10:43 . 2011-10-08 04:50 16744256 —-a-w- c:\windows\system32\nvcpl.dll
2011-12-02 10:43 . 2011-10-08 04:50 602432 —-a-w- c:\windows\system32\easyupdatusapiu.dll
2011-12-02 10:43 . 2011-10-08 04:50 54272 —-a-w- c:\windows\system32\nvwddi.dll
2011-12-02 10:18 . 2011-12-02 10:18 ——– d—–w- c:\documents and settings\Matt\Local Settings\Application Data\Microsoft Help
2011-12-02 09:59 . 2011-12-02 11:30 285176 —-a-w- c:\windows\system32\nvdrsdb1.bin
2011-12-02 09:59 . 2011-12-02 11:30 1 —-a-w- c:\windows\system32\nvdrssel.bin
2011-12-02 09:59 . 2011-12-02 11:30 285176 —-a-w- c:\windows\system32\nvdrsdb0.bin
2011-12-02 03:32 . 2006-06-19 17:01 69632 —-a-w- c:\windows\system32\ztvcabinet.dll
2011-12-02 03:32 . 2006-05-25 19:52 162304 —-a-w- c:\windows\system32\ztvunrar36.dll
2011-12-02 03:32 . 2005-08-26 05:50 77312 —-a-w- c:\windows\system32\ztvunace26.dll
2011-12-02 03:32 . 2003-02-03 00:06 153088 —-a-w- c:\windows\system32\unrar3.dll
2011-12-02 03:32 . 2002-03-06 05:00 75264 —-a-w- c:\windows\system32\unacev2.dll
2011-12-01 23:40 . 2011-12-01 23:40 ——– d—–w- c:\documents and settings\Matt\Application Data\Malwarebytes
2011-12-01 23:40 . 2011-12-01 23:40 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-12-01 23:40 . 2011-12-01 23:40 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-12-01 23:40 . 2011-08-31 22:00 22216 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-12-01 23:37 . 2011-12-01 23:37 ——– d—–w- c:\documents and settings\Matt\Local Settings\Application Data\uTorrent
2011-12-01 21:59 . 2011-12-01 21:59 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2011-12-01 21:13 . 2011-12-07 21:26 ——– d—–w- c:\windows\system32\CatRoot2
2011-11-30 20:54 . 2011-06-21 04:09 200976 —-a-w- c:\windows\system32\drivers\tmcomm.sys
2011-11-30 20:43 . 2011-11-30 20:43 ——– d—–w- c:\documents and settings\Matt\Application Data\Registry Mechanic
2011-11-29 23:06 . 2011-11-29 23:06 10135584 —-a-w- c:\program files\Common Files\lpuninstall.exe
2011-11-29 22:22 . 2011-11-29 22:22 ——– d—–w- c:\program files\Belarc
2011-11-29 22:22 . 2011-08-09 21:33 3840 —-a-w- c:\windows\system32\drivers\BANTExt.sys
2011-11-29 10:57 . 2011-12-01 09:44 12984 —-a-w- c:\windows\system32\drivers\SWDUMon.sys
2011-11-29 10:57 . 2011-11-29 12:52 ——– d—–w- c:\documents and settings\Matt\Local Settings\Application Data\SlimWare Utilities Inc
2011-11-25 20:00 . 2011-12-05 00:50 ——– d—–w- c:\program files\CCleaner
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-30 07:21 . 2011-04-20 09:25 6823496 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-11-11 23:14 . 2011-05-13 13:09 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-06 14:31 . 2011-11-06 14:31 53248 —-a-r- c:\documents and settings\Matt\Application Data\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2011-10-24 19:29 . 2011-10-24 19:29 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-10-24 19:29 . 2011-10-24 19:29 69632 —-a-w- c:\windows\system32\QuickTime.qts
2011-10-21 00:08 . 2010-03-03 23:50 16400 —-a-w- c:\windows\system32\drivers\LNonPnP.sys
2011-10-21 00:04 . 2011-10-21 00:04 128000 —-a-w- c:\windows\system32\javacpl.cpl
2011-10-21 00:04 . 2010-04-17 00:05 544656 —-a-w- c:\windows\system32\deployJava1.dll
2011-10-10 14:22 . 2010-01-13 15:13 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-10-08 04:50 . 2011-08-09 20:39 65536 —-a-w- c:\windows\system32\OpenCL.dll
2011-10-08 04:50 . 2011-08-09 20:39 919872 —-a-w- c:\windows\system32\nvdispco32.dll
2011-10-08 04:50 . 2011-08-09 20:39 877376 —-a-w- c:\windows\system32\nvgenco32.dll
2011-10-08 04:50 . 2011-08-09 20:39 2398016 —-a-w- c:\windows\system32\nvcuvid.dll
2011-10-08 04:50 . 2011-08-09 20:39 2099520 —-a-w- c:\windows\system32\nvcuvenc.dll
