Rootkit.0access & PUP.Bitminer have left their tracks [Solved]

My friend tried to get rid of the malware on her husband's computer. Even though MalwareBytes shows no infections now, IE is still being redirected and it is effecting installation of an AV program. Previous program has disappeared up in smoke. I have kept it off the internet so the infections can't invite in any more friends. The computer has Windows 7 Home Premium 64 bit operating system.

From researching the 2 main infections, I can see that I need experienced help at using powerful software tools to remove the infections. I would appreciate your help. Thanks! MsMagoo

I ran OTL in safe mode- forgot to run as admin, but it seemed to run fine. I am including Otl and Malwarebytes logs. Thanx!

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8323

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

12/6/2011 3:06:25 PM
mbam-log-2011-12-06 (15-06-25).txt

Scan type: Full scan (C:\|)
Objects scanned: 382643
Time elapsed: 1 hour(s), 17 minute(s), 38 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\John\AppData\Local\Temp\msimg32.dll (Rootkit.0Access) -> Quarantined and deleted successfully.
c:\Windows\assembly\temp\kwrd.dll (PUP.BitMiner) -> Not selected for removal.
c:\Windows\Temp\_ex-68.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8323

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

12/6/2011 5:36:11 PM
mbam-log-2011-12-06 (17-36-11).txt

Scan type: Full scan (C:\|)
Objects scanned: 383121
Time elapsed: 1 hour(s), 7 minute(s), 20 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Windows\assembly\temp\kwrd.dll (PUP.BitMiner) -> Quarantined and deleted successfully.

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8323

Windows 6.1.7600 (Safe Mode)
Internet Explorer 8.0.7600.16385

12/11/2011 4:25:13 PM
mbam-log-2011-12-11 (16-25-13).txt

Scan type: Quick scan
Objects scanned: 185711
Time elapsed: 4 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

OTL logfile created on: 12/11/2011 4:07:10 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\John\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.75 Gb Total Physical Memory | 2.95 Gb Available Physical Memory | 78.82% Memory free
7.50 Gb Paging File | 6.78 Gb Available in Paging File | 90.42% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 283.40 Gb Total Space | 249.89 Gb Free Space | 88.17% Space Free | Partition Type: NTFS
Drive E: | 488.60 Mb Total Space | 169.69 Mb Free Space | 34.73% Space Free | Partition Type: FAT

Computer Name: JOHN-PC | User Name: John | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\John\Desktop\OTL.exe (OldTimer Tools)


========== Modules (No Company Name) ==========


========== Win32 Services (SafeList) ==========

SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (wltrysvc) – C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE ()
SRV:64bit: - (DockLoginService) – C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
SRV - (McComponentHostService) – C:\Program Files (x86)\McAfee Security Scan\3.0.229\McCHSvc.exe (McAfee, Inc.)
SRV - (SftService) – C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (GoToAssist) – C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (hnmsvc) – c:\Program Files (x86)\Common Files\Dell\Advanced Networking Service\hnm_svc.exe (Dell Inc.)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (PCDSRVC{1E208CE0-FB7451FF-06020101}_0) – c:\Program Files\Dell Support Center\pcdsrvc_x64.pkms (PC-Doctor, Inc.)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (AtiHdmiService) – C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (atikmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (k57nd60a) Broadcom NetLink ™ – C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (RSUSBSTOR) – C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (BCM42RLY) – C:\Windows\SysNative\drivers\bcm42rly.sys (Broadcom Corporation)
DRV:64bit: - (BCM43XX) – C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (Packet) – C:\Windows\SysNative\drivers\packet.sys (SingleClick Systems)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (CnxtHdAudService) – C:\Windows\SysNative\drivers\CHDRT64.sys (Conexant Systems Inc.)
DRV:64bit: - (AtiPcie) AMD PCI Express (3GIO) – C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (WimFltr) – C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (Packet) – C:\Windows\SysWOW64\drivers\packet.sys (SingleClick Systems)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\John\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)



========== Chrome ==========

CHR - default_search_provider: Google ()
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}source
id=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}

O1 HOSTS File: ([2011/12/01 10:58:34 | 000,001,392 | RHS- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 217.23.4.166 www.google-analytics.com.
O1 - Hosts: 217.23.4.166 ad-emea.doubleclick.net.
O1 - Hosts: 217.23.4.166 www.statcounter.com.
O1 - Hosts: 69.72.252.254 www.google-analytics.com.
O1 - Hosts: 69.72.252.254 ad-emea.doubleclick.net.
O1 - Hosts: 69.72.252.254 www.statcounter.com.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Broadcom Wireless Manager UI] C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE (Dell Inc.)
O4 - HKLM..\Run: [Dell DataSafe Online] C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe ()
O4 - HKLM..\Run: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter File not found
O4 - HKLM..\Run: [Desktop Disc Tool] c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe ()
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [StartCCC] c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe (Dell)
O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe (Softthinks)
O4 - Startup: C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{41F094FD-C67D-44D4-92DA-88FFF3B0D468}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{478505B3-5495-4C41-B757-EDF473B5CEAE}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/08/14 11:43:06 | 000,000,000 | RHSD | M] - E:\autorun.inf – [ FAT ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*


Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 30 Days ==========

[2011/12/11 16:04:04 | 000,000,000 | —D | C] – C:\Users\John\Desktop\Computer tools
[2011/12/11 16:03:43 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\John\Desktop\OTL.exe
[2011/12/10 22:05:22 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/12/09 13:22:03 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{C7259314-2491-4598-BA5B-0BB70A7EA0CA}
[2011/12/09 13:21:42 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{5E8FF21E-9BF2-46B1-9DEA-7F207592A98D}
[2011/12/09 07:39:31 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2011/12/09 07:39:31 | 000,000,000 | —D | C] – C:\ProgramData\McAfee Security Scan
[2011/12/09 07:39:24 | 000,000,000 | —D | C] – C:\Program Files (x86)\McAfee Security Scan
[2011/12/09 07:23:23 | 000,000,000 | —D | C] – C:\ProgramData\Trend Micro
[2011/12/08 15:00:28 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{1EA54D2F-E217-48BF-8D05-ACE2AD50A3EE}
[2011/12/08 15:00:07 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{FA49C175-5C45-43BC-B388-9174725D958E}
[2011/12/06 09:58:04 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{89B5EF93-9240-41A0-A4C1-CE4031C4358C}
[2011/12/06 09:57:53 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{6534FB6F-A961-49AA-8817-00B47C75C374}
[2011/12/06 09:07:30 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{B4CC9BC5-13E1-4B13-B2D6-2AF7A946F62A}
[2011/12/05 20:57:30 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{A9DED283-D91E-4799-83F9-7745443DCC8C}
[2011/12/05 20:56:39 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{7531C4CD-2CF2-41F9-A589-F6461BE843FC}
[2011/12/05 18:08:40 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{1CD129A7-E805-48CE-AA97-BA916D989C1D}
[2011/12/05 06:08:03 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{E776F58A-4A60-4A92-89F2-8657EA660F4A}
[2011/12/05 06:07:52 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{FD878C04-F27F-4018-A691-92521CEEAD41}
[2011/12/04 08:31:25 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\Diagnostics
[2011/12/04 07:25:14 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{C0ABA02E-E54A-48E9-9B10-6FBDC7B0F492}
[2011/12/04 07:25:04 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{2DF7DA3F-33FC-42EB-9C08-F094A3DD4F69}
[2011/12/03 08:05:36 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{BD5F3B43-4257-4C7F-84D2-0DEF1DF1E1F6}
[2011/12/03 08:05:25 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{78902EEC-A0A5-4372-AD4A-AA71A069FD80}
[2011/12/02 07:34:13 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{516690DB-FDA4-4612-856F-76BC2BE75323}
[2011/12/02 07:33:52 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{A4B716CA-7DF0-4332-A8C4-F28A6A6644E2}
[2011/12/01 19:33:26 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{31E5988A-EDD9-4738-A19A-3D50345D78D9}
[2011/12/01 19:33:05 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{49C190CC-BFBD-463C-8C80-B3F68FDA0A96}
[2011/12/01 07:32:39 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{E3F111CD-0653-4E2A-9CDE-0FF49257398D}
[2011/12/01 07:32:17 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{9B842730-8686-40D5-96EE-96E90DACE025}
[2011/11/30 19:31:52 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{29712D4E-8FC0-4D38-9FA8-8DA60DBB32D3}
[2011/11/30 19:31:30 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{3FD383D9-8CF6-4E05-99A7-26DAD9BC089E}
[2011/11/30 07:31:03 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{70E8AB0C-D308-43F4-977F-C9111CA24B96}
[2011/11/30 07:30:41 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{A95776ED-8C6C-4B41-BE52-C71A1F0D15BC}
[2011/11/29 18:11:14 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{C2AC8DC4-775F-48EB-8A51-D6B1FB9AF85F}
[2011/11/29 18:10:52 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{2F11083A-C378-4945-81B5-2B2EA70DF934}
[2011/11/29 06:10:13 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{42245523-67CB-4C3B-A561-0A2629385CF7}
[2011/11/29 06:10:03 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{B687C755-250D-4023-B82A-3625DA0A71C0}
[2011/11/28 13:17:18 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2011/11/28 13:11:28 | 000,000,000 | —D | C] – C:\ProgramData\Ask
[2011/11/28 13:11:03 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaws.exe
[2011/11/28 13:11:03 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaw.exe
[2011/11/28 13:11:03 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\java.exe
[2011/11/28 09:11:39 | 000,000,000 | —D | C] – C:\Windows\system64
[2011/11/28 07:33:49 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{24E30ECC-AFA5-4436-ACB0-2CDF4976A80C}
[2011/11/28 07:33:28 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{9CE4D386-DC4F-491D-9648-5F077A56CD71}
[2011/11/27 10:31:38 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{58A338B3-636E-4E22-A0FF-FFC7BC715F84}
[2011/11/27 10:31:16 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{5A45BBB2-68F4-4A44-83B7-54AE82874437}
[2011/11/26 22:30:52 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{93EBCC9B-0AED-4315-B932-BF305932A912}
[2011/11/26 22:30:30 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{54E0601B-42D0-4F82-91C6-E77A5B226BA8}
[2011/11/26 10:30:18 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{CE06AE7A-F543-4FAF-92C5-42B66D7F6EF6}
[2011/11/26 10:29:56 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{698964A7-1422-42B5-806C-95FD9D13D6E5}
[2011/11/25 22:29:44 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{CA04410B-AD0D-4204-BA86-5B32A42BD321}
[2011/11/25 22:29:22 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{6E9C83B9-2367-426A-887B-258BD0D10D10}
[2011/11/25 10:29:10 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{90BE8CA4-0EA7-4CDB-B813-068A8B1E46BB}
[2011/11/25 10:28:47 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{8D813F64-5DB2-4C80-90E3-9F4C2B3ED882}
[2011/11/24 22:28:35 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{798F2AF1-507A-4979-A0D2-D2A9CD783B2E}
[2011/11/24 22:28:13 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{6ACA8743-F561-436E-8689-97A7077BA4DB}
[2011/11/24 10:28:01 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{7462E5C9-CCF2-4051-AE3D-7E177DA509D4}
[2011/11/24 10:27:39 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{1C1B0005-C68D-40EF-A09A-2EDBAD813F73}
[2011/11/23 22:27:27 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{5132CC8F-8CCF-407B-8072-D954FE3E7C88}
[2011/11/23 22:27:05 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{B19EF101-46AC-49AE-80DE-F9749801DBFF}
[2011/11/23 10:26:51 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{6F49F341-F883-42A1-84F5-760D67F5C713}
[2011/11/23 10:26:30 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{92D7B85F-F015-4D34-968B-45A21465DA6E}
[2011/11/22 10:20:48 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{CDA934F2-55E8-44AD-B8BA-C921612A2D82}
[2011/11/22 10:20:26 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{4B3226E3-3345-4D33-A677-A6995DA0D32A}
[2011/11/21 12:20:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2011/11/21 10:45:52 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{F256A4FC-EEA4-42C1-86AD-6E04A2C5C554}
[2011/11/21 10:45:29 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{D0621915-A4ED-436E-B620-E4AA4BFF6E86}
[2011/11/21 06:36:46 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{15F1D6DE-34B2-4DEF-AA48-645DD0B06BED}
[2011/11/20 07:51:43 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{1CD023D4-BFB7-4190-96F2-D8A4C2856819}
[2011/11/20 07:51:22 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{A4C49CA3-1B15-4C87-90A0-7B0E85404C0F}
[2011/11/19 19:15:17 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{B231A2D9-06F6-4A94-927B-F515F33D181F}
[2011/11/19 19:14:56 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{52EB6204-25D0-4FF5-AF83-0A868211B82B}
[2011/11/19 07:14:26 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{4D3D2BC2-B085-42A2-A093-4728E4075A3D}
[2011/11/19 07:14:16 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{6EB71965-3B14-4A2A-AE9F-41C68711ADEA}
[2011/11/18 21:11:25 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{7FA1D830-FCA6-4F39-AE81-FBDD544CA7A3}
[2011/11/18 21:11:03 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{65B10D6F-5A69-4BAC-AC55-2B83AF0030E3}
[2011/11/18 06:30:12 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{CAC9D137-C16E-4A32-9674-9F016CE8E8A2}
[2011/11/18 06:29:51 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{D42869DF-00FD-411A-BA44-06D63B3D82F1}
[2011/11/17 10:07:08 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{D1D7C3CA-D98D-4D80-B2A9-72786D1D063D}
[2011/11/17 10:06:46 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{A9F8F6CE-9020-4630-A963-1D5751C2E98C}
[2011/11/17 10:01:20 | 000,000,000 | —D | C] – C:\Windows\en
[2011/11/17 09:58:35 | 000,000,000 | —D | C] – C:\Program Files\Windows Live
[2011/11/17 09:57:25 | 000,515,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAudio2_5.dll
[2011/11/17 09:57:25 | 000,069,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAPOFX1_3.dll
[2011/11/17 09:57:23 | 000,523,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_42.dll
[2011/11/17 09:57:23 | 000,453,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_42.dll
[2011/11/17 09:55:19 | 003,860,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\UIRibbon.dll
[2011/11/17 09:55:19 | 002,983,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\UIRibbon.dll
[2011/11/17 09:55:19 | 001,164,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\UIRibbonRes.dll
[2011/11/17 09:55:19 | 001,164,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\UIRibbonRes.dll
[2011/11/17 09:51:54 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{F3D77095-67B5-4CDC-B7EB-42A432D77154}
[2011/11/17 09:51:32 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{7FF39E7B-AB0C-4984-B1F0-03C63F1E93A1}
[2011/11/17 07:49:36 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{5619BFF2-FCE6-4BCF-ADAF-9D41E686CC02}
[2011/11/17 07:49:13 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{297A689F-2FD7-4E7A-9559-D5F400B91AC6}
[2011/11/16 22:18:15 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{F3CB15D7-E18A-476A-99CC-5E4CE6E72F62}
[2011/11/16 17:08:14 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{681BD86F-F468-45BC-AE7E-579FFBAEDEA2}
[2011/11/16 17:07:52 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{6441FE2B-EFA3-4D64-B381-67DA24492B6F}
[2011/11/16 12:46:19 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{28B608D3-BE90-414E-9F86-8E8D9482FD1D}
[2011/11/16 12:45:58 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{B333671E-44EB-4BC2-BE93-8AFAE8F6BE80}
[2011/11/16 08:04:08 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{B370AFB0-8CD5-4E53-937B-6CE6034674AD}
[2011/11/16 08:03:46 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{13BFA8A3-AC5A-473E-89E9-F36F02F36F69}
[2011/11/16 06:30:32 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{C0A145D7-5106-44A9-B878-09DEE632AE66}
[2011/11/16 06:30:10 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{4C8D45EC-ED36-4AA8-9508-C6271A85B514}
[2011/11/15 21:04:53 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{B87FC783-4BFB-4DEE-B775-EF202F83977A}
[2011/11/15 21:04:31 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{5A3CAC07-EAD0-486A-91F9-DE233B138940}
[2011/11/15 13:54:30 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{323CA349-089B-4525-84A4-1A8017402879}
[2011/11/15 13:54:09 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{101B4FC0-9177-44B5-B666-ED1B10591491}
[2011/11/15 10:54:49 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{FFCF2019-1931-4DBD-82D0-27BF2E9B7D67}
[2011/11/15 10:54:27 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{F2CE0FBA-2900-4663-AEEE-97DD24C77744}
[2011/11/15 07:30:52 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{60090BE5-F091-425D-8FBA-2286C226402B}
[2011/11/15 07:30:31 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{54AA73D4-035F-49EF-B5E1-F87F7FCEB164}
[2011/11/15 06:44:55 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{923C3C22-C7BD-43D3-972F-D393D739629D}
[2011/11/15 06:44:44 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{E61F1C92-6514-4199-A771-613E51A6218B}
[2011/11/14 09:31:28 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{E3CC52AD-1823-472A-9538-63767AB85A3E}
[2011/11/14 09:31:06 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{5FF6FA52-DA5D-402D-B59F-1B6BF1C80726}
[2011/11/14 07:22:45 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{A8CF3FD2-17D0-47A7-BFFA-5C642CA5170F}
[2011/11/14 07:22:35 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{65AC97B8-E9EC-4D0F-A688-2489EBEA753F}
[2011/11/13 08:01:50 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{54948FBB-F1C2-443D-838C-03B7A39EEC1E}
[2011/11/13 08:01:28 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{178168FD-BB5C-491A-BCFA-FB2E53DC9EF2}
[2011/11/13 07:24:18 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{F5702EF1-91C7-4F28-B3E4-5C151B0E3658}
[2011/11/13 07:23:56 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{E4BA3B75-CD5B-4E56-8754-EB47665EE5F4}
[2011/11/12 20:17:41 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{773CE24B-F102-4B6A-9205-28CD7DBC54C3}
[2011/11/12 20:17:19 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{B46B0BB2-303B-4836-9BA4-51DED101B7A2}
[2011/11/12 08:38:28 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{7E8E6AEB-113A-4FBA-8A94-96FED4448760}
[2011/11/12 08:38:07 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{7C0BA5B9-049A-4565-8ACA-414283697144}
[2011/11/11 21:08:36 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{6477710C-3B68-438A-B844-6D20A50C8AFF}
[2011/11/11 21:08:25 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{2C505525-AEC3-45CF-9898-6017FC5770C8}
[2011/11/11 20:40:22 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{957BCA3A-8B00-4DAF-8B78-6891AFF1CCB3}
[2011/11/11 20:40:00 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{5D04F09B-40BC-41A9-8059-D8D0D60EB1B3}
[2011/11/11 19:11:46 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{67D326CE-39E9-4BB8-9E51-90B6DE4E121F}
[2011/11/11 19:11:24 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\{4403570C-7A57-41B2-818B-7E53EBC0061C}
[2010/03/12 12:52:14 | 008,653,312 | —- | C] (Dell, Inc. ) – C:\Users\John\AppData\Roaming\DataSafeDotNet.exe

========== Files - Modified Within 30 Days ==========

[2011/12/11 16:06:04 | 000,726,316 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2011/12/11 16:06:04 | 000,623,940 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2011/12/11 16:06:04 | 000,106,316 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2011/12/11 16:02:32 | 000,000,355 | —- | M] () – C:\Users\John\Desktop\Computer.lnk
[2011/12/11 15:59:46 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/12/11 15:59:36 | 3018,993,664 | -HS- | M] () – C:\hiberfil.sys
[2011/12/11 15:49:26 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\John\Desktop\OTL.exe
[2011/12/11 15:45:54 | 000,625,664 | —- | M] () – C:\Users\John\Desktop\dds.scr
[2011/12/09 15:16:00 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/09 14:00:06 | 000,000,506 | —- | M] () – C:\Windows\tasks\SystemToolsDailyTest.job
[2011/12/09 07:39:31 | 000,002,172 | —- | M] () – C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2011/12/09 07:39:31 | 000,002,172 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/12/09 07:36:28 | 000,014,240 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/12/09 07:36:28 | 000,014,240 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/12/09 07:29:28 | 000,000,890 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/06 13:39:18 | 000,001,115 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/12/01 10:58:34 | 000,001,392 | RHS- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2011/11/28 10:59:32 | 000,000,564 | —- | M] () – C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2011/11/27 10:52:12 | 000,015,872 | —- | M] () – C:\Users\John\Documents\The Mtn Goat.wps
[2011/11/27 10:52:12 | 000,001,014 | —- | M] () – C:\Users\John\AppData\Roaming\wklnhst.dat
[2011/11/21 12:20:16 | 000,002,214 | —- | M] () – C:\Users\Public\Desktop\Google Earth.lnk
[2011/11/19 17:49:54 | 000,003,666 | —- | M] () – C:\Users\John\Desktop\Mailcsv.csv
[2011/11/19 17:41:38 | 000,002,016 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011/11/19 07:19:49 | 000,002,346 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk

========== Files Created - No Company Name ==========

[2011/12/11 16:03:02 | 000,625,664 | —- | C] () – C:\Users\John\Desktop\dds.scr
[2011/12/11 16:02:32 | 000,000,355 | —- | C] () – C:\Users\John\Desktop\Computer.lnk
[2011/12/09 07:39:31 | 000,002,172 | —- | C] () – C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2011/12/09 07:39:26 | 000,002,172 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/11/27 10:52:12 | 000,015,872 | —- | C] () – C:\Users\John\Documents\The Mtn Goat.wps
[2011/11/21 12:20:16 | 000,002,214 | —- | C] () – C:\Users\Public\Desktop\Google Earth.lnk
[2011/11/19 17:49:53 | 000,003,666 | —- | C] () – C:\Users\John\Desktop\Mailcsv.csv
[2010/12/16 11:23:20 | 000,001,026 | —- | C] () – C:\ProgramData\.wtav
[2010/03/13 21:02:06 | 000,001,014 | —- | C] () – C:\Users\John\AppData\Roaming\wklnhst.dat
[2010/02/12 20:29:59 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2009/07/13 23:38:36 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/13 20:35:51 | 000,000,741 | —- | C] () – C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 20:34:42 | 000,215,943 | —- | C] () – C:\Windows\SysWow64\dssec.dat
[2009/07/13 18:10:29 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 17:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 15:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 15:26:10 | 000,673,088 | —- | C] () – C:\Windows\SysWow64\mlang.dat

========== LOP Check ==========

[2011/02/27 15:55:56 | 000,000,000 | —D | M] – C:\Users\John\AppData\Roaming\PCDr
[2010/03/13 21:02:08 | 000,000,000 | —D | M] – C:\Users\John\AppData\Roaming\Template
[2011/04/27 07:38:48 | 000,000,000 | —D | M] – C:\Users\John\AppData\Roaming\Windows Live Writer
[2011/11/28 10:59:32 | 000,000,564 | —- | M] () – C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
[2011/08/07 06:18:03 | 000,032,570 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2011/12/09 14:00:06 | 000,000,506 | —- | M] () – C:\Windows\Tasks\SystemToolsDailyTest.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/02/12 20:17:17 | 000,024,464 | RH– | M] () – C:\dell.sdr
[2011/12/11 15:59:36 | 3018,993,664 | -HS- | M] () – C:\hiberfil.sys
[2006/12/01 23:37:14 | 000,904,704 | —- | M] (Microsoft Corporation) – C:\msdia80.dll
[2011/12/11 15:59:39 | 4025,327,616 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2009/07/13 23:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 23:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 23:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 23:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 14:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/05/13 15:42:24 | 000,302,448 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 22:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/03/12 12:55:24 | 000,000,221 | -HS- | M] () – C:\Users\John\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/12/11 15:49:26 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\John\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\Windows\system64] -> \systemroot\system32 -> Mount Point

========== Alternate Data Streams ==========

@Alternate Data Stream - 160 bytes -> C:\Users\John\Documents\Firetruck.jpg:3or4kl4x13tuuug3Byamue2s4b

< End of report >


OTL Extras logfile created on: 12/11/2011 4:07:10 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\John\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.75 Gb Total Physical Memory | 2.95 Gb Available Physical Memory | 78.82% Memory free
7.50 Gb Paging File | 6.78 Gb Available in Paging File | 90.42% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 283.40 Gb Total Space | 249.89 Gb Free Space | 88.17% Space Free | Partition Type: NTFS
Drive E: | 488.60 Mb Total Space | 169.69 Mb Free Space | 34.73% Space Free | Partition Type: FAT

Computer Name: JOHN-PC | User Name: John | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"AutoUpdateDisableNotify" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0090A87C-3E0E-43D4-AA71-A71B06563A4A}" = Dell Support Center
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{26A24AE4-039D-4CA4-87B4-2F86416017FF}" = Java™ 6 Update 17 (64-bit)
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6A4E6B7B-72F8-F09D-3167-D10BED76C1D1}" = ccc-utility64
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}" = Dell Edoc Viewer
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{E60B7350-EA5F-41E0-9D6F-E508781E36D2}" = Dell Dock
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CNXT_AUDIO_HDA" = Conexant HD Audio
"Dell Support Center" = Dell Support Center
"Dell Wireless WLAN Card Utility" = Dell Wireless WLAN Card Utility
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{017F6151-CDFF-4ACE-6A0B-AB10E5C72CB6}" = CCC Help English
"{0334E92E-8D83-DBB5-6AB7-A6CDBFEA9502}" = Catalyst Control Center InstallProxy
"{052bac4a-6f79-46d4-a024-1ce1b4f73cd4}" = Microsoft Visual C++ 2005 Redistributable
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0B2BE3A5-64A9-3CFB-7F9A-B76C774D70DF}" = CCC Help Portuguese
"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = Dell DataSafe Local Backup
"{13766F76-6C8C-4E57-A9F3-3212D1C6E0D1}" = Dell DataSafe Online
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20E91018-E7FD-1094-FEB6-D7E64A12CAAC}" = CCC Help Japanese
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java™ 6 Update 29
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{30B6778F-B315-2E98-36EB-E06806B1E410}" = CCC Help Chinese Traditional
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{424BF763-4A22-CBD1-2EA4-E9F455A0B7DE}" = Catalyst Control Center Localization All
"{42D68A86-DB1C-4256-B8C9-5D0D92919AF5}" = Banctec Service Agreement
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module
"{567AB08A-6816-E679-EE84-A89F107E75F7}" = Catalyst Control Center Graphics Previews Vista
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{64710CB5-466A-3DF4-A8AF-C0B1357399E6}" = CCC Help Hungarian
"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6AF15677-78CA-5081-7F8D-55A82680FEE4}" = ccc-core-static
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7508A2B5-23AC-D9B4-5B4F-682771FF29D8}" = CCC Help Italian
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{820B6609-4C97-3A2B-B644-573B06A0F0CC}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74FFDF-F000-792D-A785-2BE5FD48D260}" = Skins
"{8B7917E0-AF55-4E8A-9473-017F0AA03AC8}" = QuickTime
"{8C6C7024-853F-3583-7D85-ABB5CD0EBB97}" = Catalyst Control Center Graphics Full New
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90850409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A33E7B0C-B99C-4EC9-B702-8A328B161AF9}" = Roxio Burn
"{A69D7B32-2BE9-42BF-B576-69B5E0FF7394}" = Catalyst Control Center - Branding
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A7AAE9A9-9E9A-FAFB-A12F-65BDB6391A39}" = CCC Help Spanish
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = Dell DataSafe Local Backup - Support Software
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA4916CE-C893-375B-CAAF-5BAC711629F2}" = CCC Help Korean
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.6
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{B0BBD04F-0A95-2AAA-666B-8AFDAF835BAE}" = Catalyst Control Center Core Implementation
"{B2E47DE7-800B-40BB-BD1F-9F221C3AEE87}" = Roxio Burn
"{BBE209D7-0A90-1684-5124-8D470CF46E91}" = CCC Help Chinese Standard
"{BD4EA616-6D92-53FC-1CFC-1894CF9E5FBA}" = Catalyst Control Center Graphics Light
"{BD6441FE-2D09-5632-4A70-5DEB2B661268}" = Catalyst Control Center Graphics Full Existing
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D837A4C4-8466-D33F-54A5-064002985191}" = CCC Help German
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EB6316F0-E008-EA74-8C15-4B178CA09F7B}" = CCC Help Turkish
"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F66A31D9-7831-4FBA-BA02-C411C0047CC5}" = Dell Remote Access
"{F76F2105-B0DB-B1AA-F254-1B68FCE35D63}" = Catalyst Control Center Graphics Previews Common
"{F9B04736-2F30-2316-7741-DCB067B78988}" = CCC Help French
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Google Chrome" = Google Chrome
"GoToAssist" = GoToAssist 8.0.0.514
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"McAfee Security Scan" = McAfee Security Scan Plus
"WinLiveSuite" = Windows Live Essentials

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.8

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/1/2011 2:56:44 PM | Computer Name = John-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 12/1/2011 3:16:12 PM | Computer Name = John-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 12/1/2011 3:22:12 PM | Computer Name = John-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 12/1/2011 3:33:14 PM | Computer Name = John-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 12/1/2011 3:39:32 PM | Computer Name = John-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 12/1/2011 3:53:40 PM | Computer Name = John-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 12/1/2011 4:00:21 PM | Computer Name = John-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 12/1/2011 4:35:52 PM | Computer Name = John-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 12/1/2011 4:57:19 PM | Computer Name = John-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 12/1/2011 6:26:48 PM | Computer Name = John-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

[ Broadcom Wireless LAN Events ]
Error - 11/10/2010 10:59:46 PM | Computer Name = John-PC | Source = WLAN-Tray | ID = 0
Description = 20:59:42, Wed, Nov 10, 10 Error - Unable to gain access to user store


Error - 1/25/2011 5:02:44 PM | Computer Name = John-PC | Source = WLAN-Tray | ID = 0
Description = 15:02:42, Tue, Jan 25, 11 Error - Unable to gain access to user store


Error - 2/22/2011 9:10:39 AM | Computer Name = John-PC | Source = WLAN-Tray | ID = 0
Description = 07:10:36, Tue, Feb 22, 11 Error - Unable to gain access to user store


Error - 7/18/2011 7:33:45 AM | Computer Name = John-PC | Source = WLAN-Tray | ID = 0
Description = 06:33:40, Mon, Jul 18, 11 Error - Unable to gain access to user store


Error - 9/15/2011 10:25:27 PM | Computer Name = John-PC | Source = WLAN-Tray | ID = 0
Description = 21:25:26, Thu, Sep 15, 11 Error - Unable to gain access to user store


Error - 9/18/2011 4:28:12 AM | Computer Name = John-PC | Source = WLAN-Tray | ID = 0
Description = 03:28:10, Sun, Sep 18, 11 Error - Unable to gain access to user store


[ Dell Events ]
Error - 10/21/2010 4:11:54 PM | Computer Name = John-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 10/21/2010 4:11:54 PM | Computer Name = John-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 6/18/2011 7:40:46 AM | Computer Name = John-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 6/18/2011 7:40:46 AM | Computer Name = John-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 8/31/2011 6:53:30 AM | Computer Name = John-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 8/31/2011 6:53:30 AM | Computer Name = John-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 9/21/2011 7:33:50 AM | Computer Name = John-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 9/21/2011 7:33:50 AM | Computer Name = John-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 9/22/2011 7:38:45 PM | Computer Name = John-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

[ System Events ]
Error - 12/11/2011 6:00:18 PM | Computer Name = John-PC | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 12/11/2011 6:00:18 PM | Computer Name = John-PC | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 12/11/2011 6:00:18 PM | Computer Name = John-PC | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 12/11/2011 6:00:18 PM | Computer Name = John-PC | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 12/11/2011 6:00:18 PM | Computer Name = John-PC | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 12/11/2011 6:00:18 PM | Computer Name = John-PC | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 12/11/2011 6:01:47 PM | Computer Name = John-PC | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 12/11/2011 6:02:43 PM | Computer Name = John-PC | Source = DCOM | ID = 10005
Description =

Error - 12/11/2011 6:02:43 PM | Computer Name = John-PC | Source = DCOM | ID = 10005
Description =

Error - 12/11/2011 6:02:43 PM | Computer Name = John-PC | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068


< End of report >

Hi Blade81, thank you for your help in chopping out this rootkit. Here are the DDS reports as requested. . DDS (Ver_11-03-05.01) - NTFS_AMD64 Run by [removed] at 9:43:11.02 on Tue 12/13/2011 Internet Explorer: 8.0.7600.16385 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3839.2821 [GMT -6:00] . AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\atieclxx.exe C:\Program Files\Dell\DellDock\DockLogin.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe C:\Windows\System32\spoolsv.exe C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation c:\Program Files (x86)\Common Files\Dell\Advanced Networking Service\hnm_svc.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE C:\Windows\System32\vds.exe C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\Dell Remote Access\ezi_ra.exe C:\Program Files (x86)\McAfee Security Scan\3.0.229\SSScheduler.exe C:\Program Files\Dell\DellDock\DellDock.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\sppsvc.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\John\Desktop\dds.scr C:\Windows\system32\conhost.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://my.yahoo.com/ mWinlogon: Userinit=userinit.exe, BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File mRun: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m mRun: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" mRun: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" mRun: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe StartupFolder: C:\Users\John\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files\Dell\DellDock\DellDock.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLRE~1.LNK - c:\Windows\Installer\{F66A31D9-7831-4FBA-BA02-C411C0047CC5}\NewShortcut4_F66A31D978314FBABA02C411C0047CC5.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\3.0.229\SSScheduler.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll LSP: mswsock.dll DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File mRun-x64: [Broadcom Wireless Manager UI] C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe Hosts: 217.23.4.166 www.google-analytics.com. Hosts: 217.23.4.166 ad-emea.doubleclick.net. Hosts: 217.23.4.166 www.statcounter.com. Hosts: 69.72.252.254 www.google-analytics.com. Hosts: 69.72.252.254 ad-emea.doubleclick.net. . Note: multiple HOSTS entries found. Please refer to Attach.txt . ============= SERVICES / DRIVERS =============== . R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-2-12 55280] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-2-12 203264] R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2009-6-9 155648] R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2010-2-12 705856] R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;C:\Windows\System32\drivers\k57nd60a.sys [2010-2-12 320040] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-3-15 135664] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-3-15 135664] S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.229\McCHSvc.exe [2011-9-20 237008] S3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;C:\Program Files\Dell Support Center\pcdsrvc_x64.pkms [2011-10-5 25072] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-2-12 221696] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-5-15 1255736] . =============== Created Last 30 ================ . 2011-12-09 19:22:03 ——– d—–w- C:\Users\John\AppData\Local\{C7259314-2491-4598-BA5B-0BB70A7EA0CA} 2011-12-09 19:21:42 ——– d—–w- C:\Users\John\AppData\Local\{5E8FF21E-9BF2-46B1-9DEA-7F207592A98D} 2011-12-09 13:39:31 ——– d—–w- C:\PROGRA~3\McAfee Security Scan 2011-12-09 13:39:24 ——– d—–w- C:\Program Files (x86)\McAfee Security Scan 2011-12-09 13:23:23 ——– d—–w- C:\PROGRA~3\Trend Micro 2011-12-08 21:00:28 ——– d—–w- C:\Users\John\AppData\Local\{1EA54D2F-E217-48BF-8D05-ACE2AD50A3EE} 2011-12-08 21:00:07 ——– d—–w- C:\Users\John\AppData\Local\{FA49C175-5C45-43BC-B388-9174725D958E} 2011-12-06 15:58:04 ——– d—–w- C:\Users\John\AppData\Local\{89B5EF93-9240-41A0-A4C1-CE4031C4358C} 2011-12-06 15:57:53 ——– d—–w- C:\Users\John\AppData\Local\{6534FB6F-A961-49AA-8817-00B47C75C374} 2011-12-06 15:07:30 ——– d—–w- C:\Users\John\AppData\Local\{B4CC9BC5-13E1-4B13-B2D6-2AF7A946F62A} 2011-12-06 02:57:30 ——– d—–w- C:\Users\John\AppData\Local\{A9DED283-D91E-4799-83F9-7745443DCC8C} 2011-12-06 02:56:39 ——– d—–w- C:\Users\John\AppData\Local\{7531C4CD-2CF2-41F9-A589-F6461BE843FC} 2011-12-06 00:08:40 ——– d—–w- C:\Users\John\AppData\Local\{1CD129A7-E805-48CE-AA97-BA916D989C1D} 2011-12-05 12:08:03 ——– d—–w- C:\Users\John\AppData\Local\{E776F58A-4A60-4A92-89F2-8657EA660F4A} 2011-12-05 12:07:52 ——– d—–w- C:\Users\John\AppData\Local\{FD878C04-F27F-4018-A691-92521CEEAD41} 2011-12-04 14:31:25 ——– d—–w- C:\Users\John\AppData\Local\Diagnostics 2011-12-04 13:25:14 ——– d—–w- C:\Users\John\AppData\Local\{C0ABA02E-E54A-48E9-9B10-6FBDC7B0F492} 2011-12-04 13:25:04 ——– d—–w- C:\Users\John\AppData\Local\{2DF7DA3F-33FC-42EB-9C08-F094A3DD4F69} 2011-12-03 14:05:36 ——– d—–w- C:\Users\John\AppData\Local\{BD5F3B43-4257-4C7F-84D2-0DEF1DF1E1F6} 2011-12-03 14:05:25 ——– d—–w- C:\Users\John\AppData\Local\{78902EEC-A0A5-4372-AD4A-AA71A069FD80} 2011-12-02 13:34:13 ——– d—–w- C:\Users\John\AppData\Local\{516690DB-FDA4-4612-856F-76BC2BE75323} 2011-12-02 13:33:52 ——– d—–w- C:\Users\John\AppData\Local\{A4B716CA-7DF0-4332-A8C4-F28A6A6644E2} 2011-12-02 01:33:26 ——– d—–w- C:\Users\John\AppData\Local\{31E5988A-EDD9-4738-A19A-3D50345D78D9} 2011-12-02 01:33:05 ——– d—–w- C:\Users\John\AppData\Local\{49C190CC-BFBD-463C-8C80-B3F68FDA0A96} 2011-12-01 13:32:39 ——– d—–w- C:\Users\John\AppData\Local\{E3F111CD-0653-4E2A-9CDE-0FF49257398D} 2011-12-01 13:32:17 ——– d—–w- C:\Users\John\AppData\Local\{9B842730-8686-40D5-96EE-96E90DACE025} 2011-12-01 01:31:52 ——– d—–w- C:\Users\John\AppData\Local\{29712D4E-8FC0-4D38-9FA8-8DA60DBB32D3} 2011-12-01 01:31:30 ——– d—–w- C:\Users\John\AppData\Local\{3FD383D9-8CF6-4E05-99A7-26DAD9BC089E} 2011-11-30 13:31:03 ——– d—–w- C:\Users\John\AppData\Local\{70E8AB0C-D308-43F4-977F-C9111CA24B96} 2011-11-30 13:30:41 ——– d—–w- C:\Users\John\AppData\Local\{A95776ED-8C6C-4B41-BE52-C71A1F0D15BC} 2011-11-30 00:11:14 ——– d—–w- C:\Users\John\AppData\Local\{C2AC8DC4-775F-48EB-8A51-D6B1FB9AF85F} 2011-11-30 00:10:52 ——– d—–w- C:\Users\John\AppData\Local\{2F11083A-C378-4945-81B5-2B2EA70DF934} 2011-11-29 12:10:13 ——– d—–w- C:\Users\John\AppData\Local\{42245523-67CB-4C3B-A561-0A2629385CF7} 2011-11-29 12:10:03 ——– d—–w- C:\Users\John\AppData\Local\{B687C755-250D-4023-B82A-3625DA0A71C0} 2011-11-28 19:11:28 ——– d—–w- C:\PROGRA~3\Ask 2011-11-28 15:11:39 ——– d—–we C:\Windows\system64 2011-11-28 13:33:49 ——– d—–w- C:\Users\John\AppData\Local\{24E30ECC-AFA5-4436-ACB0-2CDF4976A80C} 2011-11-28 13:33:28 ——– d—–w- C:\Users\John\AppData\Local\{9CE4D386-DC4F-491D-9648-5F077A56CD71} 2011-11-27 16:31:38 ——– d—–w- C:\Users\John\AppData\Local\{58A338B3-636E-4E22-A0FF-FFC7BC715F84} 2011-11-27 16:31:16 ——– d—–w- C:\Users\John\AppData\Local\{5A45BBB2-68F4-4A44-83B7-54AE82874437} 2011-11-27 04:30:52 ——– d—–w- C:\Users\John\AppData\Local\{93EBCC9B-0AED-4315-B932-BF305932A912} 2011-11-27 04:30:30 ——– d—–w- C:\Users\John\AppData\Local\{54E0601B-42D0-4F82-91C6-E77A5B226BA8} 2011-11-26 16:30:18 ——– d—–w- C:\Users\John\AppData\Local\{CE06AE7A-F543-4FAF-92C5-42B66D7F6EF6} 2011-11-26 16:29:56 ——– d—–w- C:\Users\John\AppData\Local\{698964A7-1422-42B5-806C-95FD9D13D6E5} 2011-11-26 04:29:44 ——– d—–w- C:\Users\John\AppData\Local\{CA04410B-AD0D-4204-BA86-5B32A42BD321} 2011-11-26 04:29:22 ——– d—–w- C:\Users\John\AppData\Local\{6E9C83B9-2367-426A-887B-258BD0D10D10} 2011-11-25 16:29:10 ——– d—–w- C:\Users\John\AppData\Local\{90BE8CA4-0EA7-4CDB-B813-068A8B1E46BB} 2011-11-25 16:28:47 ——– d—–w- C:\Users\John\AppData\Local\{8D813F64-5DB2-4C80-90E3-9F4C2B3ED882} 2011-11-25 04:28:35 ——– d—–w- C:\Users\John\AppData\Local\{798F2AF1-507A-4979-A0D2-D2A9CD783B2E} 2011-11-25 04:28:13 ——– d—–w- C:\Users\John\AppData\Local\{6ACA8743-F561-436E-8689-97A7077BA4DB} 2011-11-24 16:28:01 ——– d—–w- C:\Users\John\AppData\Local\{7462E5C9-CCF2-4051-AE3D-7E177DA509D4} 2011-11-24 16:27:39 ——– d—–w- C:\Users\John\AppData\Local\{1C1B0005-C68D-40EF-A09A-2EDBAD813F73} 2011-11-24 04:27:27 ——– d—–w- C:\Users\John\AppData\Local\{5132CC8F-8CCF-407B-8072-D954FE3E7C88} 2011-11-24 04:27:05 ——– d—–w- C:\Users\John\AppData\Local\{B19EF101-46AC-49AE-80DE-F9749801DBFF} 2011-11-23 16:26:51 ——– d—–w- C:\Users\John\AppData\Local\{6F49F341-F883-42A1-84F5-760D67F5C713} 2011-11-23 16:26:30 ——– d—–w- C:\Users\John\AppData\Local\{92D7B85F-F015-4D34-968B-45A21465DA6E} 2011-11-22 16:20:48 ——– d—–w- C:\Users\John\AppData\Local\{CDA934F2-55E8-44AD-B8BA-C921612A2D82} 2011-11-22 16:20:26 ——– d—–w- C:\Users\John\AppData\Local\{4B3226E3-3345-4D33-A677-A6995DA0D32A} 2011-11-21 16:45:52 ——– d—–w- C:\Users\John\AppData\Local\{F256A4FC-EEA4-42C1-86AD-6E04A2C5C554} 2011-11-21 16:45:29 ——– d—–w- C:\Users\John\AppData\Local\{D0621915-A4ED-436E-B620-E4AA4BFF6E86} 2011-11-21 12:36:46 ——– d—–w- C:\Users\John\AppData\Local\{15F1D6DE-34B2-4DEF-AA48-645DD0B06BED} 2011-11-20 13:51:43 ——– d—–w- C:\Users\John\AppData\Local\{1CD023D4-BFB7-4190-96F2-D8A4C2856819} 2011-11-20 13:51:22 ——– d—–w- C:\Users\John\AppData\Local\{A4C49CA3-1B15-4C87-90A0-7B0E85404C0F} 2011-11-20 01:15:17 ——– d—–w- C:\Users\John\AppData\Local\{B231A2D9-06F6-4A94-927B-F515F33D181F} 2011-11-20 01:14:56 ——– d—–w- C:\Users\John\AppData\Local\{52EB6204-25D0-4FF5-AF83-0A868211B82B} 2011-11-19 13:14:26 ——– d—–w- C:\Users\John\AppData\Local\{4D3D2BC2-B085-42A2-A093-4728E4075A3D} 2011-11-19 13:14:16 ——– d—–w- C:\Users\John\AppData\Local\{6EB71965-3B14-4A2A-AE9F-41C68711ADEA} 2011-11-19 03:11:25 ——– d—–w- C:\Users\John\AppData\Local\{7FA1D830-FCA6-4F39-AE81-FBDD544CA7A3} 2011-11-19 03:11:03 ——– d—–w- C:\Users\John\AppData\Local\{65B10D6F-5A69-4BAC-AC55-2B83AF0030E3} 2011-11-18 12:30:12 ——– d—–w- C:\Users\John\AppData\Local\{CAC9D137-C16E-4A32-9674-9F016CE8E8A2} 2011-11-18 12:29:51 ——– d—–w- C:\Users\John\AppData\Local\{D42869DF-00FD-411A-BA44-06D63B3D82F1} 2011-11-17 16:07:08 ——– d—–w- C:\Users\John\AppData\Local\{D1D7C3CA-D98D-4D80-B2A9-72786D1D063D} 2011-11-17 16:06:46 ——– d—–w- C:\Users\John\AppData\Local\{A9F8F6CE-9020-4630-A963-1D5751C2E98C} 2011-11-17 16:01:20 ——– d—–w- C:\Windows\en 2011-11-17 15:58:04 18328 —-a-w- C:\PROGRA~3\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-11-17 15:57:25 69464 —-a-w- C:\Windows\SysWow64\XAPOFX1_3.dll 2011-11-17 15:57:25 515416 —-a-w- C:\Windows\SysWow64\XAudio2_5.dll 2011-11-17 15:57:23 523088 —-a-w- C:\Windows\System32\d3dx10_42.dll 2011-11-17 15:57:23 453456 —-a-w- C:\Windows\SysWow64\d3dx10_42.dll 2011-11-17 15:55:19 3860992 —-a-w- C:\Windows\System32\UIRibbon.dll 2011-11-17 15:55:19 2983424 —-a-w- C:\Windows\SysWow64\UIRibbon.dll 2011-11-17 15:55:19 1164800 —-a-w- C:\Windows\SysWow64\UIRibbonRes.dll 2011-11-17 15:55:19 1164800 —-a-w- C:\Windows\System32\UIRibbonRes.dll 2011-11-17 15:51:54 ——– d—–w- C:\Users\John\AppData\Local\{F3D77095-67B5-4CDC-B7EB-42A432D77154} 2011-11-17 15:51:32 ——– d—–w- C:\Users\John\AppData\Local\{7FF39E7B-AB0C-4984-B1F0-03C63F1E93A1} 2011-11-17 13:49:36 ——– d—–w- C:\Users\John\AppData\Local\{5619BFF2-FCE6-4BCF-ADAF-9D41E686CC02} 2011-11-17 13:49:13 ——– d—–w- C:\Users\John\AppData\Local\{297A689F-2FD7-4E7A-9559-D5F400B91AC6} 2011-11-17 04:18:15 ——– d—–w- C:\Users\John\AppData\Local\{F3CB15D7-E18A-476A-99CC-5E4CE6E72F62} 2011-11-16 23:08:14 ——– d—–w- C:\Users\John\AppData\Local\{681BD86F-F468-45BC-AE7E-579FFBAEDEA2} 2011-11-16 23:07:52 ——– d—–w- C:\Users\John\AppData\Local\{6441FE2B-EFA3-4D64-B381-67DA24492B6F} 2011-11-16 18:46:19 ——– d—–w- C:\Users\John\AppData\Local\{28B608D3-BE90-414E-9F86-8E8D9482FD1D} 2011-11-16 18:45:58 ——– d—–w- C:\Users\John\AppData\Local\{B333671E-44EB-4BC2-BE93-8AFAE8F6BE80} 2011-11-16 14:04:08 ——– d—–w- C:\Users\John\AppData\Local\{B370AFB0-8CD5-4E53-937B-6CE6034674AD} 2011-11-16 14:03:46 ——– d—–w- C:\Users\John\AppData\Local\{13BFA8A3-AC5A-473E-89E9-F36F02F36F69} 2011-11-16 12:30:32 ——– d—–w- C:\Users\John\AppData\Local\{C0A145D7-5106-44A9-B878-09DEE632AE66} 2011-11-16 12:30:10 ——– d—–w- C:\Users\John\AppData\Local\{4C8D45EC-ED36-4AA8-9508-C6271A85B514} 2011-11-16 03:04:53 ——– d—–w- C:\Users\John\AppData\Local\{B87FC783-4BFB-4DEE-B775-EF202F83977A} 2011-11-16 03:04:31 ——– d—–w- C:\Users\John\AppData\Local\{5A3CAC07-EAD0-486A-91F9-DE233B138940} 2011-11-15 19:54:30 ——– d—–w- C:\Users\John\AppData\Local\{323CA349-089B-4525-84A4-1A8017402879} 2011-11-15 19:54:09 ——– d—–w- C:\Users\John\AppData\Local\{101B4FC0-9177-44B5-B666-ED1B10591491} 2011-11-15 16:54:49 ——– d—–w- C:\Users\John\AppData\Local\{FFCF2019-1931-4DBD-82D0-27BF2E9B7D67} 2011-11-15 16:54:27 ——– d—–w- C:\Users\John\AppData\Local\{F2CE0FBA-2900-4663-AEEE-97DD24C77744} 2011-11-15 13:30:52 ——– d—–w- C:\Users\John\AppData\Local\{60090BE5-F091-425D-8FBA-2286C226402B} 2011-11-15 13:30:31 ——– d—–w- C:\Users\John\AppData\Local\{54AA73D4-035F-49EF-B5E1-F87F7FCEB164} 2011-11-15 12:44:55 ——– d—–w- C:\Users\John\AppData\Local\{923C3C22-C7BD-43D3-972F-D393D739629D} 2011-11-15 12:44:44 ——– d—–w- C:\Users\John\AppData\Local\{E61F1C92-6514-4199-A771-613E51A6218B} 2011-11-14 15:31:28 ——– d—–w- C:\Users\John\AppData\Local\{E3CC52AD-1823-472A-9538-63767AB85A3E} 2011-11-14 15:31:06 ——– d—–w- C:\Users\John\AppData\Local\{5FF6FA52-DA5D-402D-B59F-1B6BF1C80726} 2011-11-14 13:22:45 ——– d—–w- C:\Users\John\AppData\Local\{A8CF3FD2-17D0-47A7-BFFA-5C642CA5170F} 2011-11-14 13:22:35 ——– d—–w- C:\Users\John\AppData\Local\{65AC97B8-E9EC-4D0F-A688-2489EBEA753F} . ==================== Find3M ==================== . 2011-10-03 11:06:03 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2011-10-01 03:21:20 1638912 —-a-w- C:\Windows\System32\mshtml.tlb 2011-10-01 02:59:14 1638912 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2011-09-29 16:24:44 1897328 —-a-w- C:\Windows\System32\drivers\tcpip.sys 2011-09-29 04:09:30 3141120 —-a-w- C:\Windows\System32\win32k.sys . ============= FINISH: 9:44:29.21 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_11-03-05.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 3/12/2010 12:35:19 PM System Uptime: 12/13/2011 9:39:33 AM (0 hours ago) . Motherboard: Dell Inc. | | 03D1TV Processor: AMD Athlon™ Neo X2 Dual Core Processor 6850e | CPU 1 | 990/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 283 GiB total, 249.729 GiB free. D: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Dell Wireless 1520 Wireless-N WLAN Mini-Card Device ID: PCI\VEN_14E4&DEV_4353&SUBSYS_000E1028&REV_01\4&243BA753&0&0028 Manufacturer: Broadcom Name: Dell Wireless 1520 Wireless-N WLAN Mini-Card PNP Device ID: PCI\VEN_14E4&DEV_4353&SUBSYS_000E1028&REV_01\4&243BA753&0&0028 Service: BCM43XX . ==== System Restore Points =================== . No restore point in system. . ==== Hosts File Hijack ====================== . Hosts: 217.23.4.166 www.google-analytics.com. Hosts: 217.23.4.166 ad-emea.doubleclick.net. Hosts: 217.23.4.166 www.statcounter.com. Hosts: 69.72.252.254 www.google-analytics.com. Hosts: 69.72.252.254 ad-emea.doubleclick.net. Hosts: 69.72.252.254 www.statcounter.com. . ==== Installed Programs ====================== . Adobe Flash Player 10 ActiveX Adobe Reader 9.4.6 Apple Application Support Apple Software Update ATI Catalyst Control Center Banctec Service Agreement Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Common Catalyst Control Center Graphics Previews Vista Catalyst Control Center InstallProxy Catalyst Control Center Localization All ccc-core-static CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help English CCC Help French CCC Help German CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Portuguese CCC Help Spanish CCC Help Turkish Cisco EAP-FAST Module Cisco LEAP Module Cisco PEAP Module Compatibility Pack for the 2007 Office system D3DX10 Dell DataSafe Local Backup Dell DataSafe Local Backup - Support Software Dell DataSafe Online Dell Getting Started Guide Dell Remote Access Google Chrome Google Earth Google Update Helper GoToAssist 8.0.0.514 Java Auto Updater Java™ 6 Update 29 Junk Mail filter update Malwarebytes' Anti-Malware version 1.51.2.1300 McAfee Security Scan Plus Microsoft Office PowerPoint Viewer 2007 (English) Microsoft Office Word Viewer 2003 Microsoft Search Enhancement Pack Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable - KB2467175 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 Microsoft Works MSVCRT MSVCRT_amd64 PowerDVD DX QuickTime Roxio Burn Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Skins Spelling Dictionaries Support For Adobe Reader 9 Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Windows Live Communications Platform Windows Live Essentials Windows Live Installer Windows Live Mail Windows Live Messenger Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live Sync Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources Yahoo! BrowserPlus 2.9.8 . ==== Event Viewer Messages From Past Week ======== . 12/9/2011 7:45:45 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} and APPID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} to the user John-PC\John SID (S-1-5-21-1101040838-1500645861-4030747750-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. 12/9/2011 7:42:20 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D3DCB472-7261-43CE-924B-0704BD730D5F} and APPID {D3DCB472-7261-43CE-924B-0704BD730D5F} to the user John-PC\John SID (S-1-5-21-1101040838-1500645861-4030747750-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. 12/9/2011 7:42:19 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {145B4335-FE2A-4927-A040-7C35AD3180EF} and APPID {145B4335-FE2A-4927-A040-7C35AD3180EF} to the user John-PC\John SID (S-1-5-21-1101040838-1500645861-4030747750-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. 12/9/2011 7:30:00 AM, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143. 12/9/2011 7:24:32 AM, Error: Service Control Manager [7000] - The Trend Micro WFP Callout Driver service failed to start due to the following error: There are no more endpoints available from the endpoint mapper. 12/9/2011 3:20:18 PM, Error: NetBT [4321] - The name "BETTYSPC :0" could not be registered on the interface with IP address 192.168.1.5. The computer with the IP address 192.168.1.1 did not allow the name to be claimed by this computer. 12/9/2011 12:59:31 PM, Error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0. 12/8/2011 2:36:30 PM, Error: Service Control Manager [7003] - The McAfee Personal Firewall Service service depends the following service: MpsSvc. This service might not be installed. 12/6/2011 4:13:33 PM, Error: Service Control Manager [7031] - The McShield service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service. 12/13/2011 9:40:06 AM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed. 12/13/2011 9:40:06 AM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed. 12/13/2011 9:40:05 AM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service. 12/13/2011 9:40:03 AM, Error: atikmdag [52236] - CPLIB :: General - Invalid Parameter 12/13/2011 9:40:03 AM, Error: atikmdag [43029] - Display is not active 12/11/2011 4:29:55 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:02:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F} 12/11/2011 4:02:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF} 12/11/2011 4:00:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030} 12/11/2011 4:00:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} 12/11/2011 4:00:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89} 12/11/2011 4:00:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E} 12/11/2011 4:00:17 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 12/11/2011 4:00:11 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC} 12/11/2011 4:00:00 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr Tcpip tdx vwififlt Wanarpv6 WfpLwf 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The TCP/IP Registry Compatibility service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start. . ==== End Of File ===========================