2011-10-08 04:50 . 2011-08-09 20:39 17956864 —-a-w- c:\windows\system32\nvoglnt.dll
2011-10-08 04:50 . 2011-08-09 20:39 5595136 —-a-w- c:\windows\system32\nvcuda.dll
2011-10-08 04:50 . 2011-08-09 20:39 2449408 —-a-w- c:\windows\system32\nvapi.dll
2011-10-08 04:50 . 2011-08-09 20:39 17240064 —-a-w- c:\windows\system32\nvcompiler.dll
2011-10-08 04:50 . 2011-02-18 04:01 4226688 —-a-w- c:\windows\system32\nv4_disp.dll
2011-10-08 04:50 . 2011-02-18 04:01 12791488 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2011-09-28 07:06 . 2008-04-14 12:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-09-26 15:41 . 2009-10-08 19:57 611328 —-a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 15:41 . 2008-04-14 12:00 220160 —-a-w- c:\windows\system32\oleacc.dll
2011-09-26 15:41 . 2008-04-14 12:00 20480 —-a-w- c:\windows\system32\oleaccrc.dll
2011-09-20 01:50 . 2011-09-20 01:50 53248 —-a-r- c:\documents and settings\Matt\Application Data\Microsoft\Installer\{64C85B95-E971-4705-B3ED-D4A0153C0D5B}\ARPPRODUCTICON.exe
2011-12-04 11:13 . 2011-05-28 22:05 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FileHippo.com"="c:\program files\FileHippo.com\UpdateChecker.exe" [2010-08-09 248832]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-13 19550344]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2009-01-30 204288]
"Facebook Update"="c:\documents and settings\Matt\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" [2011-09-26 137536]
"RegistryMechanic"="c:\program files\Registry Mechanic\RegMech.exe" [2009-10-14 3217368]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CPU Power Monitor"="c:\program files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe" [2008-01-09 627200]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 196608]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2010-10-25 36760]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-05-04 252136]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1387288]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-10-08 16744256]
"NvMediaCenter"="NvMCTray.dll" [2011-10-08 203072]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2011-10-08 1632360]
"RTHDCPL"="RTHDCPL.EXE" [2011-08-17 20064872]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2011-07-27 434080]
.
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
Install LastPass FF RunOnce.lnk - c:\program files\Common Files\lpuninstall.exe [2011-11-29 10135584]
Install LastPass IE RunOnce.lnk - c:\program files\Common Files\lpuninstall.exe [2011-11-29 10135584]
.
c:\documents and settings\Matt\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
.
c:\documents and settings\Guest\Start Menu\Programs\Startup\
Install LastPass FF RunOnce.lnk - c:\program files\Common Files\lpuninstall.exe [2011-11-29 10135584]
Install LastPass IE RunOnce.lnk - c:\program files\Common Files\lpuninstall.exe [2011-11-29 10135584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-10-28 10:13 64592 —-a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^Matt^Start Menu^Programs^Startup^Logitech . Product Registration.lnk]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Acrobat Speed Launcher]
2010-10-25 20:13 36760 —-a-w- c:\program files\Adobe\Acrobat 10.0\Acrobat\acrobat_sl.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"cdloader"="c:\documents and settings\Matt\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Documents and Settings\\Matt\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [8/12/2011 7:39 PM 28552]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys –> c:\windows\system32\drivers\TfFsMon.sys [?]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys –> c:\windows\system32\drivers\TfSysMon.sys [?]