I ran ComboFix and DDS as requested and am posting the logs. I was unable to access McAfee to turn it off while scanning. This does not seem to have effected running the scans. Looks like it has infected hosts files. Not surprising that it has been redirecting. Thanx for working on this. ComboFix 11-12-13.03 - John 12/13/2011 20:44:14.1.2 - x64 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3839.2791 [GMT -6:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C} SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\.wtav c:\programdata\PCDr\5907\Downloads\6d278070-bed8-4e41-ae7b-4a6338a2173c.dll c:\windows\assembly\tmp\U c:\windows\system32\consrv.dll c:\windows\system32\jucheck.exe c:\windows\system32\jusched.exe c:\windows\System64 . . ((((((((((((((((((((((((( Files Created from 2011-11-14 to 2011-12-14 ))))))))))))))))))))))))))))))) . . 2011-12-14 02:56 . 2011-12-14 02:56 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-12-09 13:39 . 2011-12-09 13:39 ——– d—–w- c:\programdata\McAfee Security Scan 2011-12-09 13:39 . 2011-12-09 13:39 ——– d—–w- c:\program files (x86)\McAfee Security Scan 2011-12-09 13:23 . 2011-12-09 13:29 ——– d—–w- c:\programdata\Trend Micro 2011-12-04 14:31 . 2011-12-04 14:31 ——– d—–w- c:\users\John\AppData\Local\Diagnostics 2011-11-28 19:17 . 2011-11-28 19:17 ——– d—–w- c:\program files (x86)\Common Files\Java 2011-11-28 19:11 . 2011-11-28 19:11 ——– d—–w- c:\programdata\Ask 2011-11-17 16:01 . 2011-11-17 16:01 ——– d—–w- c:\windows\en 2011-11-17 15:58 . 2011-11-17 15:58 ——– d—–w- c:\program files\Windows Live 2011-11-17 15:58 . 2011-11-17 15:58 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-11-17 15:57 . 2009-09-04 23:44 69464 —-a-w- c:\windows\SysWow64\XAPOFX1_3.dll 2011-11-17 15:57 . 2009-09-04 23:44 515416 —-a-w- c:\windows\SysWow64\XAudio2_5.dll 2011-11-17 15:57 . 2009-09-04 23:29 453456 —-a-w- c:\windows\SysWow64\d3dx10_42.dll 2011-11-17 15:57 . 2009-09-04 23:29 523088 —-a-w- c:\windows\system32\d3dx10_42.dll 2011-11-17 15:55 . 2010-08-11 05:19 3860992 —-a-w- c:\windows\system32\UIRibbon.dll 2011-11-17 15:55 . 2010-08-11 05:13 1164800 —-a-w- c:\windows\system32\UIRibbonRes.dll 2011-11-17 15:55 . 2010-08-11 04:44 2983424 —-a-w- c:\windows\SysWow64\UIRibbon.dll 2011-11-17 15:55 . 2010-08-11 04:35 1164800 —-a-w- c:\windows\SysWow64\UIRibbonRes.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-10-03 11:06 . 2010-11-17 10:32 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll 2011-10-01 03:21 . 2011-11-10 23:27 1638912 —-a-w- c:\windows\system32\mshtml.tlb 2011-10-01 02:59 . 2011-11-10 23:27 1638912 —-a-w- c:\windows\SysWow64\mshtml.tlb 2011-09-29 16:24 . 2011-11-10 23:28 1897328 —-a-w- c:\windows\system32\drivers\tcpip.sys 2011-09-29 04:09 . 2011-11-10 23:26 3141120 —-a-w- c:\windows\system32\win32k.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-15 98304] "Dell DataSafe Online"="c:\program files (x86)\Dell DataSafe Online\DataSafeOnline.exe" [2009-11-13 1807600] "Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160] "PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-08-11 140520] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-02-16 417792] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] "c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"="c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [2011-11-10 559616] "Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe" [2011-01-13 165184] . c:\users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-9-21 1316192] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Dell Remote Access.lnk - c:\windows\Installer\{F66A31D9-7831-4FBA-BA02-C411C0047CC5}\NewShortcut4_F66A31D978314FBABA02C411C0047CC5.exe [2010-2-12 53248] McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\3.0.229\SSScheduler.exe [2011-9-20 272528] . c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-9-21 1316192] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-15 135664] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-15 135664] R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.229\McCHSvc.exe [2011-09-20 237008] R3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms [2011-10-06 25072] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648] S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-01-13 705856] S3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x] . . Contents of the 'Scheduled Tasks' folder . 2011-12-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-15 17:36] . 2011-12-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-15 17:36] . 2011-11-28 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job - c:\program files\Dell Support Center\uaclauncher.exe [2011-10-06 20:32] . 2011-12-14 c:\windows\Tasks\SystemToolsDailyTest.job - c:\program files\Dell Support Center\uaclauncher.exe [2011-10-06 20:32] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Broadcom Wireless Manager UI"="c:\program files\Dell\Dell Wireless WLAN Card\WLTRAY.exe" [2009-07-17 4968960] "combofix"="c:\combofix\CF23789.3XE" [2009-07-14 344576] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://my.yahoo.com/ mLocal Page = c:\windows\SysWOW64\blank.htm TCP: DhcpNameServer = 192.168.1.254 . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Wow6432Node-HKLM-Run-DellSupportCenter - c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe Toolbar-Locked - (no file) WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020101}_0] "ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\Dell\Advanced Networking Service\hnm_svc.exe c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\program files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe c:\program files (x86)\Dell DataSafe Local Backup\Toaster.exe c:\program files (x86)\Dell Remote Access\ezi_ra.exe c:\windows\WLXPGSS.SCR . ************************************************************************** . Completion time: 2011-12-13 21:19:36 - machine was rebooted ComboFix-quarantined-files.txt 2011-12-14 03:19 . Pre-Run: 268,014,174,208 bytes free Post-Run: 269,155,274,752 bytes free . - - End Of File - - 1F09C83DF8E76F540D44BD4F81139E11 . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_11-03-05.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 3/12/2010 12:35:19 PM System Uptime: 12/13/2011 9:33:49 PM (0 hours ago) . Motherboard: Dell Inc. | | 03D1TV Processor: AMD Athlon™ Neo X2 Dual Core Processor 6850e | CPU 1 | 1800/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 283 GiB total, 250.782 GiB free. D: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Dell Wireless 1520 Wireless-N WLAN Mini-Card Device ID: PCI\VEN_14E4&DEV_4353&SUBSYS_000E1028&REV_01\4&243BA753&0&0028 Manufacturer: Broadcom Name: Dell Wireless 1520 Wireless-N WLAN Mini-Card PNP Device ID: PCI\VEN_14E4&DEV_4353&SUBSYS_000E1028&REV_01\4&243BA753&0&0028 Service: BCM43XX . ==== System Restore Points =================== . RP93: 12/13/2011 8:41:24 PM - ComboFix created restore point . ==== Hosts File Hijack ====================== . Hosts: 217.23.4.166 www.google-analytics.com. Hosts: 217.23.4.166 ad-emea.doubleclick.net. Hosts: 217.23.4.166 www.statcounter.com. Hosts: 69.72.252.254 www.google-analytics.com. Hosts: 69.72.252.254 ad-emea.doubleclick.net. Hosts: 69.72.252.254 www.statcounter.com. . ==== Installed Programs ====================== . Adobe Flash Player 10 ActiveX Adobe Reader 9.4.6 Apple Application Support Apple Software Update ATI Catalyst Control Center Banctec Service Agreement Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Common Catalyst Control Center Graphics Previews Vista Catalyst Control Center InstallProxy Catalyst Control Center Localization All ccc-core-static CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help English CCC Help French CCC Help German CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Portuguese CCC Help Spanish CCC Help Turkish Cisco EAP-FAST Module Cisco LEAP Module Cisco PEAP Module Compatibility Pack for the 2007 Office system D3DX10 Dell DataSafe Local Backup Dell DataSafe Local Backup - Support Software Dell DataSafe Online Dell Getting Started Guide Dell Remote Access Google Chrome Google Earth Google Update Helper GoToAssist 8.0.0.514 Java Auto Updater Java™ 6 Update 29 Junk Mail filter update Malwarebytes' Anti-Malware version 1.51.2.1300 McAfee Security Scan Plus Microsoft Office PowerPoint Viewer 2007 (English) Microsoft Office Word Viewer 2003 Microsoft Search Enhancement Pack Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable - KB2467175 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 Microsoft Works MSVCRT MSVCRT_amd64 PowerDVD DX QuickTime Roxio Burn Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Skins Spelling Dictionaries Support For Adobe Reader 9 Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Windows Live Communications Platform Windows Live Essentials Windows Live Installer Windows Live Mail Windows Live Messenger Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live Sync Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources Yahoo! BrowserPlus 2.9.8 . ==== Event Viewer Messages From Past Week ======== . 12/9/2011 7:45:45 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} and APPID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} to the user John-PC\John SID (S-1-5-21-1101040838-1500645861-4030747750-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. 12/9/2011 7:42:20 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D3DCB472-7261-43CE-924B-0704BD730D5F} and APPID {D3DCB472-7261-43CE-924B-0704BD730D5F} to the user John-PC\John SID (S-1-5-21-1101040838-1500645861-4030747750-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. 12/9/2011 7:42:19 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {145B4335-FE2A-4927-A040-7C35AD3180EF} and APPID {145B4335-FE2A-4927-A040-7C35AD3180EF} to the user John-PC\John SID (S-1-5-21-1101040838-1500645861-4030747750-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. 12/9/2011 7:30:00 AM, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143. 12/9/2011 7:24:32 AM, Error: Service Control Manager [7000] - The Trend Micro WFP Callout Driver service failed to start due to the following error: There are no more endpoints available from the endpoint mapper. 12/9/2011 3:20:18 PM, Error: NetBT [4321] - The name "BETTYSPC :0" could not be registered on the interface with IP address 192.168.1.5. The computer with the IP address 192.168.1.1 did not allow the name to be claimed by this computer. 12/9/2011 12:59:31 PM, Error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0. 12/8/2011 2:36:30 PM, Error: Service Control Manager [7003] - The McAfee Personal Firewall Service service depends the following service: MpsSvc. This service might not be installed. 12/6/2011 4:13:33 PM, Error: Service Control Manager [7031] - The McShield service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service. 12/13/2011 9:34:08 PM, Error: Service Control Manager [7003] - The Internet Connection Sharing (ICS) service depends the following service: BFE. This service might not be installed. 12/13/2011 9:34:05 PM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed. 12/13/2011 9:34:05 PM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed. 12/13/2011 9:34:03 PM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service. 12/13/2011 9:34:00 PM, Error: atikmdag [52236] - CPLIB :: General - Invalid Parameter 12/13/2011 9:34:00 PM, Error: atikmdag [43029] - Display is not active 12/13/2011 8:58:24 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. 12/13/2011 8:51:14 PM, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver. 12/11/2011 4:29:55 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:02:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F} 12/11/2011 4:02:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF} 12/11/2011 4:00:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030} 12/11/2011 4:00:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} 12/11/2011 4:00:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89} 12/11/2011 4:00:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E} 12/11/2011 4:00:17 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 12/11/2011 4:00:11 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC} 12/11/2011 4:00:00 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr Tcpip tdx vwififlt Wanarpv6 WfpLwf 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The TCP/IP Registry Compatibility service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start. . ==== End Of File =========================== . DDS (Ver_11-03-05.01) - NTFS_AMD64 Run by [removed] at 21:37:21.78 on Tue 12/13/2011 Internet Explorer: 8.0.7600.16385 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3839.2881 [GMT -6:00] . AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Program Files\Dell\DellDock\DockLogin.exe C:\Windows\system32\atieclxx.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe C:\Windows\System32\spoolsv.exe C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation c:\Program Files (x86)\Common Files\Dell\Advanced Networking Service\hnm_svc.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE C:\Windows\System32\vds.exe C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Program Files (x86)\Dell Remote Access\ezi_ra.exe C:\Program Files (x86)\McAfee Security Scan\3.0.229\SSScheduler.exe c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\Dell\DellDock\DellDock.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\sppsvc.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\John\Desktop\dds.scr C:\Windows\system32\conhost.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://my.yahoo.com/ BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File mRun: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m mRun: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" mRun: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe StartupFolder: C:\Users\John\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files\Dell\DellDock\DellDock.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLRE~1.LNK - c:\Windows\Installer\{F66A31D9-7831-4FBA-BA02-C411C0047CC5}\NewShortcut4_F66A31D978314FBABA02C411C0047CC5.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\3.0.229\SSScheduler.exe mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File mRun-x64: [Broadcom Wireless Manager UI] C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe Hosts: 217.23.4.166 www.google-analytics.com. Hosts: 217.23.4.166 ad-emea.doubleclick.net. Hosts: 217.23.4.166 www.statcounter.com. Hosts: 69.72.252.254 www.google-analytics.com. Hosts: 69.72.252.254 ad-emea.doubleclick.net.]Note: multiple HOSTS entries found. Please refer to Attach.txt . ============= SERVICES / DRIVERS =============== . R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-2-12 55280] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-2-12 203264] R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2009-6-9 155648] R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2010-2-12 705856] R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;C:\Windows\System32\drivers\k57nd60a.sys [2010-2-12 320040] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-3-15 135664] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-3-15 135664] S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.229\McCHSvc.exe [2011-9-20 237008] S3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;C:\Program Files\Dell Support Center\pcdsrvc_x64.pkms [2011-10-5 25072] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-2-12 221696] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-5-15 1255736] . =============== Created Last 30 ================ . 2011-12-14 03:34:15 ——– d-sh–w- C:\$RECYCLE.BIN 2011-12-14 02:41:20 518144 —-a-w- C:\Windows\SWREG.exe 2011-12-14 02:41:20 256000 —-a-w- C:\Windows\PEV.exe 2011-12-14 02:41:20 208896 —-a-w- C:\Windows\MBR.exe 2011-12-14 02:41:19 98816 —-a-w- C:\Windows\sed.exe 2011-12-09 19:22:03 ——– d—–w- C:\Users\John\AppData\Local\{C7259314-2491-4598-BA5B-0BB70A7EA0CA} 2011-12-09 19:21:42 ——– d—–w- C:\Users\John\AppData\Local\{5E8FF21E-9BF2-46B1-9DEA-7F207592A98D} 2011-12-09 13:39:31 ——– d—–w- C:\PROGRA~3\McAfee Security Scan 2011-12-09 13:39:24 ——– d—–w- C:\Program Files (x86)\McAfee Security Scan 2011-12-09 13:23:23 ——– d—–w- C:\PROGRA~3\Trend Micro 2011-12-08 21:00:28 ——– d—–w- C:\Users\John\AppData\Local\{1EA54D2F-E217-48BF-8D05-ACE2AD50A3EE} 2011-12-08 21:00:07 ——– d—–w- C:\Users\John\AppData\Local\{FA49C175-5C45-43BC-B388-9174725D958E} 2011-12-06 15:58:04 ——– d—–w- C:\Users\John\AppData\Local\{89B5EF93-9240-41A0-A4C1-CE4031C4358C} 2011-12-06 15:57:53 ——– d—–w- C:\Users\John\AppData\Local\{6534FB6F-A961-49AA-8817-00B47C75C374} 2011-12-06 15:07:30 ——– d—–w- C:\Users\John\AppData\Local\{B4CC9BC5-13E1-4B13-B2D6-2AF7A946F62A} 2011-12-06 02:57:30 ——– d—–w- C:\Users\John\AppData\Local\{A9DED283-D91E-4799-83F9-7745443DCC8C} 2011-12-06 02:56:39 ——– d—–w- C:\Users\John\AppData\Local\{7531C4CD-2CF2-41F9-A589-F6461BE843FC} 2011-12-06 00:08:40 ——– d—–w- C:\Users\John\AppData\Local\{1CD129A7-E805-48CE-AA97-BA916D989C1D} 2011-12-05 12:08:03 ——– d—–w- C:\Users\John\AppData\Local\{E776F58A-4A60-4A92-89F2-8657EA660F4A} 2011-12-05 12:07:52 ——– d—–w- C:\Users\John\AppData\Local\{FD878C04-F27F-4018-A691-92521CEEAD41} 2011-12-04 14:31:25 ——– d—–w- C:\Users\John\AppData\Local\Diagnostics 2011-12-04 13:25:14 ——– d—–w- C:\Users\John\AppData\Local\{C0ABA02E-E54A-48E9-9B10-6FBDC7B0F492} 2011-12-04 13:25:04 ——– d—–w- C:\Users\John\AppData\Local\{2DF7DA3F-33FC-42EB-9C08-F094A3DD4F69} 2011-12-03 14:05:36 ——– d—–w- C:\Users\John\AppData\Local\{BD5F3B43-4257-4C7F-84D2-0DEF1DF1E1F6} 2011-12-03 14:05:25 ——– d—–w- C:\Users\John\AppData\Local\{78902EEC-A0A5-4372-AD4A-AA71A069FD80} 2011-12-02 13:34:13 ——– d—–w- C:\Users\John\AppData\Local\{516690DB-FDA4-4612-856F-76BC2BE75323} 2011-12-02 13:33:52 ——– d—–w- C:\Users\John\AppData\Local\{A4B716CA-7DF0-4332-A8C4-F28A6A6644E2} 2011-12-02 01:33:26 ——– d—–w- C:\Users\John\AppData\Local\{31E5988A-EDD9-4738-A19A-3D50345D78D9} 2011-12-02 01:33:05 ——– d—–w- C:\Users\John\AppData\Local\{49C190CC-BFBD-463C-8C80-B3F68FDA0A96} 2011-12-01 13:32:39 ——– d—–w- C:\Users\John\AppData\Local\{E3F111CD-0653-4E2A-9CDE-0FF49257398D} 2011-12-01 13:32:17 ——– d—–w- C:\Users\John\AppData\Local\{9B842730-8686-40D5-96EE-96E90DACE025} 2011-12-01 01:31:52 ——– d—–w- C:\Users\John\AppData\Local\{29712D4E-8FC0-4D38-9FA8-8DA60DBB32D3} 2011-12-01 01:31:30 ——– d—–w- C:\Users\John\AppData\Local\{3FD383D9-8CF6-4E05-99A7-26DAD9BC089E} 2011-11-30 13:31:03 ——– d—–w- C:\Users\John\AppData\Local\{70E8AB0C-D308-43F4-977F-C9111CA24B96} 2011-11-30 13:30:41 ——– d—–w- C:\Users\John\AppData\Local\{A95776ED-8C6C-4B41-BE52-C71A1F0D15BC} 2011-11-30 00:11:14 ——– d—–w- C:\Users\John\AppData\Local\{C2AC8DC4-775F-48EB-8A51-D6B1FB9AF85F} 2011-11-30 00:10:52 ——– d—–w- C:\Users\John\AppData\Local\{2F11083A-C378-4945-81B5-2B2EA70DF934} 2011-11-29 12:10:13 ——– d—–w- C:\Users\John\AppData\Local\{42245523-67CB-4C3B-A561-0A2629385CF7} 2011-11-29 12:10:03 ——– d—–w- C:\Users\John\AppData\Local\{B687C755-250D-4023-B82A-3625DA0A71C0} 2011-11-28 19:11:28 ——– d—–w- C:\PROGRA~3\Ask 2011-11-28 13:33:49 ——– d—–w- C:\Users\John\AppData\Local\{24E30ECC-AFA5-4436-ACB0-2CDF4976A80C} 2011-11-28 13:33:28 ——– d—–w- C:\Users\John\AppData\Local\{9CE4D386-DC4F-491D-9648-5F077A56CD71} 2011-11-27 16:31:38 ——– d—–w- C:\Users\John\AppData\Local\{58A338B3-636E-4E22-A0FF-FFC7BC715F84} 2011-11-27 16:31:16 ——– d—–w- C:\Users\John\AppData\Local\{5A45BBB2-68F4-4A44-83B7-54AE82874437} 2011-11-27 04:30:52 ——– d—–w- C:\Users\John\AppData\Local\{93EBCC9B-0AED-4315-B932-BF305932A912} 2011-11-27 04:30:30 ——– d—–w- C:\Users\John\AppData\Local\{54E0601B-42D0-4F82-91C6-E77A5B226BA8} 2011-11-26 16:30:18 ——– d—–w- C:\Users\John\AppData\Local\{CE06AE7A-F543-4FAF-92C5-42B66D7F6EF6} 2011-11-26 16:29:56 ——– d—–w- C:\Users\John\AppData\Local\{698964A7-1422-42B5-806C-95FD9D13D6E5} 2011-11-26 04:29:44 ——– d—–w- C:\Users\John\AppData\Local\{CA04410B-AD0D-4204-BA86-5B32A42BD321} 2011-11-26 04:29:22 ——– d—–w- C:\Users\John\AppData\Local\{6E9C83B9-2367-426A-887B-258BD0D10D10} 2011-11-25 16:29:10 ——– d—–w- C:\Users\John\AppData\Local\{90BE8CA4-0EA7-4CDB-B813-068A8B1E46BB} 2011-11-25 16:28:47 ——– d—–w- C:\Users\John\AppData\Local\{8D813F64-5DB2-4C80-90E3-9F4C2B3ED882} 2011-11-25 04:28:35 ——– d—–w- C:\Users\John\AppData\Local\{798F2AF1-507A-4979-A0D2-D2A9CD783B2E} 2011-11-25 04:28:13 ——– d—–w- C:\Users\John\AppData\Local\{6ACA8743-F561-436E-8689-97A7077BA4DB} 2011-11-24 16:28:01 ——– d—–w- C:\Users\John\AppData\Local\{7462E5C9-CCF2-4051-AE3D-7E177DA509D4} 2011-11-24 16:27:39 ——– d—–w- C:\Users\John\AppData\Local\{1C1B0005-C68D-40EF-A09A-2EDBAD813F73} 2011-11-24 04:27:27 ——– d—–w- C:\Users\John\AppData\Local\{5132CC8F-8CCF-407B-8072-D954FE3E7C88} 2011-11-24 04:27:05 ——– d—–w- C:\Users\John\AppData\Local\{B19EF101-46AC-49AE-80DE-F9749801DBFF} 2011-11-23 16:26:51 ——– d—–w- C:\Users\John\AppData\Local\{6F49F341-F883-42A1-84F5-760D67F5C713} 2011-11-23 16:26:30 ——– d—–w- C:\Users\John\AppData\Local\{92D7B85F-F015-4D34-968B-45A21465DA6E} 2011-11-22 16:20:48 ——– d—–w- C:\Users\John\AppData\Local\{CDA934F2-55E8-44AD-B8BA-C921612A2D82} 2011-11-22 16:20:26 ——– d—–w- C:\Users\John\AppData\Local\{4B3226E3-3345-4D33-A677-A6995DA0D32A} 2011-11-21 16:45:52 ——– d—–w- C:\Users\John\AppData\Local\{F256A4FC-EEA4-42C1-86AD-6E04A2C5C554} 2011-11-21 16:45:29 ——– d—–w- C:\Users\John\AppData\Local\{D0621915-A4ED-436E-B620-E4AA4BFF6E86} 2011-11-21 12:36:46 ——– d—–w- C:\Users\John\AppData\Local\{15F1D6DE-34B2-4DEF-AA48-645DD0B06BED} 2011-11-20 13:51:43 ——– d—–w- C:\Users\John\AppData\Local\{1CD023D4-BFB7-4190-96F2-D8A4C2856819} 2011-11-20 13:51:22 ——– d—–w- C:\Users\John\AppData\Local\{A4C49CA3-1B15-4C87-90A0-7B0E85404C0F} 2011-11-20 01:15:17 ——– d—–w- C:\Users\John\AppData\Local\{B231A2D9-06F6-4A94-927B-F515F33D181F} 2011-11-20 01:14:56 ——– d—–w- C:\Users\John\AppData\Local\{52EB6204-25D0-4FF5-AF83-0A868211B82B} 2011-11-19 13:14:26 ——– d—–w- C:\Users\John\AppData\Local\{4D3D2BC2-B085-42A2-A093-4728E4075A3D} 2011-11-19 13:14:16 ——– d—–w- C:\Users\John\AppData\Local\{6EB71965-3B14-4A2A-AE9F-41C68711ADEA} 2011-11-19 03:11:25 ——– d—–w- C:\Users\John\AppData\Local\{7FA1D830-FCA6-4F39-AE81-FBDD544CA7A3} 2011-11-19 03:11:03 ——– d—–w- C:\Users\John\AppData\Local\{65B10D6F-5A69-4BAC-AC55-2B83AF0030E3} 2011-11-18 12:30:12 ——– d—–w- C:\Users\John\AppData\Local\{CAC9D137-C16E-4A32-9674-9F016CE8E8A2} 2011-11-18 12:29:51 ——– d—–w- C:\Users\John\AppData\Local\{D42869DF-00FD-411A-BA44-06D63B3D82F1} 2011-11-17 16:07:08 ——– d—–w- C:\Users\John\AppData\Local\{D1D7C3CA-D98D-4D80-B2A9-72786D1D063D} 2011-11-17 16:06:46 ——– d—–w- C:\Users\John\AppData\Local\{A9F8F6CE-9020-4630-A963-1D5751C2E98C} 2011-11-17 16:01:20 ——– d—–w- C:\Windows\en 2011-11-17 15:58:04 18328 —-a-w- C:\PROGRA~3\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-11-17 15:57:25 69464 —-a-w- C:\Windows\SysWow64\XAPOFX1_3.dll 2011-11-17 15:57:25 515416 —-a-w- C:\Windows\SysWow64\XAudio2_5.dll 2011-11-17 15:57:23 523088 —-a-w- C:\Windows\System32\d3dx10_42.dll 2011-11-17 15:57:23 453456 —-a-w- C:\Windows\SysWow64\d3dx10_42.dll 2011-11-17 15:55:19 3860992 —-a-w- C:\Windows\System32\UIRibbon.dll 2011-11-17 15:55:19 2983424 —-a-w- C:\Windows\SysWow64\UIRibbon.dll 2011-11-17 15:55:19 1164800 —-a-w- C:\Windows\SysWow64\UIRibbonRes.dll 2011-11-17 15:55:19 1164800 —-a-w- C:\Windows\System32\UIRibbonRes.dll 2011-11-17 15:51:54 ——– d—–w- C:\Users\John\AppData\Local\{F3D77095-67B5-4CDC-B7EB-42A432D77154} 2011-11-17 15:51:32 ——– d—–w- C:\Users\John\AppData\Local\{7FF39E7B-AB0C-4984-B1F0-03C63F1E93A1} 2011-11-17 13:49:36 ——– d—–w- C:\Users\John\AppData\Local\{5619BFF2-FCE6-4BCF-ADAF-9D41E686CC02} 2011-11-17 13:49:13 ——– d—–w- C:\Users\John\AppData\Local\{297A689F-2FD7-4E7A-9559-D5F400B91AC6} 2011-11-17 04:18:15 ——– d—–w- C:\Users\John\AppData\Local\{F3CB15D7-E18A-476A-99CC-5E4CE6E72F62} 2011-11-16 23:08:14 ——– d—–w- C:\Users\John\AppData\Local\{681BD86F-F468-45BC-AE7E-579FFBAEDEA2} 2011-11-16 23:07:52 ——– d—–w- C:\Users\John\AppData\Local\{6441FE2B-EFA3-4D64-B381-67DA24492B6F} 2011-11-16 18:46:19 ——– d—–w- C:\Users\John\AppData\Local\{28B608D3-BE90-414E-9F86-8E8D9482FD1D} 2011-11-16 18:45:58 ——– d—–w- C:\Users\John\AppData\Local\{B333671E-44EB-4BC2-BE93-8AFAE8F6BE80} 2011-11-16 14:04:08 ——– d—–w- C:\Users\John\AppData\Local\{B370AFB0-8CD5-4E53-937B-6CE6034674AD} 2011-11-16 14:03:46 ——– d—–w- C:\Users\John\AppData\Local\{13BFA8A3-AC5A-473E-89E9-F36F02F36F69} 2011-11-16 12:30:32 ——– d—–w- C:\Users\John\AppData\Local\{C0A145D7-5106-44A9-B878-09DEE632AE66} 2011-11-16 12:30:10 ——– d—–w- C:\Users\John\AppData\Local\{4C8D45EC-ED36-4AA8-9508-C6271A85B514} 2011-11-16 03:04:53 ——– d—–w- C:\Users\John\AppData\Local\{B87FC783-4BFB-4DEE-B775-EF202F83977A} 2011-11-16 03:04:31 ——– d—–w- C:\Users\John\AppData\Local\{5A3CAC07-EAD0-486A-91F9-DE233B138940} 2011-11-15 19:54:30 ——– d—–w- C:\Users\John\AppData\Local\{323CA349-089B-4525-84A4-1A8017402879} 2011-11-15 19:54:09 ——– d—–w- C:\Users\John\AppData\Local\{101B4FC0-9177-44B5-B666-ED1B10591491} 2011-11-15 16:54:49 ——– d—–w- C:\Users\John\AppData\Local\{FFCF2019-1931-4DBD-82D0-27BF2E9B7D67} 2011-11-15 16:54:27 ——– d—–w- C:\Users\John\AppData\Local\{F2CE0FBA-2900-4663-AEEE-97DD24C77744} 2011-11-15 13:30:52 ——– d—–w- C:\Users\John\AppData\Local\{60090BE5-F091-425D-8FBA-2286C226402B} 2011-11-15 13:30:31 ——– d—–w- C:\Users\John\AppData\Local\{54AA73D4-035F-49EF-B5E1-F87F7FCEB164} 2011-11-15 12:44:55 ——– d—–w- C:\Users\John\AppData\Local\{923C3C22-C7BD-43D3-972F-D393D739629D} 2011-11-15 12:44:44 ——– d—–w- C:\Users\John\AppData\Local\{E61F1C92-6514-4199-A771-613E51A6218B} 2011-11-14 15:31:28 ——– d—–w- C:\Users\John\AppData\Local\{E3CC52AD-1823-472A-9538-63767AB85A3E} 2011-11-14 15:31:06 ——– d—–w- C:\Users\John\AppData\Local\{5FF6FA52-DA5D-402D-B59F-1B6BF1C80726} 2011-11-14 13:22:45 ——– d—–w- C:\Users\John\AppData\Local\{A8CF3FD2-17D0-47A7-BFFA-5C642CA5170F} 2011-11-14 13:22:35 ——– d—–w- C:\Users\John\AppData\Local\{65AC97B8-E9EC-4D0F-A688-2489EBEA753F} . ==================== Find3M ==================== . 2011-10-03 11:06:03 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2011-10-01 03:21:20 1638912 —-a-w- C:\Windows\System32\mshtml.tlb 2011-10-01 02:59:14 1638912 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2011-09-29 16:24:44 1897328 —-a-w- C:\Windows\System32\drivers\tcpip.sys 2011-09-29 04:09:30 3141120 —-a-w- C:\Windows\System32\win32k.sys . ============= FINISH: 21:38:13.51 ===============

Hi Blade81,
I was unsuccessful with HostXpert. I ran it as administrator and both times I tried to run it, got the message that it was a hidden file and system file and could not be changed. I had gone to all files and checked show hidden files, but that did not make a difference. I got a final message "ERROR: Cannot create file C:\windows\system32\DRIVERS\ETC\hosts"

I removed Adobe and Flash as you requested and ran Combofix with the code from the textbox. When I ran ESET, I had one browser redirection- to a normal, but unintended website. ESET is essentially clean other than finding a fill in the ComboFix quarantine. Here is the new Combofix report, ESET report, and new DDS.

ComboFix 11-12-13.03 - John 12/14/2011 13:04:32.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3839.2676 [GMT -6:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\John\Desktop\CFScript.txt
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-11-14 to 2011-12-14 )))))))))))))))))))))))))))))))
.
.
2011-12-14 19:37 . 2011-12-14 19:37 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-12-14 18:54 . 2011-12-14 18:54 ——– d—–w- C:\HostsXpert
2011-12-09 13:39 . 2011-12-09 13:39 ——– d—–w- c:\programdata\McAfee Security Scan
2011-12-09 13:39 . 2011-12-09 13:39 ——– d—–w- c:\program files (x86)\McAfee Security Scan
2011-12-09 13:23 . 2011-12-09 13:29 ——– d—–w- c:\programdata\Trend Micro
2011-12-04 14:31 . 2011-12-04 14:31 ——– d—–w- c:\users\John\AppData\Local\Diagnostics
2011-11-28 19:17 . 2011-11-28 19:17 ——– d—–w- c:\program files (x86)\Common Files\Java
2011-11-28 19:11 . 2011-11-28 19:11 ——– d—–w- c:\programdata\Ask
2011-11-17 16:01 . 2011-11-17 16:01 ——– d—–w- c:\windows\en
2011-11-17 15:58 . 2011-11-17 15:58 ——– d—–w- c:\program files\Windows Live
2011-11-17 15:58 . 2011-11-17 15:58 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-11-17 15:57 . 2009-09-04 23:44 69464 —-a-w- c:\windows\SysWow64\XAPOFX1_3.dll
2011-11-17 15:57 . 2009-09-04 23:44 515416 —-a-w- c:\windows\SysWow64\XAudio2_5.dll
2011-11-17 15:57 . 2009-09-04 23:29 453456 —-a-w- c:\windows\SysWow64\d3dx10_42.dll
2011-11-17 15:57 . 2009-09-04 23:29 523088 —-a-w- c:\windows\system32\d3dx10_42.dll
2011-11-17 15:55 . 2010-08-11 05:19 3860992 —-a-w- c:\windows\system32\UIRibbon.dll
2011-11-17 15:55 . 2010-08-11 05:13 1164800 —-a-w- c:\windows\system32\UIRibbonRes.dll
2011-11-17 15:55 . 2010-08-11 04:44 2983424 —-a-w- c:\windows\SysWow64\UIRibbon.dll
2011-11-17 15:55 . 2010-08-11 04:35 1164800 —-a-w- c:\windows\SysWow64\UIRibbonRes.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-03 11:06 . 2010-11-17 10:32 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll
2011-10-01 03:21 . 2011-11-10 23:27 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-10-01 02:59 . 2011-11-10 23:27 1638912 —-a-w- c:\windows\SysWow64\mshtml.tlb
2011-09-29 16:24 . 2011-11-10 23:28 1897328 —-a-w- c:\windows\system32\drivers\tcpip.sys
2011-09-29 04:09 . 2011-11-10 23:26 3141120 —-a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-12-14_03.00.10 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 05:10 . 2011-12-14 02:37 41012 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-12-14 18:43 41012 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-03-13 14:07 . 2011-12-14 18:43 14848 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1101040838-1500645861-4030747750-1001_UserData.bin
+ 2010-03-12 21:10 . 2011-12-14 18:43 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-03-12 21:10 . 2011-12-14 02:37 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-03-12 21:10 . 2011-12-14 02:37 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-03-12 21:10 . 2011-12-14 18:43 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-03-12 21:10 . 2011-12-14 18:43 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-03-12 21:10 . 2011-12-14 02:37 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-03-12 21:06 . 2011-12-14 19:14 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-03-12 21:06 . 2011-12-14 03:00 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-03-12 21:06 . 2011-12-14 19:14 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-03-12 21:06 . 2011-12-14 03:00 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-12-17 03:43 . 2011-12-14 03:27 3370 c:\windows\system32\wdi\ERCQueuedResolutions.dat
- 2011-12-14 02:59 . 2011-12-14 02:59 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-12-14 18:41 . 2011-12-14 18:41 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-12-14 18:41 . 2011-12-14 18:41 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-12-14 02:59 . 2011-12-14 02:59 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 02:36 . 2011-12-14 02:41 623940 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-12-14 03:41 623940 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-12-14 03:41 106316 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2011-12-14 02:41 106316 c:\windows\system32\perfc009.dat
- 2009-07-14 05:01 . 2011-12-14 02:58 284136 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-12-14 03:59 284136 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-15 98304]
"Dell DataSafe Online"="c:\program files (x86)\Dell DataSafe Online\DataSafeOnline.exe" [2009-11-13 1807600]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160]
"PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-08-11 140520]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-02-16 417792]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"="c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [2011-11-10 559616]
"Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe" [2011-01-13 165184]
.
c:\users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-9-21 1316192]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Remote Access.lnk - c:\windows\Installer\{F66A31D9-7831-4FBA-BA02-C411C0047CC5}\NewShortcut4_F66A31D978314FBABA02C411C0047CC5.exe [2010-2-12 53248]
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\3.0.229\SSScheduler.exe [2011-9-20 272528]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-9-21 1316192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-15 135664]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-15 135664]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.229\McCHSvc.exe [2011-09-20 237008]
R3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms [2011-10-06 25072]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-01-13 705856]
S3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-15 17:36]
.
2011-12-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-15 17:36]
.
2011-11-28 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-10-06 20:32]
.
2011-12-14 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-10-06 20:32]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\program files\Dell\Dell Wireless WLAN Card\WLTRAY.exe" [2009-07-17 4968960]
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://my.yahoo.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.1.254
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020101}_0]
"ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-12-14 13:58:17
ComboFix-quarantined-files.txt 2011-12-14 19:58
ComboFix2.txt 2011-12-14 03:19
.
Pre-Run: 269,244,895,232 bytes free
Post-Run: 269,195,866,112 bytes free
.
- - End Of File - - EA368ACF04B18DFA035936221E2A3E50