S0 yqitml;yqitml;c:\windows\system32\drivers\goftph.sys –> c:\windows\system32\drivers\goftph.sys [?]
S1 MpKsl20ce8cf8;MpKsl20ce8cf8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4A03B186-F4A9-4D28-ACA3-647D99A9C45E}\MpKsl20ce8cf8.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4A03B186-F4A9-4D28-ACA3-647D99A9C45E}\MpKsl20ce8cf8.sys [?]
S1 MpKsl2cb65221;MpKsl2cb65221;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8DED331E-9ED4-4FF7-BDFD-4818EF60B9D0}\MpKsl2cb65221.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8DED331E-9ED4-4FF7-BDFD-4818EF60B9D0}\MpKsl2cb65221.sys [?]
S1 MpKsl328203da;MpKsl328203da;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7906D254-D96A-45FD-94FF-1B049C9A7911}\MpKsl328203da.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7906D254-D96A-45FD-94FF-1B049C9A7911}\MpKsl328203da.sys [?]
S1 MpKsl501bda62;MpKsl501bda62;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{580A31CF-B574-4832-A2A8-158D01D36911}\MpKsl501bda62.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{580A31CF-B574-4832-A2A8-158D01D36911}\MpKsl501bda62.sys [?]
S1 MpKsl6eb6db84;MpKsl6eb6db84;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{40AF7DB9-4802-4425-A87E-BD75A9F7413D}\MpKsl6eb6db84.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{40AF7DB9-4802-4425-A87E-BD75A9F7413D}\MpKsl6eb6db84.sys [?]
S1 MpKsl769f8250;MpKsl769f8250;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9B9583B9-770A-4562-B247-6567C01BB6BE}\MpKsl769f8250.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9B9583B9-770A-4562-B247-6567C01BB6BE}\MpKsl769f8250.sys [?]
S1 MpKsl86a1c50d;MpKsl86a1c50d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{790F95CB-AF64-42D0-AE98-DE502CAE8B1D}\MpKsl86a1c50d.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{790F95CB-AF64-42D0-AE98-DE502CAE8B1D}\MpKsl86a1c50d.sys [?]
S1 MpKsl87919cb9;MpKsl87919cb9;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8ECFF52A-D0D5-407E-9526-53A911D663D4}\MpKsl87919cb9.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8ECFF52A-D0D5-407E-9526-53A911D663D4}\MpKsl87919cb9.sys [?]
S1 MpKsl87b5b2b0;MpKsl87b5b2b0;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D23E4833-2449-495F-B361-E420BB598BCC}\MpKsl87b5b2b0.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D23E4833-2449-495F-B361-E420BB598BCC}\MpKsl87b5b2b0.sys [?]
S1 MpKsl98434995;MpKsl98434995;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3623F4DD-758F-4F83-9F87-5FCB4B0CD55A}\MpKsl98434995.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3623F4DD-758F-4F83-9F87-5FCB4B0CD55A}\MpKsl98434995.sys [?]
S1 MpKsla5679633;MpKsla5679633;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7E63642B-D04B-4B7B-9FFA-A32751481951}\MpKsla5679633.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7E63642B-D04B-4B7B-9FFA-A32751481951}\MpKsla5679633.sys [?]
S1 MpKslc28b7753;MpKslc28b7753;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7E63642B-D04B-4B7B-9FFA-A32751481951}\MpKslc28b7753.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7E63642B-D04B-4B7B-9FFA-A32751481951}\MpKslc28b7753.sys [?]
S1 MpKsld4184e25;MpKsld4184e25;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{841818E8-84F8-41B8-8DF0-F7741ABF6810}\MpKsld4184e25.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{841818E8-84F8-41B8-8DF0-F7741ABF6810}\MpKsld4184e25.sys [?]
S1 MpKsld9bea51d;MpKsld9bea51d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{805F10F0-B9B2-44A3-AD06-8E9C52C60BFD}\MpKsld9bea51d.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{805F10F0-B9B2-44A3-AD06-8E9C52C60BFD}\MpKsld9bea51d.sys [?]
S1 MpKsle126b59a;MpKsle126b59a;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B6D96D02-DA75-4858-8F34-FDB77A4DCFB6}\MpKsle126b59a.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B6D96D02-DA75-4858-8F34-FDB77A4DCFB6}\MpKsle126b59a.sys [?]