ESET SCAN LOG
Found 1 infected file
C:\Qoobox\Quarantine\C\Windows\System32\consrv.dll.vir Win64/Sirefef.E trojan

.
DDS (Ver_11-03-05.01) - NTFS_AMD64
Run by [removed] at 18:27:49.48 on Wed 12/14/2011
Internet Explorer: 8.0.7600.16385
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3839.2956 [GMT -6:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
c:\Program Files (x86)\Common Files\Dell\Advanced Networking Service\hnm_svc.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
C:\Windows\System32\vds.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE
C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files (x86)\Dell Remote Access\ezi_ra.exe
C:\Program Files (x86)\McAfee Security Scan\3.0.229\SSScheduler.exe
C:\Program Files\Dell\DellDock\DellDock.exe
c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\John\Desktop\dds.scr
C:\Windows\system32\conhost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://my.yahoo.com/
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
mRun: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m
mRun: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"
mRun: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"
mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe
StartupFolder: C:\Users\John\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files\Dell\DellDock\DellDock.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLRE~1.LNK - c:\Windows\Installer\{F66A31D9-7831-4FBA-BA02-C411C0047CC5}\NewShortcut4_F66A31D978314FBABA02C411C0047CC5.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\3.0.229\SSScheduler.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
mRun-x64: [Broadcom Wireless Manager UI] C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe
Hosts: 217.23.4.166 www.google-analytics.com.
Hosts: 217.23.4.166 ad-emea.doubleclick.net.
Hosts: 217.23.4.166 www.statcounter.com.
Hosts: 69.72.252.254 www.google-analytics.com.
Hosts: 69.72.252.254 ad-emea.doubleclick.net.
.
Note: multiple HOSTS entries found. Please refer to Attach.txt
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-2-12 55280]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-2-12 203264]
R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2009-6-9 155648]
R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2010-2-12 705856]
R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;C:\Windows\System32\drivers\k57nd60a.sys [2010-2-12 320040]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-3-15 135664]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-3-15 135664]
S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.229\McCHSvc.exe [2011-9-20 237008]
S3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;C:\Program Files\Dell Support Center\pcdsrvc_x64.pkms [2011-10-5 25072]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-2-12 221696]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-5-15 1255736]
.
=============== Created Last 30 ================
.
2011-12-14 20:21:43 ——– d—–w- C:\Program Files (x86)\ESET
2011-12-14 20:10:51 ——– d—–w- C:\Users\John\AppData\Local\ElevatedDiagnostics
2011-12-14 20:07:44 ——– d-sh–w- C:\$RECYCLE.BIN
2011-12-14 18:54:12 ——– d—–w- C:\HostsXpert
2011-12-14 02:41:20 518144 —-a-w- C:\Windows\SWREG.exe
2011-12-14 02:41:20 256000 —-a-w- C:\Windows\PEV.exe
2011-12-14 02:41:20 208896 —-a-w- C:\Windows\MBR.exe
2011-12-14 02:41:19 98816 —-a-w- C:\Windows\sed.exe
2011-12-09 19:22:03 ——– d—–w- C:\Users\John\AppData\Local\{C7259314-2491-4598-BA5B-0BB70A7EA0CA}
2011-12-09 19:21:42 ——– d—–w- C:\Users\John\AppData\Local\{5E8FF21E-9BF2-46B1-9DEA-7F207592A98D}
2011-12-09 13:39:31 ——– d—–w- C:\PROGRA~3\McAfee Security Scan
2011-12-09 13:39:24 ——– d—–w- C:\Program Files (x86)\McAfee Security Scan
2011-12-09 13:23:23 ——– d—–w- C:\PROGRA~3\Trend Micro
2011-12-08 21:00:28 ——– d—–w- C:\Users\John\AppData\Local\{1EA54D2F-E217-48BF-8D05-ACE2AD50A3EE}
2011-12-08 21:00:07 ——– d—–w- C:\Users\John\AppData\Local\{FA49C175-5C45-43BC-B388-9174725D958E}
2011-12-06 15:58:04 ——– d—–w- C:\Users\John\AppData\Local\{89B5EF93-9240-41A0-A4C1-CE4031C4358C}
2011-12-06 15:57:53 ——– d—–w- C:\Users\John\AppData\Local\{6534FB6F-A961-49AA-8817-00B47C75C374}
2011-12-06 15:07:30 ——– d—–w- C:\Users\John\AppData\Local\{B4CC9BC5-13E1-4B13-B2D6-2AF7A946F62A}
2011-12-06 02:57:30 ——– d—–w- C:\Users\John\AppData\Local\{A9DED283-D91E-4799-83F9-7745443DCC8C}
2011-12-06 02:56:39 ——– d—–w- C:\Users\John\AppData\Local\{7531C4CD-2CF2-41F9-A589-F6461BE843FC}
2011-12-06 00:08:40 ——– d—–w- C:\Users\John\AppData\Local\{1CD129A7-E805-48CE-AA97-BA916D989C1D}
2011-12-05 12:08:03 ——– d—–w- C:\Users\John\AppData\Local\{E776F58A-4A60-4A92-89F2-8657EA660F4A}
2011-12-05 12:07:52 ——– d—–w- C:\Users\John\AppData\Local\{FD878C04-F27F-4018-A691-92521CEEAD41}
2011-12-04 14:31:25 ——– d—–w- C:\Users\John\AppData\Local\Diagnostics
2011-12-04 13:25:14 ——– d—–w- C:\Users\John\AppData\Local\{C0ABA02E-E54A-48E9-9B10-6FBDC7B0F492}
2011-12-04 13:25:04 ——– d—–w- C:\Users\John\AppData\Local\{2DF7DA3F-33FC-42EB-9C08-F094A3DD4F69}
2011-12-03 14:05:36 ——– d—–w- C:\Users\John\AppData\Local\{BD5F3B43-4257-4C7F-84D2-0DEF1DF1E1F6}
2011-12-03 14:05:25 ——– d—–w- C:\Users\John\AppData\Local\{78902EEC-A0A5-4372-AD4A-AA71A069FD80}
2011-12-02 13:34:13 ——– d—–w- C:\Users\John\AppData\Local\{516690DB-FDA4-4612-856F-76BC2BE75323}
2011-12-02 13:33:52 ——– d—–w- C:\Users\John\AppData\Local\{A4B716CA-7DF0-4332-A8C4-F28A6A6644E2}
2011-12-02 01:33:26 ——– d—–w- C:\Users\John\AppData\Local\{31E5988A-EDD9-4738-A19A-3D50345D78D9}
2011-12-02 01:33:05 ——– d—–w- C:\Users\John\AppData\Local\{49C190CC-BFBD-463C-8C80-B3F68FDA0A96}
2011-12-01 13:32:39 ——– d—–w- C:\Users\John\AppData\Local\{E3F111CD-0653-4E2A-9CDE-0FF49257398D}
2011-12-01 13:32:17 ——– d—–w- C:\Users\John\AppData\Local\{9B842730-8686-40D5-96EE-96E90DACE025}
2011-12-01 01:31:52 ——– d—–w- C:\Users\John\AppData\Local\{29712D4E-8FC0-4D38-9FA8-8DA60DBB32D3}
2011-12-01 01:31:30 ——– d—–w- C:\Users\John\AppData\Local\{3FD383D9-8CF6-4E05-99A7-26DAD9BC089E}
2011-11-30 13:31:03 ——– d—–w- C:\Users\John\AppData\Local\{70E8AB0C-D308-43F4-977F-C9111CA24B96}
2011-11-30 13:30:41 ——– d—–w- C:\Users\John\AppData\Local\{A95776ED-8C6C-4B41-BE52-C71A1F0D15BC}
2011-11-30 00:11:14 ——– d—–w- C:\Users\John\AppData\Local\{C2AC8DC4-775F-48EB-8A51-D6B1FB9AF85F}
2011-11-30 00:10:52 ——– d—–w- C:\Users\John\AppData\Local\{2F11083A-C378-4945-81B5-2B2EA70DF934}
2011-11-29 12:10:13 ——– d—–w- C:\Users\John\AppData\Local\{42245523-67CB-4C3B-A561-0A2629385CF7}
2011-11-29 12:10:03 ——– d—–w- C:\Users\John\AppData\Local\{B687C755-250D-4023-B82A-3625DA0A71C0}
2011-11-28 19:11:28 ——– d—–w- C:\PROGRA~3\Ask
2011-11-28 13:33:49 ——– d—–w- C:\Users\John\AppData\Local\{24E30ECC-AFA5-4436-ACB0-2CDF4976A80C}
2011-11-28 13:33:28 ——– d—–w- C:\Users\John\AppData\Local\{9CE4D386-DC4F-491D-9648-5F077A56CD71}
2011-11-27 16:31:38 ——– d—–w- C:\Users\John\AppData\Local\{58A338B3-636E-4E22-A0FF-FFC7BC715F84}
2011-11-27 16:31:16 ——– d—–w- C:\Users\John\AppData\Local\{5A45BBB2-68F4-4A44-83B7-54AE82874437}
2011-11-27 04:30:52 ——– d—–w- C:\Users\John\AppData\Local\{93EBCC9B-0AED-4315-B932-BF305932A912}
2011-11-27 04:30:30 ——– d—–w- C:\Users\John\AppData\Local\{54E0601B-42D0-4F82-91C6-E77A5B226BA8}
2011-11-26 16:30:18 ——– d—–w- C:\Users\John\AppData\Local\{CE06AE7A-F543-4FAF-92C5-42B66D7F6EF6}
2011-11-26 16:29:56 ——– d—–w- C:\Users\John\AppData\Local\{698964A7-1422-42B5-806C-95FD9D13D6E5}
2011-11-26 04:29:44 ——– d—–w- C:\Users\John\AppData\Local\{CA04410B-AD0D-4204-BA86-5B32A42BD321}
2011-11-26 04:29:22 ——– d—–w- C:\Users\John\AppData\Local\{6E9C83B9-2367-426A-887B-258BD0D10D10}
2011-11-25 16:29:10 ——– d—–w- C:\Users\John\AppData\Local\{90BE8CA4-0EA7-4CDB-B813-068A8B1E46BB}
2011-11-25 16:28:47 ——– d—–w- C:\Users\John\AppData\Local\{8D813F64-5DB2-4C80-90E3-9F4C2B3ED882}
2011-11-25 04:28:35 ——– d—–w- C:\Users\John\AppData\Local\{798F2AF1-507A-4979-A0D2-D2A9CD783B2E}
2011-11-25 04:28:13 ——– d—–w- C:\Users\John\AppData\Local\{6ACA8743-F561-436E-8689-97A7077BA4DB}
2011-11-24 16:28:01 ——– d—–w- C:\Users\John\AppData\Local\{7462E5C9-CCF2-4051-AE3D-7E177DA509D4}
2011-11-24 16:27:39 ——– d—–w- C:\Users\John\AppData\Local\{1C1B0005-C68D-40EF-A09A-2EDBAD813F73}
2011-11-24 04:27:27 ——– d—–w- C:\Users\John\AppData\Local\{5132CC8F-8CCF-407B-8072-D954FE3E7C88}
2011-11-24 04:27:05 ——– d—–w- C:\Users\John\AppData\Local\{B19EF101-46AC-49AE-80DE-F9749801DBFF}
2011-11-23 16:26:51 ——– d—–w- C:\Users\John\AppData\Local\{6F49F341-F883-42A1-84F5-760D67F5C713}
2011-11-23 16:26:30 ——– d—–w- C:\Users\John\AppData\Local\{92D7B85F-F015-4D34-968B-45A21465DA6E}
2011-11-22 16:20:48 ——– d—–w- C:\Users\John\AppData\Local\{CDA934F2-55E8-44AD-B8BA-C921612A2D82}
2011-11-22 16:20:26 ——– d—–w- C:\Users\John\AppData\Local\{4B3226E3-3345-4D33-A677-A6995DA0D32A}
2011-11-21 16:45:52 ——– d—–w- C:\Users\John\AppData\Local\{F256A4FC-EEA4-42C1-86AD-6E04A2C5C554}
2011-11-21 16:45:29 ——– d—–w- C:\Users\John\AppData\Local\{D0621915-A4ED-436E-B620-E4AA4BFF6E86}
2011-11-21 12:36:46 ——– d—–w- C:\Users\John\AppData\Local\{15F1D6DE-34B2-4DEF-AA48-645DD0B06BED}
2011-11-20 13:51:43 ——– d—–w- C:\Users\John\AppData\Local\{1CD023D4-BFB7-4190-96F2-D8A4C2856819}
2011-11-20 13:51:22 ——– d—–w- C:\Users\John\AppData\Local\{A4C49CA3-1B15-4C87-90A0-7B0E85404C0F}
2011-11-20 01:15:17 ——– d—–w- C:\Users\John\AppData\Local\{B231A2D9-06F6-4A94-927B-F515F33D181F}
2011-11-20 01:14:56 ——– d—–w- C:\Users\John\AppData\Local\{52EB6204-25D0-4FF5-AF83-0A868211B82B}
2011-11-19 13:14:26 ——– d—–w- C:\Users\John\AppData\Local\{4D3D2BC2-B085-42A2-A093-4728E4075A3D}
2011-11-19 13:14:16 ——– d—–w- C:\Users\John\AppData\Local\{6EB71965-3B14-4A2A-AE9F-41C68711ADEA}
2011-11-19 03:11:25 ——– d—–w- C:\Users\John\AppData\Local\{7FA1D830-FCA6-4F39-AE81-FBDD544CA7A3}
2011-11-19 03:11:03 ——– d—–w- C:\Users\John\AppData\Local\{65B10D6F-5A69-4BAC-AC55-2B83AF0030E3}
2011-11-18 12:30:12 ——– d—–w- C:\Users\John\AppData\Local\{CAC9D137-C16E-4A32-9674-9F016CE8E8A2}
2011-11-18 12:29:51 ——– d—–w- C:\Users\John\AppData\Local\{D42869DF-00FD-411A-BA44-06D63B3D82F1}
2011-11-17 16:07:08 ——– d—–w- C:\Users\John\AppData\Local\{D1D7C3CA-D98D-4D80-B2A9-72786D1D063D}
2011-11-17 16:06:46 ——– d—–w- C:\Users\John\AppData\Local\{A9F8F6CE-9020-4630-A963-1D5751C2E98C}
2011-11-17 16:01:20 ——– d—–w- C:\Windows\en
2011-11-17 15:58:04 18328 —-a-w- C:\PROGRA~3\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-11-17 15:57:25 69464 —-a-w- C:\Windows\SysWow64\XAPOFX1_3.dll
2011-11-17 15:57:25 515416 —-a-w- C:\Windows\SysWow64\XAudio2_5.dll
2011-11-17 15:57:23 523088 —-a-w- C:\Windows\System32\d3dx10_42.dll
2011-11-17 15:57:23 453456 —-a-w- C:\Windows\SysWow64\d3dx10_42.dll
2011-11-17 15:55:19 3860992 —-a-w- C:\Windows\System32\UIRibbon.dll
2011-11-17 15:55:19 2983424 —-a-w- C:\Windows\SysWow64\UIRibbon.dll
2011-11-17 15:55:19 1164800 —-a-w- C:\Windows\SysWow64\UIRibbonRes.dll
2011-11-17 15:55:19 1164800 —-a-w- C:\Windows\System32\UIRibbonRes.dll
2011-11-17 15:51:54 ——– d—–w- C:\Users\John\AppData\Local\{F3D77095-67B5-4CDC-B7EB-42A432D77154}
2011-11-17 15:51:32 ——– d—–w- C:\Users\John\AppData\Local\{7FF39E7B-AB0C-4984-B1F0-03C63F1E93A1}
2011-11-17 13:49:36 ——– d—–w- C:\Users\John\AppData\Local\{5619BFF2-FCE6-4BCF-ADAF-9D41E686CC02}
2011-11-17 13:49:13 ——– d—–w- C:\Users\John\AppData\Local\{297A689F-2FD7-4E7A-9559-D5F400B91AC6}
2011-11-17 04:18:15 ——– d—–w- C:\Users\John\AppData\Local\{F3CB15D7-E18A-476A-99CC-5E4CE6E72F62}
2011-11-16 23:08:14 ——– d—–w- C:\Users\John\AppData\Local\{681BD86F-F468-45BC-AE7E-579FFBAEDEA2}
2011-11-16 23:07:52 ——– d—–w- C:\Users\John\AppData\Local\{6441FE2B-EFA3-4D64-B381-67DA24492B6F}
2011-11-16 18:46:19 ——– d—–w- C:\Users\John\AppData\Local\{28B608D3-BE90-414E-9F86-8E8D9482FD1D}
2011-11-16 18:45:58 ——– d—–w- C:\Users\John\AppData\Local\{B333671E-44EB-4BC2-BE93-8AFAE8F6BE80}
2011-11-16 14:04:08 ——– d—–w- C:\Users\John\AppData\Local\{B370AFB0-8CD5-4E53-937B-6CE6034674AD}
2011-11-16 14:03:46 ——– d—–w- C:\Users\John\AppData\Local\{13BFA8A3-AC5A-473E-89E9-F36F02F36F69}
2011-11-16 12:30:32 ——– d—–w- C:\Users\John\AppData\Local\{C0A145D7-5106-44A9-B878-09DEE632AE66}
2011-11-16 12:30:10 ——– d—–w- C:\Users\John\AppData\Local\{4C8D45EC-ED36-4AA8-9508-C6271A85B514}
2011-11-16 03:04:53 ——– d—–w- C:\Users\John\AppData\Local\{B87FC783-4BFB-4DEE-B775-EF202F83977A}
2011-11-16 03:04:31 ——– d—–w- C:\Users\John\AppData\Local\{5A3CAC07-EAD0-486A-91F9-DE233B138940}
2011-11-15 19:54:30 ——– d—–w- C:\Users\John\AppData\Local\{323CA349-089B-4525-84A4-1A8017402879}
2011-11-15 19:54:09 ——– d—–w- C:\Users\John\AppData\Local\{101B4FC0-9177-44B5-B666-ED1B10591491}
2011-11-15 16:54:49 ——– d—–w- C:\Users\John\AppData\Local\{FFCF2019-1931-4DBD-82D0-27BF2E9B7D67}
2011-11-15 16:54:27 ——– d—–w- C:\Users\John\AppData\Local\{F2CE0FBA-2900-4663-AEEE-97DD24C77744}
2011-11-15 13:30:52 ——– d—–w- C:\Users\John\AppData\Local\{60090BE5-F091-425D-8FBA-2286C226402B}
2011-11-15 13:30:31 ——– d—–w- C:\Users\John\AppData\Local\{54AA73D4-035F-49EF-B5E1-F87F7FCEB164}
2011-11-15 12:44:55 ——– d—–w- C:\Users\John\AppData\Local\{923C3C22-C7BD-43D3-972F-D393D739629D}
2011-11-15 12:44:44 ——– d—–w- C:\Users\John\AppData\Local\{E61F1C92-6514-4199-A771-613E51A6218B}
.
==================== Find3M ====================
.
2011-10-03 11:06:03 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll
2011-10-01 03:21:20 1638912 —-a-w- C:\Windows\System32\mshtml.tlb
2011-10-01 02:59:14 1638912 —-a-w- C:\Windows\SysWow64\mshtml.tlb
2011-09-29 16:24:44 1897328 —-a-w- C:\Windows\System32\drivers\tcpip.sys
2011-09-29 04:09:30 3141120 —-a-w- C:\Windows\System32\win32k.sys
.
============= FINISH: 18:29:14.21 ===============

I've run the Combofix fix. Computer seems to be running well, other than showing a script error whenever I'm on a WTT page that shows how to drag files into combofix. ComboFix 11-12-15.02 - John 12/15/2011 10:58:56.3.2 - x64 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3839.2650 [GMT -6:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\John\Desktop\CFScript.txt AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C} SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\windows\system32\DRIVERS\ETC\hosts" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\system32\DRIVERS\ETC\hosts . . ((((((((((((((((((((((((( Files Created from 2011-11-15 to 2011-12-15 ))))))))))))))))))))))))))))))) . . 2011-12-15 17:09 . 2011-12-15 17:09 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-12-14 20:21 . 2011-12-14 20:21 ——– d—–w- c:\program files (x86)\ESET 2011-12-14 20:10 . 2011-12-14 20:10 ——– d—–w- c:\users\John\AppData\Local\ElevatedDiagnostics 2011-12-14 20:05 . 2011-12-14 20:05 ——– d—–w- c:\windows\system32\Macromed 2011-12-14 18:54 . 2011-12-14 18:54 ——– d—–w- C:\HostsXpert 2011-12-09 13:39 . 2011-12-09 13:39 ——– d—–w- c:\programdata\McAfee Security Scan 2011-12-09 13:39 . 2011-12-09 13:39 ——– d—–w- c:\program files (x86)\McAfee Security Scan 2011-12-09 13:23 . 2011-12-09 13:29 ——– d—–w- c:\programdata\Trend Micro 2011-12-04 14:31 . 2011-12-04 14:31 ——– d—–w- c:\users\John\AppData\Local\Diagnostics 2011-11-28 19:17 . 2011-11-28 19:17 ——– d—–w- c:\program files (x86)\Common Files\Java 2011-11-28 19:11 . 2011-11-28 19:11 ——– d—–w- c:\programdata\Ask 2011-11-17 16:01 . 2011-11-17 16:01 ——– d—–w- c:\windows\en 2011-11-17 15:58 . 2011-11-17 15:58 ——– d—–w- c:\program files\Windows Live 2011-11-17 15:58 . 2011-11-17 15:58 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-11-17 15:57 . 2009-09-04 23:44 69464 —-a-w- c:\windows\SysWow64\XAPOFX1_3.dll 2011-11-17 15:57 . 2009-09-04 23:44 515416 —-a-w- c:\windows\SysWow64\XAudio2_5.dll 2011-11-17 15:57 . 2009-09-04 23:29 453456 —-a-w- c:\windows\SysWow64\d3dx10_42.dll 2011-11-17 15:57 . 2009-09-04 23:29 523088 —-a-w- c:\windows\system32\d3dx10_42.dll 2011-11-17 15:55 . 2010-08-11 05:19 3860992 —-a-w- c:\windows\system32\UIRibbon.dll 2011-11-17 15:55 . 2010-08-11 05:13 1164800 —-a-w- c:\windows\system32\UIRibbonRes.dll 2011-11-17 15:55 . 2010-08-11 04:44 2983424 —-a-w- c:\windows\SysWow64\UIRibbon.dll 2011-11-17 15:55 . 2010-08-11 04:35 1164800 —-a-w- c:\windows\SysWow64\UIRibbonRes.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-10-03 11:06 . 2010-11-17 10:32 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll 2011-10-01 03:21 . 2011-11-10 23:27 1638912 —-a-w- c:\windows\system32\mshtml.tlb 2011-10-01 02:59 . 2011-11-10 23:27 1638912 —-a-w- c:\windows\SysWow64\mshtml.tlb 2011-09-29 16:24 . 2011-11-10 23:28 1897328 —-a-w- c:\windows\system32\drivers\tcpip.sys 2011-09-29 04:09 . 2011-11-10 23:26 3141120 —-a-w- c:\windows\system32\win32k.sys . . ((((((((((((((((((((((((((((( SnapShot@2011-12-14_03.00.10 ))))))))))))))))))))))))))))))))))))))))) . + 2010-02-13 01:01 . 2011-12-15 16:34 37282 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin - 2009-07-14 05:10 . 2011-12-14 02:37 41012 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2011-12-15 16:34 41012 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2010-03-13 14:07 . 2011-12-15 16:34 14892 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1101040838-1500645861-4030747750-1001_UserData.bin + 2010-03-12 21:10 . 2011-12-15 16:35 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2010-03-12 21:10 . 2011-12-14 02:37 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2010-03-12 21:10 . 2011-12-14 02:37 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2010-03-12 21:10 . 2011-12-15 16:35 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2010-03-12 21:10 . 2011-12-15 16:35 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2010-03-12 21:10 . 2011-12-14 02:37 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2010-03-12 21:06 . 2011-12-14 03:00 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-03-12 21:06 . 2011-12-15 17:09 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-03-12 21:06 . 2011-12-15 17:09 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2010-03-12 21:06 . 2011-12-14 03:00 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2010-12-17 03:43 . 2011-12-14 03:27 3370 c:\windows\system32\wdi\ERCQueuedResolutions.dat + 2011-12-14 20:13 . 2011-12-14 20:13 9560 c:\windows\system32\NetworkList\Icons\{98FFC717-BEF9-4540-9902-429765BDB755}_48.bin + 2011-12-14 20:13 . 2011-12-14 20:13 4280 c:\windows\system32\NetworkList\Icons\{98FFC717-BEF9-4540-9902-429765BDB755}_32.bin + 2011-12-14 20:13 . 2011-12-14 20:13 2456 c:\windows\system32\NetworkList\Icons\{98FFC717-BEF9-4540-9902-429765BDB755}_24.bin - 2011-12-14 02:59 . 2011-12-14 02:59 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2011-12-15 16:32 . 2011-12-15 16:32 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2011-12-15 16:32 . 2011-12-15 16:32 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2011-12-14 02:59 . 2011-12-14 02:59 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-07-14 02:36 . 2011-12-15 16:43 623940 c:\windows\system32\perfh009.dat - 2009-07-14 02:36 . 2011-12-14 02:41 623940 c:\windows\system32\perfh009.dat + 2009-07-14 02:36 . 2011-12-15 16:43 106316 c:\windows\system32\perfc009.dat - 2009-07-14 02:36 . 2011-12-14 02:41 106316 c:\windows\system32\perfc009.dat - 2009-07-14 05:01 . 2011-12-14 02:58 284136 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 05:01 . 2011-12-15 00:35 284136 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-15 98304] "Dell DataSafe Online"="c:\program files (x86)\Dell DataSafe Online\DataSafeOnline.exe" [2009-11-13 1807600] "Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160] "PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-08-11 140520] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-02-16 417792] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] "c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"="c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [2011-11-10 559616] "Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe" [2011-01-13 165184] . c:\users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-9-21 1316192] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Dell Remote Access.lnk - c:\windows\Installer\{F66A31D9-7831-4FBA-BA02-C411C0047CC5}\NewShortcut4_F66A31D978314FBABA02C411C0047CC5.exe [2010-2-12 53248] McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\3.0.229\SSScheduler.exe [2011-9-20 272528] . c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-9-21 1316192] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-15 135664] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-15 135664] R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.229\McCHSvc.exe [2011-09-20 237008] R3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms [2011-10-06 25072] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648] S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-01-13 705856] S3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x] . . Contents of the 'Scheduled Tasks' folder . 2011-12-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-15 17:36] . 2011-12-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-15 17:36] . 2011-11-28 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job - c:\program files\Dell Support Center\uaclauncher.exe [2011-10-06 20:32] . 2011-12-15 c:\windows\Tasks\SystemToolsDailyTest.job - c:\program files\Dell Support Center\uaclauncher.exe [2011-10-06 20:32] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Broadcom Wireless Manager UI"="c:\program files\Dell\Dell Wireless WLAN Card\WLTRAY.exe" [2009-07-17 4968960] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://my.yahoo.com/ mLocal Page = c:\windows\SysWOW64\blank.htm TCP: DhcpNameServer = [removed] [removed] . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020101}_0] "ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2011-12-15 11:30:28 ComboFix-quarantined-files.txt 2011-12-15 17:30 ComboFix2.txt 2011-12-14 19:58 ComboFix3.txt 2011-12-14 03:19 . Pre-Run: 268,963,491,840 bytes free Post-Run: 268,692,099,072 bytes free . - - End Of File - - 76A086051A7DE79BD8526226088FA5C5 . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_11-03-05.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 3/12/2010 12:35:19 PM System Uptime: 12/15/2011 10:32:28 AM (1 hours ago) . Motherboard: Dell Inc. | | 03D1TV Processor: AMD Athlon™ Neo X2 Dual Core Processor 6850e | CPU 1 | 1800/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 283 GiB total, 250.301 GiB free. D: is CDROM () E: is Removable . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP93: 12/13/2011 8:41:24 PM - ComboFix created restore point RP94: 12/14/2011 2:03:45 PM - Removed Adobe Reader 9.4.6. . ==== Installed Programs ====================== . Apple Application Support Apple Software Update ATI Catalyst Control Center Banctec Service Agreement Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Common Catalyst Control Center Graphics Previews Vista Catalyst Control Center InstallProxy Catalyst Control Center Localization All ccc-core-static CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help English CCC Help French CCC Help German CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Portuguese CCC Help Spanish CCC Help Turkish Cisco EAP-FAST Module Cisco LEAP Module Cisco PEAP Module Compatibility Pack for the 2007 Office system D3DX10 Dell DataSafe Local Backup Dell DataSafe Local Backup - Support Software Dell DataSafe Online Dell Getting Started Guide Dell Remote Access ESET Online Scanner v3 Google Chrome Google Earth Google Update Helper GoToAssist 8.0.0.514 Java Auto Updater Java™ 6 Update 29 Junk Mail filter update Malwarebytes' Anti-Malware version 1.51.2.1300 McAfee Security Scan Plus Microsoft Office PowerPoint Viewer 2007 (English) Microsoft Office Word Viewer 2003 Microsoft Search Enhancement Pack Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable - KB2467175 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 Microsoft Works MSVCRT MSVCRT_amd64 PowerDVD DX QuickTime Roxio Burn Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Skins Spelling Dictionaries Support For Adobe Reader 9 Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Windows Live Communications Platform Windows Live Essentials Windows Live Installer Windows Live Mail Windows Live Messenger Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live Sync Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources Yahoo! BrowserPlus 2.9.8 . ==== Event Viewer Messages From Past Week ======== . 12/9/2011 7:45:45 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} and APPID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} to the user John-PC\John SID (S-1-5-21-1101040838-1500645861-4030747750-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. 12/9/2011 7:42:20 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D3DCB472-7261-43CE-924B-0704BD730D5F} and APPID {D3DCB472-7261-43CE-924B-0704BD730D5F} to the user John-PC\John SID (S-1-5-21-1101040838-1500645861-4030747750-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. 12/9/2011 7:42:19 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {145B4335-FE2A-4927-A040-7C35AD3180EF} and APPID {145B4335-FE2A-4927-A040-7C35AD3180EF} to the user John-PC\John SID (S-1-5-21-1101040838-1500645861-4030747750-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. 12/9/2011 7:30:00 AM, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143. 12/9/2011 7:24:32 AM, Error: Service Control Manager [7000] - The Trend Micro WFP Callout Driver service failed to start due to the following error: There are no more endpoints available from the endpoint mapper. 12/9/2011 3:20:18 PM, Error: NetBT [4321] - The name "BETTYSPC :0" could not be registered on the interface with IP address 192.168.1.5. The computer with the IP address 192.168.1.1 did not allow the name to be claimed by this computer. 12/8/2011 2:36:30 PM, Error: Service Control Manager [7003] - The McAfee Personal Firewall Service service depends the following service: MpsSvc. This service might not be installed. 12/15/2011 11:09:45 AM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. 12/15/2011 11:05:51 AM, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 12/15/2011 11:05:29 AM, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver. 12/15/2011 10:33:03 AM, Error: Service Control Manager [7003] - The Internet Connection Sharing (ICS) service depends the following service: BFE. This service might not be installed. 12/15/2011 10:33:01 AM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed. 12/15/2011 10:33:01 AM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed. 12/15/2011 10:32:59 AM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service. 12/15/2011 10:32:57 AM, Error: atikmdag [52236] - CPLIB :: General - Invalid Parameter 12/15/2011 10:32:57 AM, Error: atikmdag [43029] - Display is not active 12/14/2011 3:24:56 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F} 12/14/2011 3:24:56 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF} 12/14/2011 2:45:01 PM, Error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0. 12/14/2011 2:12:27 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\System32\bcmihvsrv64.dll Error Code: 21 12/14/2011 2:07:49 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030} 12/14/2011 2:07:49 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} 12/14/2011 2:07:48 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 12/14/2011 2:07:41 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC} 12/14/2011 2:07:36 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache spldr Wanarpv6 12/14/2011 2:07:36 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start. 12/14/2011 2:00:03 PM, Error: Service Control Manager [7000] - The Windows Presentation Foundation Font Cache 3.0.0.0 service failed to start due to the following error: A device attached to the system is not functioning. 12/11/2011 4:29:55 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:00:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89} 12/11/2011 4:00:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E} 12/11/2011 4:00:00 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr Tcpip tdx vwififlt Wanarpv6 WfpLwf 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The TCP/IP Registry Compatibility service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning. . ==== End Of File =========================== . DDS (Ver_11-03-05.01) - NTFS_AMD64 Run by [removed] at 11:36:15.37 on Thu 12/15/2011 Internet Explorer: 8.0.7600.16385 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3839.2501 [GMT -6:00] . AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Program Files\Dell\DellDock\DockLogin.exe C:\Windows\system32\atieclxx.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe C:\Windows\System32\spoolsv.exe C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation c:\Program Files (x86)\Common Files\Dell\Advanced Networking Service\hnm_svc.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe C:\Program Files (x86)\Dell Remote Access\ezi_ra.exe C:\Program Files (x86)\McAfee Security Scan\3.0.229\SSScheduler.exe C:\Program Files\Dell\DellDock\DellDock.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\WUDFHost.exe C:\Windows\system32\wuauclt.exe C:\Windows\system32\WLANExt.exe C:\Windows\system32\conhost.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\John\Desktop\dds.scr C:\Windows\system32\conhost.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://my.yahoo.com/ BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll mRun: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m mRun: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" mRun: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe StartupFolder: C:\Users\John\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files\Dell\DellDock\DellDock.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLRE~1.LNK - c:\Windows\Installer\{F66A31D9-7831-4FBA-BA02-C411C0047CC5}\NewShortcut4_F66A31D978314FBABA02C411C0047CC5.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\3.0.229\SSScheduler.exe mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll mRun-x64: [Broadcom Wireless Manager UI] C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe . ============= SERVICES / DRIVERS =============== . R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-2-12 55280] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-2-12 203264] R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2009-6-9 155648] R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2010-2-12 705856] R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;C:\Windows\System32\drivers\k57nd60a.sys [2010-2-12 320040] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-3-15 135664] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-3-15 135664] S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.229\McCHSvc.exe [2011-9-20 237008] S3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;C:\Program Files\Dell Support Center\pcdsrvc_x64.pkms [2011-10-5 25072] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-2-12 221696] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-5-15 1255736] . =============== Created Last 30 ================ . 2011-12-14 20:21:43 ——– d—–w- C:\Program Files (x86)\ESET 2011-12-14 20:10:51 ——– d—–w- C:\Users\John\AppData\Local\ElevatedDiagnostics 2011-12-14 18:54:12 ——– d—–w- C:\HostsXpert 2011-12-14 02:41:20 518144 —-a-w- C:\Windows\SWREG.exe 2011-12-14 02:41:20 256000 —-a-w- C:\Windows\PEV.exe 2011-12-14 02:41:20 208896 —-a-w- C:\Windows\MBR.exe 2011-12-14 02:41:19 98816 —-a-w- C:\Windows\sed.exe 2011-12-09 19:22:03 ——– d—–w- C:\Users\John\AppData\Local\{C7259314-2491-4598-BA5B-0BB70A7EA0CA} 2011-12-09 19:21:42 ——– d—–w- C:\Users\John\AppData\Local\{5E8FF21E-9BF2-46B1-9DEA-7F207592A98D} 2011-12-09 13:39:31 ——– d—–w- C:\PROGRA~3\McAfee Security Scan 2011-12-09 13:39:24 ——– d—–w- C:\Program Files (x86)\McAfee Security Scan 2011-12-09 13:23:23 ——– d—–w- C:\PROGRA~3\Trend Micro 2011-12-08 21:00:28 ——– d—–w- C:\Users\John\AppData\Local\{1EA54D2F-E217-48BF-8D05-ACE2AD50A3EE} 2011-12-08 21:00:07 ——– d—–w- C:\Users\John\AppData\Local\{FA49C175-5C45-43BC-B388-9174725D958E} 2011-12-06 15:58:04 ——– d—–w- C:\Users\John\AppData\Local\{89B5EF93-9240-41A0-A4C1-CE4031C4358C} 2011-12-06 15:57:53 ——– d—–w- C:\Users\John\AppData\Local\{6534FB6F-A961-49AA-8817-00B47C75C374} 2011-12-06 15:07:30 ——– d—–w- C:\Users\John\AppData\Local\{B4CC9BC5-13E1-4B13-B2D6-2AF7A946F62A} 2011-12-06 02:57:30 ——– d—–w- C:\Users\John\AppData\Local\{A9DED283-D91E-4799-83F9-7745443DCC8C} 2011-12-06 02:56:39 ——– d—–w- C:\Users\John\AppData\Local\{7531C4CD-2CF2-41F9-A589-F6461BE843FC} 2011-12-06 00:08:40 ——– d—–w- C:\Users\John\AppData\Local\{1CD129A7-E805-48CE-AA97-BA916D989C1D} 2011-12-05 12:08:03 ——– d—–w- C:\Users\John\AppData\Local\{E776F58A-4A60-4A92-89F2-8657EA660F4A} 2011-12-05 12:07:52 ——– d—–w- C:\Users\John\AppData\Local\{FD878C04-F27F-4018-A691-92521CEEAD41} 2011-12-04 14:31:25 ——– d—–w- C:\Users\John\AppData\Local\Diagnostics 2011-12-04 13:25:14 ——– d—–w- C:\Users\John\AppData\Local\{C0ABA02E-E54A-48E9-9B10-6FBDC7B0F492} 2011-12-04 13:25:04 ——– d—–w- C:\Users\John\AppData\Local\{2DF7DA3F-33FC-42EB-9C08-F094A3DD4F69} 2011-12-03 14:05:36 ——– d—–w- C:\Users\John\AppData\Local\{BD5F3B43-4257-4C7F-84D2-0DEF1DF1E1F6} 2011-12-03 14:05:25 ——– d—–w- C:\Users\John\AppData\Local\{78902EEC-A0A5-4372-AD4A-AA71A069FD80} 2011-12-02 13:34:13 ——– d—–w- C:\Users\John\AppData\Local\{516690DB-FDA4-4612-856F-76BC2BE75323} 2011-12-02 13:33:52 ——– d—–w- C:\Users\John\AppData\Local\{A4B716CA-7DF0-4332-A8C4-F28A6A6644E2} 2011-12-02 01:33:26 ——– d—–w- C:\Users\John\AppData\Local\{31E5988A-EDD9-4738-A19A-3D50345D78D9} 2011-12-02 01:33:05 ——– d—–w- C:\Users\John\AppData\Local\{49C190CC-BFBD-463C-8C80-B3F68FDA0A96} 2011-12-01 13:32:39 ——– d—–w- C:\Users\John\AppData\Local\{E3F111CD-0653-4E2A-9CDE-0FF49257398D} 2011-12-01 13:32:17 ——– d—–w- C:\Users\John\AppData\Local\{9B842730-8686-40D5-96EE-96E90DACE025} 2011-12-01 01:31:52 ——– d—–w- C:\Users\John\AppData\Local\{29712D4E-8FC0-4D38-9FA8-8DA60DBB32D3} 2011-12-01 01:31:30 ——– d—–w- C:\Users\John\AppData\Local\{3FD383D9-8CF6-4E05-99A7-26DAD9BC089E} 2011-11-30 13:31:03 ——– d—–w- C:\Users\John\AppData\Local\{70E8AB0C-D308-43F4-977F-C9111CA24B96} 2011-11-30 13:30:41 ——– d—–w- C:\Users\John\AppData\Local\{A95776ED-8C6C-4B41-BE52-C71A1F0D15BC} 2011-11-30 00:11:14 ——– d—–w- C:\Users\John\AppData\Local\{C2AC8DC4-775F-48EB-8A51-D6B1FB9AF85F} 2011-11-30 00:10:52 ——– d—–w- C:\Users\John\AppData\Local\{2F11083A-C378-4945-81B5-2B2EA70DF934} 2011-11-29 12:10:13 ——– d—–w- C:\Users\John\AppData\Local\{42245523-67CB-4C3B-A561-0A2629385CF7} 2011-11-29 12:10:03 ——– d—–w- C:\Users\John\AppData\Local\{B687C755-250D-4023-B82A-3625DA0A71C0} 2011-11-28 19:11:28 ——– d—–w- C:\PROGRA~3\Ask 2011-11-28 13:33:49 ——– d—–w- C:\Users\John\AppData\Local\{24E30ECC-AFA5-4436-ACB0-2CDF4976A80C} 2011-11-28 13:33:28 ——– d—–w- C:\Users\John\AppData\Local\{9CE4D386-DC4F-491D-9648-5F077A56CD71} 2011-11-27 16:31:38 ——– d—–w- C:\Users\John\AppData\Local\{58A338B3-636E-4E22-A0FF-FFC7BC715F84} 2011-11-27 16:31:16 ——– d—–w- C:\Users\John\AppData\Local\{5A45BBB2-68F4-4A44-83B7-54AE82874437} 2011-11-27 04:30:52 ——– d—–w- C:\Users\John\AppData\Local\{93EBCC9B-0AED-4315-B932-BF305932A912} 2011-11-27 04:30:30 ——– d—–w- C:\Users\John\AppData\Local\{54E0601B-42D0-4F82-91C6-E77A5B226BA8} 2011-11-26 16:30:18 ——– d—–w- C:\Users\John\AppData\Local\{CE06AE7A-F543-4FAF-92C5-42B66D7F6EF6} 2011-11-26 16:29:56 ——– d—–w- C:\Users\John\AppData\Local\{698964A7-1422-42B5-806C-95FD9D13D6E5} 2011-11-26 04:29:44 ——– d—–w- C:\Users\John\AppData\Local\{CA04410B-AD0D-4204-BA86-5B32A42BD321} 2011-11-26 04:29:22 ——– d—–w- C:\Users\John\AppData\Local\{6E9C83B9-2367-426A-887B-258BD0D10D10} 2011-11-25 16:29:10 ——– d—–w- C:\Users\John\AppData\Local\{90BE8CA4-0EA7-4CDB-B813-068A8B1E46BB} 2011-11-25 16:28:47 ——– d—–w- C:\Users\John\AppData\Local\{8D813F64-5DB2-4C80-90E3-9F4C2B3ED882} 2011-11-25 04:28:35 ——– d—–w- C:\Users\John\AppData\Local\{798F2AF1-507A-4979-A0D2-D2A9CD783B2E} 2011-11-25 04:28:13 ——– d—–w- C:\Users\John\AppData\Local\{6ACA8743-F561-436E-8689-97A7077BA4DB} 2011-11-24 16:28:01 ——– d—–w- C:\Users\John\AppData\Local\{7462E5C9-CCF2-4051-AE3D-7E177DA509D4} 2011-11-24 16:27:39 ——– d—–w- C:\Users\John\AppData\Local\{1C1B0005-C68D-40EF-A09A-2EDBAD813F73} 2011-11-24 04:27:27 ——– d—–w- C:\Users\John\AppData\Local\{5132CC8F-8CCF-407B-8072-D954FE3E7C88} 2011-11-24 04:27:05 ——– d—–w- C:\Users\John\AppData\Local\{B19EF101-46AC-49AE-80DE-F9749801DBFF} 2011-11-23 16:26:51 ——– d—–w- C:\Users\John\AppData\Local\{6F49F341-F883-42A1-84F5-760D67F5C713} 2011-11-23 16:26:30 ——– d—–w- C:\Users\John\AppData\Local\{92D7B85F-F015-4D34-968B-45A21465DA6E} 2011-11-22 16:20:48 ——– d—–w- C:\Users\John\AppData\Local\{CDA934F2-55E8-44AD-B8BA-C921612A2D82} 2011-11-22 16:20:26 ——– d—–w- C:\Users\John\AppData\Local\{4B3226E3-3345-4D33-A677-A6995DA0D32A} 2011-11-21 16:45:52 ——– d—–w- C:\Users\John\AppData\Local\{F256A4FC-EEA4-42C1-86AD-6E04A2C5C554} 2011-11-21 16:45:29 ——– d—–w- C:\Users\John\AppData\Local\{D0621915-A4ED-436E-B620-E4AA4BFF6E86} 2011-11-21 12:36:46 ——– d—–w- C:\Users\John\AppData\Local\{15F1D6DE-34B2-4DEF-AA48-645DD0B06BED} 2011-11-20 13:51:43 ——– d—–w- C:\Users\John\AppData\Local\{1CD023D4-BFB7-4190-96F2-D8A4C2856819} 2011-11-20 13:51:22 ——– d—–w- C:\Users\John\AppData\Local\{A4C49CA3-1B15-4C87-90A0-7B0E85404C0F} 2011-11-20 01:15:17 ——– d—–w- C:\Users\John\AppData\Local\{B231A2D9-06F6-4A94-927B-F515F33D181F} 2011-11-20 01:14:56 ——– d—–w- C:\Users\John\AppData\Local\{52EB6204-25D0-4FF5-AF83-0A868211B82B} 2011-11-19 13:14:26 ——– d—–w- C:\Users\John\AppData\Local\{4D3D2BC2-B085-42A2-A093-4728E4075A3D} 2011-11-19 13:14:16 ——– d—–w- C:\Users\John\AppData\Local\{6EB71965-3B14-4A2A-AE9F-41C68711ADEA} 2011-11-19 03:11:25 ——– d—–w- C:\Users\John\AppData\Local\{7FA1D830-FCA6-4F39-AE81-FBDD544CA7A3} 2011-11-19 03:11:03 ——– d—–w- C:\Users\John\AppData\Local\{65B10D6F-5A69-4BAC-AC55-2B83AF0030E3} 2011-11-18 12:30:12 ——– d—–w- C:\Users\John\AppData\Local\{CAC9D137-C16E-4A32-9674-9F016CE8E8A2} 2011-11-18 12:29:51 ——– d—–w- C:\Users\John\AppData\Local\{D42869DF-00FD-411A-BA44-06D63B3D82F1} 2011-11-17 16:07:08 ——– d—–w- C:\Users\John\AppData\Local\{D1D7C3CA-D98D-4D80-B2A9-72786D1D063D} 2011-11-17 16:06:46 ——– d—–w- C:\Users\John\AppData\Local\{A9F8F6CE-9020-4630-A963-1D5751C2E98C} 2011-11-17 16:01:20 ——– d—–w- C:\Windows\en 2011-11-17 15:58:04 18328 —-a-w- C:\PROGRA~3\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-11-17 15:57:25 69464 —-a-w- C:\Windows\SysWow64\XAPOFX1_3.dll 2011-11-17 15:57:25 515416 —-a-w- C:\Windows\SysWow64\XAudio2_5.dll 2011-11-17 15:57:23 523088 —-a-w- C:\Windows\System32\d3dx10_42.dll 2011-11-17 15:57:23 453456 —-a-w- C:\Windows\SysWow64\d3dx10_42.dll 2011-11-17 15:55:19 3860992 —-a-w- C:\Windows\System32\UIRibbon.dll 2011-11-17 15:55:19 2983424 —-a-w- C:\Windows\SysWow64\UIRibbon.dll 2011-11-17 15:55:19 1164800 —-a-w- C:\Windows\SysWow64\UIRibbonRes.dll 2011-11-17 15:55:19 1164800 —-a-w- C:\Windows\System32\UIRibbonRes.dll 2011-11-17 15:51:54 ——– d—–w- C:\Users\John\AppData\Local\{F3D77095-67B5-4CDC-B7EB-42A432D77154} 2011-11-17 15:51:32 ——– d—–w- C:\Users\John\AppData\Local\{7FF39E7B-AB0C-4984-B1F0-03C63F1E93A1} 2011-11-17 13:49:36 ——– d—–w- C:\Users\John\AppData\Local\{5619BFF2-FCE6-4BCF-ADAF-9D41E686CC02} 2011-11-17 13:49:13 ——– d—–w- C:\Users\John\AppData\Local\{297A689F-2FD7-4E7A-9559-D5F400B91AC6} 2011-11-17 04:18:15 ——– d—–w- C:\Users\John\AppData\Local\{F3CB15D7-E18A-476A-99CC-5E4CE6E72F62} 2011-11-16 23:08:14 ——– d—–w- C:\Users\John\AppData\Local\{681BD86F-F468-45BC-AE7E-579FFBAEDEA2} 2011-11-16 23:07:52 ——– d—–w- C:\Users\John\AppData\Local\{6441FE2B-EFA3-4D64-B381-67DA24492B6F} 2011-11-16 18:46:19 ——– d—–w- C:\Users\John\AppData\Local\{28B608D3-BE90-414E-9F86-8E8D9482FD1D} 2011-11-16 18:45:58 ——– d—–w- C:\Users\John\AppData\Local\{B333671E-44EB-4BC2-BE93-8AFAE8F6BE80} 2011-11-16 14:04:08 ——– d—–w- C:\Users\John\AppData\Local\{B370AFB0-8CD5-4E53-937B-6CE6034674AD} 2011-11-16 14:03:46 ——– d—–w- C:\Users\John\AppData\Local\{13BFA8A3-AC5A-473E-89E9-F36F02F36F69} 2011-11-16 12:30:32 ——– d—–w- C:\Users\John\AppData\Local\{C0A145D7-5106-44A9-B878-09DEE632AE66} 2011-11-16 12:30:10 ——– d—–w- C:\Users\John\AppData\Local\{4C8D45EC-ED36-4AA8-9508-C6271A85B514} 2011-11-16 03:04:53 ——– d—–w- C:\Users\John\AppData\Local\{B87FC783-4BFB-4DEE-B775-EF202F83977A} 2011-11-16 03:04:31 ——– d—–w- C:\Users\John\AppData\Local\{5A3CAC07-EAD0-486A-91F9-DE233B138940} 2011-11-15 19:54:30 ——– d—–w- C:\Users\John\AppData\Local\{323CA349-089B-4525-84A4-1A8017402879} 2011-11-15 19:54:09 ——– d—–w- C:\Users\John\AppData\Local\{101B4FC0-9177-44B5-B666-ED1B10591491} . ==================== Find3M ==================== . 2011-10-03 11:06:03 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2011-10-01 03:21:20 1638912 —-a-w- C:\Windows\System32\mshtml.tlb 2011-10-01 02:59:14 1638912 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2011-09-29 16:24:44 1897328 —-a-w- C:\Windows\System32\drivers\tcpip.sys 2011-09-29 04:09:30 3141120 —-a-w- C:\Windows\System32\win32k.sys . ============= FINISH: 11:36:36.68 ===============