S1 MpKsle3603df1;MpKsle3603df1;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DABF9181-65AD-4894-880B-8BA01495DCCA}\MpKsle3603df1.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DABF9181-65AD-4894-880B-8BA01495DCCA}\MpKsle3603df1.sys [?]
S1 MpKsle4ef30a9;MpKsle4ef30a9;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{805F10F0-B9B2-44A3-AD06-8E9C52C60BFD}\MpKsle4ef30a9.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{805F10F0-B9B2-44A3-AD06-8E9C52C60BFD}\MpKsle4ef30a9.sys [?]
S1 MpKsle5b919af;MpKsle5b919af;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8ECFF52A-D0D5-407E-9526-53A911D663D4}\MpKsle5b919af.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8ECFF52A-D0D5-407E-9526-53A911D663D4}\MpKsle5b919af.sys [?]
S1 MpKsle90576dd;MpKsle90576dd;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{805F10F0-B9B2-44A3-AD06-8E9C52C60BFD}\MpKsle90576dd.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{805F10F0-B9B2-44A3-AD06-8E9C52C60BFD}\MpKsle90576dd.sys [?]
S1 MpKslebc8f2ea;MpKslebc8f2ea;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8DED331E-9ED4-4FF7-BDFD-4818EF60B9D0}\MpKslebc8f2ea.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8DED331E-9ED4-4FF7-BDFD-4818EF60B9D0}\MpKslebc8f2ea.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 12:16 PM 130384]
S2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [1/13/2010 11:59 PM 12184]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [12/1/2011 6:40 PM 366152]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [12/2/2011 5:43 AM 2253120]
S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [10/23/2011 5:55 PM 583640]
S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\Logishrd\LVMVFM\UMVPFSrv.exe [4/1/2011 4:11 AM 450848]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [5/7/2011 10:28 AM 1691480]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\drivers\ssadadb.sys [5/13/2011 2:21 AM 30312]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [12/1/2011 6:40 PM 22216]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [4/14/2008 7:00 AM 14336]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [1/29/2011 1:42 PM 27064]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [5/13/2011 2:21 AM 121064]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [5/13/2011 2:21 AM 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [5/13/2011 2:21 AM 136808]
S3 SureThing Labelflash service;SureThing Labelflash service;c:\program files\Common Files\SureThing Shared\stllssvr.exe [8/14/2010 6:01 AM 74392]
S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\TfNetMon.sys –> c:\windows\system32\drivers\TfNetMon.sys [?]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [4/14/2008 7:00 AM 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 12:16 PM 753504]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - LBEEPKE
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
WINRM REG_MULTI_SZ WINRM
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-07-21 16:20 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-06 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1004336348-926492609-682003330-1003Core.job
- c:\documents and settings\Matt\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-09-26 00:33]
.
2011-12-06 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1004336348-926492609-682003330-1003UA.job
- c:\documents and settings\Matt\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-09-26 00:33]
.
2011-12-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1004336348-926492609-682003330-1003Core.job
- c:\documents and settings\Matt\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-08-27 09:57]
.
2011-12-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1004336348-926492609-682003330-1003UA.job
- c:\documents and settings\Matt\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-08-27 09:57]
.
2011-12-07 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 19:39]
.
.
——- Supplementary Scan ——-
.
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: LastPass - file://c:\program files\LastPass\context.html?cmd=lastpass
IE: LastPass Fill Forms - file://c:\program files\LastPass\context.html?cmd=fillforms
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = 10.0.0.1
FF - ProfilePath - c:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\tf8574lj.default\
FF - prefs.js: browser.startup.homepage - hxxp://rivals.yahoo.com/ncaa/football
FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true);user_pref(general.useragent.extra.brc,
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-07 16:34
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(412)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
Completion time: 2011-12-07 16:36:04
ComboFix-quarantined-files.txt 2011-12-07 21:36
.
Pre-Run: 418,067,582,976 bytes free
Post-Run: 418,118,782,976 bytes free
.
- - End Of File - - 9E588675F7C6EB1E0079A2F561689EDB