Hi Blade81, I was successfull in running hostsxpert this time- used it to restore MS hosts. You didn't ask for updated DDS scans this time, but I ran them to confirms success. Here they are. . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_11-03-05.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 3/12/2010 12:35:19 PM System Uptime: 12/16/2011 10:04:57 AM (0 hours ago) . Motherboard: Dell Inc. | | 03D1TV Processor: AMD Athlon™ Neo X2 Dual Core Processor 6850e | CPU 1 | 1800/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 283 GiB total, 250.298 GiB free. D: is CDROM () E: is Removable . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP93: 12/13/2011 8:41:24 PM - ComboFix created restore point RP94: 12/14/2011 2:03:45 PM - Removed Adobe Reader 9.4.6. . ==== Installed Programs ====================== . Apple Application Support Apple Software Update ATI Catalyst Control Center Banctec Service Agreement Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Common Catalyst Control Center Graphics Previews Vista Catalyst Control Center InstallProxy Catalyst Control Center Localization All ccc-core-static CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help English CCC Help French CCC Help German CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Portuguese CCC Help Spanish CCC Help Turkish Cisco EAP-FAST Module Cisco LEAP Module Cisco PEAP Module Compatibility Pack for the 2007 Office system D3DX10 Dell DataSafe Local Backup Dell DataSafe Local Backup - Support Software Dell DataSafe Online Dell Getting Started Guide Dell Remote Access ESET Online Scanner v3 Google Chrome Google Earth Google Update Helper GoToAssist 8.0.0.514 Java Auto Updater Java™ 6 Update 29 Junk Mail filter update Malwarebytes' Anti-Malware version 1.51.2.1300 McAfee Security Scan Plus Microsoft Office PowerPoint Viewer 2007 (English) Microsoft Office Word Viewer 2003 Microsoft Search Enhancement Pack Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable - KB2467175 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 Microsoft Works MSVCRT MSVCRT_amd64 PowerDVD DX QuickTime Roxio Burn Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Skins Spelling Dictionaries Support For Adobe Reader 9 Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Windows Live Communications Platform Windows Live Essentials Windows Live Installer Windows Live Mail Windows Live Messenger Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live Sync Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources Yahoo! BrowserPlus 2.9.8 . ==== Event Viewer Messages From Past Week ======== . 12/9/2011 7:45:45 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} and APPID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} to the user John-PC\John SID (S-1-5-21-1101040838-1500645861-4030747750-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. 12/9/2011 7:42:20 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D3DCB472-7261-43CE-924B-0704BD730D5F} and APPID {D3DCB472-7261-43CE-924B-0704BD730D5F} to the user John-PC\John SID (S-1-5-21-1101040838-1500645861-4030747750-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. 12/9/2011 7:42:19 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {145B4335-FE2A-4927-A040-7C35AD3180EF} and APPID {145B4335-FE2A-4927-A040-7C35AD3180EF} to the user John-PC\John SID (S-1-5-21-1101040838-1500645861-4030747750-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. 12/9/2011 7:30:00 AM, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143. 12/9/2011 7:24:32 AM, Error: Service Control Manager [7000] - The Trend Micro WFP Callout Driver service failed to start due to the following error: There are no more endpoints available from the endpoint mapper. 12/9/2011 3:20:18 PM, Error: NetBT [4321] - The name "BETTYSPC :0" could not be registered on the interface with IP address 192.168.1.5. The computer with the IP address 192.168.1.1 did not allow the name to be claimed by this computer. 12/16/2011 10:05:23 AM, Error: VDS Basic Provider [1] - Unexpected failure. Error code: D@01010004 12/16/2011 10:05:16 AM, Error: Service Control Manager [7003] - The Internet Connection Sharing (ICS) service depends the following service: BFE. This service might not be installed. 12/16/2011 10:05:14 AM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed. 12/16/2011 10:05:14 AM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed. 12/16/2011 10:05:12 AM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service. 12/16/2011 10:05:12 AM, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 12/16/2011 10:05:08 AM, Error: atikmdag [52236] - CPLIB :: General - Invalid Parameter 12/16/2011 10:05:08 AM, Error: atikmdag [43029] - Display is not active 12/15/2011 11:09:45 AM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. 12/15/2011 11:05:29 AM, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver. 12/14/2011 3:24:56 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F} 12/14/2011 3:24:56 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF} 12/14/2011 2:45:01 PM, Error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0. 12/14/2011 2:12:27 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\System32\bcmihvsrv64.dll Error Code: 21 12/14/2011 2:07:49 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030} 12/14/2011 2:07:49 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} 12/14/2011 2:07:48 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 12/14/2011 2:07:41 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC} 12/14/2011 2:07:36 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache spldr Wanarpv6 12/14/2011 2:07:36 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start. 12/14/2011 2:00:03 PM, Error: Service Control Manager [7000] - The Windows Presentation Foundation Font Cache 3.0.0.0 service failed to start due to the following error: A device attached to the system is not functioning. 12/11/2011 4:29:55 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:00:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89} 12/11/2011 4:00:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E} 12/11/2011 4:00:00 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr Tcpip tdx vwififlt Wanarpv6 WfpLwf 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The TCP/IP Registry Compatibility service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning. . ==== End Of File =========================== . DDS (Ver_11-03-05.01) - NTFS_AMD64 Run by [removed] at 10:22:08.86 on Fri 12/16/2011 Internet Explorer: 8.0.7600.16385 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3839.2804 [GMT -6:00] . AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Program Files\Dell\DellDock\DockLogin.exe C:\Windows\system32\atieclxx.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe C:\Windows\system32\WLANExt.exe C:\Windows\system32\conhost.exe C:\Windows\System32\spoolsv.exe C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation c:\Program Files (x86)\Common Files\Dell\Advanced Networking Service\hnm_svc.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe C:\Windows\system32\WUDFHost.exe C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe C:\Program Files (x86)\Dell Remote Access\ezi_ra.exe C:\Program Files (x86)\McAfee Security Scan\3.0.229\SSScheduler.exe C:\Program Files\Dell\DellDock\DellDock.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\wuauclt.exe C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\taskeng.exe C:\Program Files\Dell Support Center\pcdrcui.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\John\Desktop\dds.scr C:\Windows\system32\conhost.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://my.yahoo.com/ BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll mRun: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m mRun: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" mRun: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe StartupFolder: C:\Users\John\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files\Dell\DellDock\DellDock.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLRE~1.LNK - c:\Windows\Installer\{F66A31D9-7831-4FBA-BA02-C411C0047CC5}\NewShortcut4_F66A31D978314FBABA02C411C0047CC5.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\3.0.229\SSScheduler.exe mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll mRun-x64: [Broadcom Wireless Manager UI] C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe . ============= SERVICES / DRIVERS =============== . R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-2-12 55280] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-2-12 203264] R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2009-6-9 155648] R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2010-2-12 705856] R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;C:\Windows\System32\drivers\k57nd60a.sys [2010-2-12 320040] R3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;C:\Program Files\Dell Support Center\pcdsrvc_x64.pkms [2011-10-5 25072] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-3-15 135664] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-3-15 135664] S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.229\McCHSvc.exe [2011-9-20 237008] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-2-12 221696] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-5-15 1255736] . =============== Created Last 30 ================ . 2011-12-16 16:05:29 ——– d-sh–w- C:\$RECYCLE.BIN 2011-12-14 20:21:43 ——– d—–w- C:\Program Files (x86)\ESET 2011-12-14 20:10:51 ——– d—–w- C:\Users\John\AppData\Local\ElevatedDiagnostics 2011-12-14 18:54:12 ——– d—–w- C:\HostsXpert 2011-12-14 02:41:20 518144 —-a-w- C:\Windows\SWREG.exe 2011-12-14 02:41:20 256000 —-a-w- C:\Windows\PEV.exe 2011-12-14 02:41:20 208896 —-a-w- C:\Windows\MBR.exe 2011-12-14 02:41:19 98816 —-a-w- C:\Windows\sed.exe 2011-12-09 19:22:03 ——– d—–w- C:\Users\John\AppData\Local\{C7259314-2491-4598-BA5B-0BB70A7EA0CA} 2011-12-09 19:21:42 ——– d—–w- C:\Users\John\AppData\Local\{5E8FF21E-9BF2-46B1-9DEA-7F207592A98D} 2011-12-09 13:39:31 ——– d—–w- C:\PROGRA~3\McAfee Security Scan 2011-12-09 13:39:24 ——– d—–w- C:\Program Files (x86)\McAfee Security Scan 2011-12-09 13:23:23 ——– d—–w- C:\PROGRA~3\Trend Micro 2011-12-08 21:00:28 ——– d—–w- C:\Users\John\AppData\Local\{1EA54D2F-E217-48BF-8D05-ACE2AD50A3EE} 2011-12-08 21:00:07 ——– d—–w- C:\Users\John\AppData\Local\{FA49C175-5C45-43BC-B388-9174725D958E} 2011-12-06 15:58:04 ——– d—–w- C:\Users\John\AppData\Local\{89B5EF93-9240-41A0-A4C1-CE4031C4358C} 2011-12-06 15:57:53 ——– d—–w- C:\Users\John\AppData\Local\{6534FB6F-A961-49AA-8817-00B47C75C374} 2011-12-06 15:07:30 ——– d—–w- C:\Users\John\AppData\Local\{B4CC9BC5-13E1-4B13-B2D6-2AF7A946F62A} 2011-12-06 02:57:30 ——– d—–w- C:\Users\John\AppData\Local\{A9DED283-D91E-4799-83F9-7745443DCC8C} 2011-12-06 02:56:39 ——– d—–w- C:\Users\John\AppData\Local\{7531C4CD-2CF2-41F9-A589-F6461BE843FC} 2011-12-06 00:08:40 ——– d—–w- C:\Users\John\AppData\Local\{1CD129A7-E805-48CE-AA97-BA916D989C1D} 2011-12-05 12:08:03 ——– d—–w- C:\Users\John\AppData\Local\{E776F58A-4A60-4A92-89F2-8657EA660F4A} 2011-12-05 12:07:52 ——– d—–w- C:\Users\John\AppData\Local\{FD878C04-F27F-4018-A691-92521CEEAD41} 2011-12-04 14:31:25 ——– d—–w- C:\Users\John\AppData\Local\Diagnostics 2011-12-04 13:25:14 ——– d—–w- C:\Users\John\AppData\Local\{C0ABA02E-E54A-48E9-9B10-6FBDC7B0F492} 2011-12-04 13:25:04 ——– d—–w- C:\Users\John\AppData\Local\{2DF7DA3F-33FC-42EB-9C08-F094A3DD4F69} 2011-12-03 14:05:36 ——– d—–w- C:\Users\John\AppData\Local\{BD5F3B43-4257-4C7F-84D2-0DEF1DF1E1F6} 2011-12-03 14:05:25 ——– d—–w- C:\Users\John\AppData\Local\{78902EEC-A0A5-4372-AD4A-AA71A069FD80} 2011-12-02 13:34:13 ——– d—–w- C:\Users\John\AppData\Local\{516690DB-FDA4-4612-856F-76BC2BE75323} 2011-12-02 13:33:52 ——– d—–w- C:\Users\John\AppData\Local\{A4B716CA-7DF0-4332-A8C4-F28A6A6644E2} 2011-12-02 01:33:26 ——– d—–w- C:\Users\John\AppData\Local\{31E5988A-EDD9-4738-A19A-3D50345D78D9} 2011-12-02 01:33:05 ——– d—–w- C:\Users\John\AppData\Local\{49C190CC-BFBD-463C-8C80-B3F68FDA0A96} 2011-12-01 13:32:39 ——– d—–w- C:\Users\John\AppData\Local\{E3F111CD-0653-4E2A-9CDE-0FF49257398D} 2011-12-01 13:32:17 ——– d—–w- C:\Users\John\AppData\Local\{9B842730-8686-40D5-96EE-96E90DACE025} 2011-12-01 01:31:52 ——– d—–w- C:\Users\John\AppData\Local\{29712D4E-8FC0-4D38-9FA8-8DA60DBB32D3} 2011-12-01 01:31:30 ——– d—–w- C:\Users\John\AppData\Local\{3FD383D9-8CF6-4E05-99A7-26DAD9BC089E} 2011-11-30 13:31:03 ——– d—–w- C:\Users\John\AppData\Local\{70E8AB0C-D308-43F4-977F-C9111CA24B96} 2011-11-30 13:30:41 ——– d—–w- C:\Users\John\AppData\Local\{A95776ED-8C6C-4B41-BE52-C71A1F0D15BC} 2011-11-30 00:11:14 ——– d—–w- C:\Users\John\AppData\Local\{C2AC8DC4-775F-48EB-8A51-D6B1FB9AF85F} 2011-11-30 00:10:52 ——– d—–w- C:\Users\John\AppData\Local\{2F11083A-C378-4945-81B5-2B2EA70DF934} 2011-11-29 12:10:13 ——– d—–w- C:\Users\John\AppData\Local\{42245523-67CB-4C3B-A561-0A2629385CF7} 2011-11-29 12:10:03 ——– d—–w- C:\Users\John\AppData\Local\{B687C755-250D-4023-B82A-3625DA0A71C0} 2011-11-28 19:11:28 ——– d—–w- C:\PROGRA~3\Ask 2011-11-28 13:33:49 ——– d—–w- C:\Users\John\AppData\Local\{24E30ECC-AFA5-4436-ACB0-2CDF4976A80C} 2011-11-28 13:33:28 ——– d—–w- C:\Users\John\AppData\Local\{9CE4D386-DC4F-491D-9648-5F077A56CD71} 2011-11-27 16:31:38 ——– d—–w- C:\Users\John\AppData\Local\{58A338B3-636E-4E22-A0FF-FFC7BC715F84} 2011-11-27 16:31:16 ——– d—–w- C:\Users\John\AppData\Local\{5A45BBB2-68F4-4A44-83B7-54AE82874437} 2011-11-27 04:30:52 ——– d—–w- C:\Users\John\AppData\Local\{93EBCC9B-0AED-4315-B932-BF305932A912} 2011-11-27 04:30:30 ——– d—–w- C:\Users\John\AppData\Local\{54E0601B-42D0-4F82-91C6-E77A5B226BA8} 2011-11-26 16:30:18 ——– d—–w- C:\Users\John\AppData\Local\{CE06AE7A-F543-4FAF-92C5-42B66D7F6EF6} 2011-11-26 16:29:56 ——– d—–w- C:\Users\John\AppData\Local\{698964A7-1422-42B5-806C-95FD9D13D6E5} 2011-11-26 04:29:44 ——– d—–w- C:\Users\John\AppData\Local\{CA04410B-AD0D-4204-BA86-5B32A42BD321} 2011-11-26 04:29:22 ——– d—–w- C:\Users\John\AppData\Local\{6E9C83B9-2367-426A-887B-258BD0D10D10} 2011-11-25 16:29:10 ——– d—–w- C:\Users\John\AppData\Local\{90BE8CA4-0EA7-4CDB-B813-068A8B1E46BB} 2011-11-25 16:28:47 ——– d—–w- C:\Users\John\AppData\Local\{8D813F64-5DB2-4C80-90E3-9F4C2B3ED882} 2011-11-25 04:28:35 ——– d—–w- C:\Users\John\AppData\Local\{798F2AF1-507A-4979-A0D2-D2A9CD783B2E} 2011-11-25 04:28:13 ——– d—–w- C:\Users\John\AppData\Local\{6ACA8743-F561-436E-8689-97A7077BA4DB} 2011-11-24 16:28:01 ——– d—–w- C:\Users\John\AppData\Local\{7462E5C9-CCF2-4051-AE3D-7E177DA509D4} 2011-11-24 16:27:39 ——– d—–w- C:\Users\John\AppData\Local\{1C1B0005-C68D-40EF-A09A-2EDBAD813F73} 2011-11-24 04:27:27 ——– d—–w- C:\Users\John\AppData\Local\{5132CC8F-8CCF-407B-8072-D954FE3E7C88} 2011-11-24 04:27:05 ——– d—–w- C:\Users\John\AppData\Local\{B19EF101-46AC-49AE-80DE-F9749801DBFF} 2011-11-23 16:26:51 ——– d—–w- C:\Users\John\AppData\Local\{6F49F341-F883-42A1-84F5-760D67F5C713} 2011-11-23 16:26:30 ——– d—–w- C:\Users\John\AppData\Local\{92D7B85F-F015-4D34-968B-45A21465DA6E} 2011-11-22 16:20:48 ——– d—–w- C:\Users\John\AppData\Local\{CDA934F2-55E8-44AD-B8BA-C921612A2D82} 2011-11-22 16:20:26 ——– d—–w- C:\Users\John\AppData\Local\{4B3226E3-3345-4D33-A677-A6995DA0D32A} 2011-11-21 16:45:52 ——– d—–w- C:\Users\John\AppData\Local\{F256A4FC-EEA4-42C1-86AD-6E04A2C5C554} 2011-11-21 16:45:29 ——– d—–w- C:\Users\John\AppData\Local\{D0621915-A4ED-436E-B620-E4AA4BFF6E86} 2011-11-21 12:36:46 ——– d—–w- C:\Users\John\AppData\Local\{15F1D6DE-34B2-4DEF-AA48-645DD0B06BED} 2011-11-20 13:51:43 ——– d—–w- C:\Users\John\AppData\Local\{1CD023D4-BFB7-4190-96F2-D8A4C2856819} 2011-11-20 13:51:22 ——– d—–w- C:\Users\John\AppData\Local\{A4C49CA3-1B15-4C87-90A0-7B0E85404C0F} 2011-11-20 01:15:17 ——– d—–w- C:\Users\John\AppData\Local\{B231A2D9-06F6-4A94-927B-F515F33D181F} 2011-11-20 01:14:56 ——– d—–w- C:\Users\John\AppData\Local\{52EB6204-25D0-4FF5-AF83-0A868211B82B} 2011-11-19 13:14:26 ——– d—–w- C:\Users\John\AppData\Local\{4D3D2BC2-B085-42A2-A093-4728E4075A3D} 2011-11-19 13:14:16 ——– d—–w- C:\Users\John\AppData\Local\{6EB71965-3B14-4A2A-AE9F-41C68711ADEA} 2011-11-19 03:11:25 ——– d—–w- C:\Users\John\AppData\Local\{7FA1D830-FCA6-4F39-AE81-FBDD544CA7A3} 2011-11-19 03:11:03 ——– d—–w- C:\Users\John\AppData\Local\{65B10D6F-5A69-4BAC-AC55-2B83AF0030E3} 2011-11-18 12:30:12 ——– d—–w- C:\Users\John\AppData\Local\{CAC9D137-C16E-4A32-9674-9F016CE8E8A2} 2011-11-18 12:29:51 ——– d—–w- C:\Users\John\AppData\Local\{D42869DF-00FD-411A-BA44-06D63B3D82F1} 2011-11-17 16:07:08 ——– d—–w- C:\Users\John\AppData\Local\{D1D7C3CA-D98D-4D80-B2A9-72786D1D063D} 2011-11-17 16:06:46 ——– d—–w- C:\Users\John\AppData\Local\{A9F8F6CE-9020-4630-A963-1D5751C2E98C} 2011-11-17 16:01:20 ——– d—–w- C:\Windows\en 2011-11-17 15:58:04 18328 —-a-w- C:\PROGRA~3\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-11-17 15:57:25 69464 —-a-w- C:\Windows\SysWow64\XAPOFX1_3.dll 2011-11-17 15:57:25 515416 —-a-w- C:\Windows\SysWow64\XAudio2_5.dll 2011-11-17 15:57:23 523088 —-a-w- C:\Windows\System32\d3dx10_42.dll 2011-11-17 15:57:23 453456 —-a-w- C:\Windows\SysWow64\d3dx10_42.dll 2011-11-17 15:55:19 3860992 —-a-w- C:\Windows\System32\UIRibbon.dll 2011-11-17 15:55:19 2983424 —-a-w- C:\Windows\SysWow64\UIRibbon.dll 2011-11-17 15:55:19 1164800 —-a-w- C:\Windows\SysWow64\UIRibbonRes.dll 2011-11-17 15:55:19 1164800 —-a-w- C:\Windows\System32\UIRibbonRes.dll 2011-11-17 15:51:54 ——– d—–w- C:\Users\John\AppData\Local\{F3D77095-67B5-4CDC-B7EB-42A432D77154} 2011-11-17 15:51:32 ——– d—–w- C:\Users\John\AppData\Local\{7FF39E7B-AB0C-4984-B1F0-03C63F1E93A1} 2011-11-17 13:49:36 ——– d—–w- C:\Users\John\AppData\Local\{5619BFF2-FCE6-4BCF-ADAF-9D41E686CC02} 2011-11-17 13:49:13 ——– d—–w- C:\Users\John\AppData\Local\{297A689F-2FD7-4E7A-9559-D5F400B91AC6} 2011-11-17 04:18:15 ——– d—–w- C:\Users\John\AppData\Local\{F3CB15D7-E18A-476A-99CC-5E4CE6E72F62} 2011-11-16 23:08:14 ——– d—–w- C:\Users\John\AppData\Local\{681BD86F-F468-45BC-AE7E-579FFBAEDEA2} 2011-11-16 23:07:52 ——– d—–w- C:\Users\John\AppData\Local\{6441FE2B-EFA3-4D64-B381-67DA24492B6F} 2011-11-16 18:46:19 ——– d—–w- C:\Users\John\AppData\Local\{28B608D3-BE90-414E-9F86-8E8D9482FD1D} 2011-11-16 18:45:58 ——– d—–w- C:\Users\John\AppData\Local\{B333671E-44EB-4BC2-BE93-8AFAE8F6BE80} . ==================== Find3M ==================== . 2011-10-03 11:06:03 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2011-10-01 03:21:20 1638912 —-a-w- C:\Windows\System32\mshtml.tlb 2011-10-01 02:59:14 1638912 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2011-09-29 16:24:44 1897328 —-a-w- C:\Windows\System32\drivers\tcpip.sys 2011-09-29 04:09:30 3141120 —-a-w- C:\Windows\System32\win32k.sys . ============= FINISH: 10:23:25.74 ===============

Blade 81, here are the reports. Looks like remnants of McAfee linger. I did removal/uninstall through the control panel and ran MCPR.exe twice. . DDS (Ver_11-03-05.01) - NTFS_AMD64 Run by [removed] at 9:13:55.52 on Sat 12/17/2011 Internet Explorer: 8.0.7601.17514 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3839.2732 [GMT -6:00] . AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Program Files\Dell\DellDock\DockLogin.exe C:\Windows\system32\atieclxx.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe C:\Program Files\AVAST Software\Avast\AvastSvc.exe C:\Windows\System32\spoolsv.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE c:\Program Files (x86)\Common Files\Dell\Advanced Networking Service\hnm_svc.exe C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Program Files (x86)\Secunia\PSI\PSIA.exe C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe C:\Windows\System32\vds.exe C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE C:\Program Files (x86)\Dell Remote Access\ezi_ra.exe C:\Program Files (x86)\Secunia\PSI\psi_tray.exe C:\Program Files\Dell\DellDock\DellDock.exe C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe C:\Program Files (x86)\Secunia\PSI\sua.exe c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files\AVAST Software\Avast\AvastUI.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\SysWOW64\ctfmon.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\John\Desktop\dds.scr C:\Windows\system32\conhost.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://my.yahoo.com/ BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll mRun: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m mRun: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" mRun: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe StartupFolder: C:\Users\John\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files\Dell\DellDock\DellDock.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLRE~1.LNK - c:\Windows\Installer\{F66A31D9-7831-4FBA-BA02-C411C0047CC5}\NewShortcut4_F66A31D978314FBABA02C411C0047CC5.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SECUNI~1.LNK - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll BHO-X64: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll TB-X64: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll mRun-x64: [Broadcom Wireless Manager UI] C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe . ============= SERVICES / DRIVERS =============== . R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-2-12 55280] R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2011-12-16 591192] R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2011-12-16 304472] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904] R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-2-12 203264] R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2011-12-16 24408] R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2011-12-16 66904] R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-12-16 44768] R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2009-6-9 155648] R2 Secunia PSI Agent;Secunia PSI Agent;C:\Program Files (x86)\Secunia\PSI\psia.exe [2011-10-14 994360] R2 Secunia Update Agent;Secunia Update Agent;C:\Program Files (x86)\Secunia\PSI\sua.exe [2011-10-14 399416] R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2010-2-12 705856] R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;C:\Windows\System32\drivers\k57nd60a.sys [2010-2-12 320040] R3 PSI;PSI;C:\Windows\System32\drivers\psi_mf.sys [2010-9-1 17976] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-3-15 135664] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-3-15 135664] S3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;C:\Program Files\Dell Support Center\pcdsrvc_x64.pkms [2011-12-13 25072] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-2-12 221696] S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-7-1 59392] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-5-15 1255736] . =============== Created Last 30 ================ . 2011-12-17 03:44:47 ——– d—–w- C:\Temp 2011-12-17 01:27:41 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin7.dll 2011-12-17 01:27:41 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin6.dll 2011-12-17 01:27:41 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin5.dll 2011-12-17 01:27:41 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin4.dll 2011-12-17 01:27:41 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin3.dll 2011-12-17 01:27:41 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin2.dll 2011-12-17 01:27:41 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin.dll 2011-12-17 01:22:32 525544 —-a-w- C:\Windows\System32\deployJava1.dll 2011-12-17 01:15:00 ——– d—–w- C:\Users\John\AppData\Local\Secunia PSI 2011-12-17 01:14:45 ——– d—–w- C:\Program Files (x86)\Secunia 2011-12-16 23:11:03 ——– d—–w- C:\Windows\System32\SPReview 2011-12-16 23:10:40 ——– d—–w- C:\Windows\System32\EventProviders 2011-12-16 22:57:35 414368 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2011-12-16 22:05:00 ——– d-s—w- C:\Windows\SysWow64\Microsoft 2011-12-16 21:56:27 3145216 —-a-w- C:\Windows\System32\win32k.sys 2011-12-16 21:56:26 723456 —-a-w- C:\Windows\System32\EncDec.dll 2011-12-16 21:56:25 534528 —-a-w- C:\Windows\SysWow64\EncDec.dll 2011-12-16 21:56:12 2048 —-a-w- C:\Windows\SysWow64\tzres.dll 2011-12-16 21:56:12 2048 —-a-w- C:\Windows\System32\tzres.dll 2011-12-16 19:29:11 591192 —-a-w- C:\Windows\System32\drivers\aswSnx.sys 2011-12-16 19:29:09 66904 —-a-w- C:\Windows\System32\drivers\aswMonFlt.sys 2011-12-16 19:28:24 41184 —-a-w- C:\Windows\avastSS.scr 2011-12-16 19:28:15 ——– d—–w- C:\Program Files\AVAST Software 2011-12-16 19:28:15 ——– d—–w- C:\PROGRA~3\AVAST Software 2011-12-16 16:05:29 ——– d-sh–w- C:\$RECYCLE.BIN 2011-12-14 20:21:43 ——– d—–w- C:\Program Files (x86)\ESET 2011-12-14 20:10:51 ——– d—–w- C:\Users\John\AppData\Local\ElevatedDiagnostics 2011-12-14 18:54:12 ——– d—–w- C:\HostsXpert 2011-12-09 19:22:03 ——– d—–w- C:\Users\John\AppData\Local\{C7259314-2491-4598-BA5B-0BB70A7EA0CA} 2011-12-09 19:21:42 ——– d—–w- C:\Users\John\AppData\Local\{5E8FF21E-9BF2-46B1-9DEA-7F207592A98D} 2011-12-09 13:23:23 ——– d—–w- C:\PROGRA~3\Trend Micro 2011-12-08 21:00:28 ——– d—–w- C:\Users\John\AppData\Local\{1EA54D2F-E217-48BF-8D05-ACE2AD50A3EE} 2011-12-08 21:00:07 ——– d—–w- C:\Users\John\AppData\Local\{FA49C175-5C45-43BC-B388-9174725D958E} 2011-12-06 15:58:04 ——– d—–w- C:\Users\John\AppData\Local\{89B5EF93-9240-41A0-A4C1-CE4031C4358C} 2011-12-06 15:57:53 ——– d—–w- C:\Users\John\AppData\Local\{6534FB6F-A961-49AA-8817-00B47C75C374} 2011-12-06 15:07:30 ——– d—–w- C:\Users\John\AppData\Local\{B4CC9BC5-13E1-4B13-B2D6-2AF7A946F62A} 2011-12-06 02:57:30 ——– d—–w- C:\Users\John\AppData\Local\{A9DED283-D91E-4799-83F9-7745443DCC8C} 2011-12-06 02:56:39 ——– d—–w- C:\Users\John\AppData\Local\{7531C4CD-2CF2-41F9-A589-F6461BE843FC} 2011-12-06 00:08:40 ——– d—–w- C:\Users\John\AppData\Local\{1CD129A7-E805-48CE-AA97-BA916D989C1D} 2011-12-05 12:08:03 ——– d—–w- C:\Users\John\AppData\Local\{E776F58A-4A60-4A92-89F2-8657EA660F4A} 2011-12-05 12:07:52 ——– d—–w- C:\Users\John\AppData\Local\{FD878C04-F27F-4018-A691-92521CEEAD41} 2011-12-04 14:31:25 ——– d—–w- C:\Users\John\AppData\Local\Diagnostics 2011-12-04 13:25:14 ——– d—–w- C:\Users\John\AppData\Local\{C0ABA02E-E54A-48E9-9B10-6FBDC7B0F492} 2011-12-04 13:25:04 ——– d—–w- C:\Users\John\AppData\Local\{2DF7DA3F-33FC-42EB-9C08-F094A3DD4F69} 2011-12-03 14:05:36 ——– d—–w- C:\Users\John\AppData\Local\{BD5F3B43-4257-4C7F-84D2-0DEF1DF1E1F6} 2011-12-03 14:05:25 ——– d—–w- C:\Users\John\AppData\Local\{78902EEC-A0A5-4372-AD4A-AA71A069FD80} 2011-12-02 13:34:13 ——– d—–w- C:\Users\John\AppData\Local\{516690DB-FDA4-4612-856F-76BC2BE75323} 2011-12-02 13:33:52 ——– d—–w- C:\Users\John\AppData\Local\{A4B716CA-7DF0-4332-A8C4-F28A6A6644E2} 2011-12-02 01:33:26 ——– d—–w- C:\Users\John\AppData\Local\{31E5988A-EDD9-4738-A19A-3D50345D78D9} 2011-12-02 01:33:05 ——– d—–w- C:\Users\John\AppData\Local\{49C190CC-BFBD-463C-8C80-B3F68FDA0A96} 2011-12-01 13:32:39 ——– d—–w- C:\Users\John\AppData\Local\{E3F111CD-0653-4E2A-9CDE-0FF49257398D} 2011-12-01 13:32:17 ——– d—–w- C:\Users\John\AppData\Local\{9B842730-8686-40D5-96EE-96E90DACE025} 2011-12-01 01:31:52 ——– d—–w- C:\Users\John\AppData\Local\{29712D4E-8FC0-4D38-9FA8-8DA60DBB32D3} 2011-12-01 01:31:30 ——– d—–w- C:\Users\John\AppData\Local\{3FD383D9-8CF6-4E05-99A7-26DAD9BC089E} 2011-11-30 13:31:03 ——– d—–w- C:\Users\John\AppData\Local\{70E8AB0C-D308-43F4-977F-C9111CA24B96} 2011-11-30 13:30:41 ——– d—–w- C:\Users\John\AppData\Local\{A95776ED-8C6C-4B41-BE52-C71A1F0D15BC} 2011-11-30 00:11:14 ——– d—–w- C:\Users\John\AppData\Local\{C2AC8DC4-775F-48EB-8A51-D6B1FB9AF85F} 2011-11-30 00:10:52 ——– d—–w- C:\Users\John\AppData\Local\{2F11083A-C378-4945-81B5-2B2EA70DF934} 2011-11-29 12:10:13 ——– d—–w- C:\Users\John\AppData\Local\{42245523-67CB-4C3B-A561-0A2629385CF7} 2011-11-29 12:10:03 ——– d—–w- C:\Users\John\AppData\Local\{B687C755-250D-4023-B82A-3625DA0A71C0} 2011-11-28 19:11:28 ——– d—–w- C:\PROGRA~3\Ask 2011-11-28 13:33:49 ——– d—–w- C:\Users\John\AppData\Local\{24E30ECC-AFA5-4436-ACB0-2CDF4976A80C} 2011-11-28 13:33:28 ——– d—–w- C:\Users\John\AppData\Local\{9CE4D386-DC4F-491D-9648-5F077A56CD71} 2011-11-27 16:31:38 ——– d—–w- C:\Users\John\AppData\Local\{58A338B3-636E-4E22-A0FF-FFC7BC715F84} 2011-11-27 16:31:16 ——– d—–w- C:\Users\John\AppData\Local\{5A45BBB2-68F4-4A44-83B7-54AE82874437} 2011-11-27 04:30:52 ——– d—–w- C:\Users\John\AppData\Local\{93EBCC9B-0AED-4315-B932-BF305932A912} 2011-11-27 04:30:30 ——– d—–w- C:\Users\John\AppData\Local\{54E0601B-42D0-4F82-91C6-E77A5B226BA8} 2011-11-26 16:30:18 ——– d—–w- C:\Users\John\AppData\Local\{CE06AE7A-F543-4FAF-92C5-42B66D7F6EF6} 2011-11-26 16:29:56 ——– d—–w- C:\Users\John\AppData\Local\{698964A7-1422-42B5-806C-95FD9D13D6E5} 2011-11-26 04:29:44 ——– d—–w- C:\Users\John\AppData\Local\{CA04410B-AD0D-4204-BA86-5B32A42BD321} 2011-11-26 04:29:22 ——– d—–w- C:\Users\John\AppData\Local\{6E9C83B9-2367-426A-887B-258BD0D10D10} 2011-11-25 16:29:10 ——– d—–w- C:\Users\John\AppData\Local\{90BE8CA4-0EA7-4CDB-B813-068A8B1E46BB} 2011-11-25 16:28:47 ——– d—–w- C:\Users\John\AppData\Local\{8D813F64-5DB2-4C80-90E3-9F4C2B3ED882} 2011-11-25 04:28:35 ——– d—–w- C:\Users\John\AppData\Local\{798F2AF1-507A-4979-A0D2-D2A9CD783B2E} 2011-11-25 04:28:13 ——– d—–w- C:\Users\John\AppData\Local\{6ACA8743-F561-436E-8689-97A7077BA4DB} 2011-11-24 16:28:01 ——– d—–w- C:\Users\John\AppData\Local\{7462E5C9-CCF2-4051-AE3D-7E177DA509D4} 2011-11-24 16:27:39 ——– d—–w- C:\Users\John\AppData\Local\{1C1B0005-C68D-40EF-A09A-2EDBAD813F73} 2011-11-24 04:27:27 ——– d—–w- C:\Users\John\AppData\Local\{5132CC8F-8CCF-407B-8072-D954FE3E7C88} 2011-11-24 04:27:05 ——– d—–w- C:\Users\John\AppData\Local\{B19EF101-46AC-49AE-80DE-F9749801DBFF} 2011-11-23 16:26:51 ——– d—–w- C:\Users\John\AppData\Local\{6F49F341-F883-42A1-84F5-760D67F5C713} 2011-11-23 16:26:30 ——– d—–w- C:\Users\John\AppData\Local\{92D7B85F-F015-4D34-968B-45A21465DA6E} 2011-11-22 16:20:48 ——– d—–w- C:\Users\John\AppData\Local\{CDA934F2-55E8-44AD-B8BA-C921612A2D82} 2011-11-22 16:20:26 ——– d—–w- C:\Users\John\AppData\Local\{4B3226E3-3345-4D33-A677-A6995DA0D32A} 2011-11-21 16:45:52 ——– d—–w- C:\Users\John\AppData\Local\{F256A4FC-EEA4-42C1-86AD-6E04A2C5C554} 2011-11-21 16:45:29 ——– d—–w- C:\Users\John\AppData\Local\{D0621915-A4ED-436E-B620-E4AA4BFF6E86} 2011-11-21 12:36:46 ——– d—–w- C:\Users\John\AppData\Local\{15F1D6DE-34B2-4DEF-AA48-645DD0B06BED} 2011-11-20 13:51:43 ——– d—–w- C:\Users\John\AppData\Local\{1CD023D4-BFB7-4190-96F2-D8A4C2856819} 2011-11-20 13:51:22 ——– d—–w- C:\Users\John\AppData\Local\{A4C49CA3-1B15-4C87-90A0-7B0E85404C0F} 2011-11-20 01:15:17 ——– d—–w- C:\Users\John\AppData\Local\{B231A2D9-06F6-4A94-927B-F515F33D181F} 2011-11-20 01:14:56 ——– d—–w- C:\Users\John\AppData\Local\{52EB6204-25D0-4FF5-AF83-0A868211B82B} 2011-11-19 13:14:26 ——– d—–w- C:\Users\John\AppData\Local\{4D3D2BC2-B085-42A2-A093-4728E4075A3D} 2011-11-19 13:14:16 ——– d—–w- C:\Users\John\AppData\Local\{6EB71965-3B14-4A2A-AE9F-41C68711ADEA} 2011-11-19 03:11:25 ——– d—–w- C:\Users\John\AppData\Local\{7FA1D830-FCA6-4F39-AE81-FBDD544CA7A3} 2011-11-19 03:11:03 ——– d—–w- C:\Users\John\AppData\Local\{65B10D6F-5A69-4BAC-AC55-2B83AF0030E3} 2011-11-18 12:30:12 ——– d—–w- C:\Users\John\AppData\Local\{CAC9D137-C16E-4A32-9674-9F016CE8E8A2} 2011-11-18 12:29:51 ——– d—–w- C:\Users\John\AppData\Local\{D42869DF-00FD-411A-BA44-06D63B3D82F1} 2011-11-17 16:07:08 ——– d—–w- C:\Users\John\AppData\Local\{D1D7C3CA-D98D-4D80-B2A9-72786D1D063D} 2011-11-17 16:06:46 ——– d—–w- C:\Users\John\AppData\Local\{A9F8F6CE-9020-4630-A963-1D5751C2E98C} 2011-11-17 16:01:20 ——– d—–w- C:\Windows\en 2011-11-17 15:58:04 18328 —-a-w- C:\PROGRA~3\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-11-17 15:57:25 69464 —-a-w- C:\Windows\SysWow64\XAPOFX1_3.dll 2011-11-17 15:57:25 515416 —-a-w- C:\Windows\SysWow64\XAudio2_5.dll 2011-11-17 15:57:23 523088 —-a-w- C:\Windows\System32\d3dx10_42.dll 2011-11-17 15:57:23 453456 —-a-w- C:\Windows\SysWow64\d3dx10_42.dll 2011-11-17 15:51:54 ——– d—–w- C:\Users\John\AppData\Local\{F3D77095-67B5-4CDC-B7EB-42A432D77154} 2011-11-17 15:51:32 ——– d—–w- C:\Users\John\AppData\Local\{7FF39E7B-AB0C-4984-B1F0-03C63F1E93A1} . ==================== Find3M ==================== . 2011-12-16 23:22:32 152576 —-a-w- C:\Windows\SysWow64\msclmd.dll 2011-12-16 23:22:31 175616 —-a-w- C:\Windows\System32\msclmd.dll 2011-11-05 05:41:43 1188864 —-a-w- C:\Windows\System32\wininet.dll 2011-11-05 04:35:00 981504 —-a-w- C:\Windows\SysWow64\wininet.dll 2011-11-05 03:32:47 1638912 —-a-w- C:\Windows\System32\mshtml.tlb 2011-11-05 02:48:51 1638912 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2011-10-26 05:21:20 43520 —-a-w- C:\Windows\System32\csrsrv.dll 2011-10-24 20:29:02 94208 —-a-w- C:\Windows\SysWow64\QuickTimeVR.qtx 2011-10-24 20:29:02 69632 —-a-w- C:\Windows\SysWow64\QuickTime.qts 2011-10-03 11:06:03 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2011-09-29 16:29:28 1923952 —-a-w- C:\Windows\System32\drivers\tcpip.sys . ============= FINISH: 9:14:37.87 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_11-03-05.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 3/12/2010 12:35:19 PM System Uptime: 12/17/2011 9:02:46 AM (0 hours ago) . Motherboard: Dell Inc. | | 03D1TV Processor: AMD Athlon™ Neo X2 Dual Core Processor 6850e | CPU 1 | 1800/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 283 GiB total, 250.629 GiB free. D: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Dell Wireless 1520 Wireless-N WLAN Mini-Card Device ID: PCI\VEN_14E4&DEV_4353&SUBSYS_000E1028&REV_01\4&243BA753&0&0028 Manufacturer: Broadcom Name: Dell Wireless 1520 Wireless-N WLAN Mini-Card PNP Device ID: PCI\VEN_14E4&DEV_4353&SUBSYS_000E1028&REV_01\4&243BA753&0&0028 Service: BCM43XX . ==== System Restore Points =================== . No restore point in system. . ==== Installed Programs ====================== . Adobe AIR Adobe Reader X (10.1.1) Apple Application Support Apple Software Update ATI Catalyst Control Center avast! Free Antivirus Banctec Service Agreement Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Common Catalyst Control Center Graphics Previews Vista Catalyst Control Center InstallProxy Catalyst Control Center Localization All ccc-core-static CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help English CCC Help French CCC Help German CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Portuguese CCC Help Spanish CCC Help Turkish Cisco EAP-FAST Module Cisco LEAP Module Cisco PEAP Module Compatibility Pack for the 2007 Office system D3DX10 Dell DataSafe Local Backup Dell DataSafe Local Backup - Support Software Dell DataSafe Online Dell Getting Started Guide Dell Remote Access ESET Online Scanner v3 Google Chrome Google Earth Google Update Helper GoToAssist 8.0.0.514 Java Auto Updater Java™ 6 Update 29 Junk Mail filter update Malwarebytes' Anti-Malware version 1.51.2.1300 Microsoft Office PowerPoint Viewer 2007 (English) Microsoft Office Word Viewer 2003 Microsoft Search Enhancement Pack Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable - KB2467175 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 Microsoft Works MSVCRT MSVCRT_amd64 PowerDVD DX QuickTime Roxio Burn Secunia PSI (2.0.0.4003) Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Skins Spelling Dictionaries Support For Adobe Reader 9 Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Windows Live Communications Platform Windows Live Essentials Windows Live Installer Windows Live Mail Windows Live Messenger Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live Sync Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources Yahoo! BrowserPlus 2.9.8 . ==== Event Viewer Messages From Past Week ======== . 12/17/2011 9:03:20 AM, Error: Service Control Manager [7003] - The Internet Connection Sharing (ICS) service depends the following service: BFE. This service might not be installed. 12/17/2011 9:03:18 AM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service. 12/17/2011 9:03:17 AM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed. 12/17/2011 9:03:17 AM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed. 12/17/2011 9:03:10 AM, Error: atikmdag [52236] - CPLIB :: General - Invalid Parameter 12/17/2011 9:03:10 AM, Error: atikmdag [43029] - Display is not active 12/16/2011 9:23:15 PM, Error: volsnap [14] - The shadow copies of volume C: were aborted because of an IO failure on volume C:. 12/16/2011 7:56:00 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect. 12/16/2011 7:43:54 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000003b (0x00000000c0000005, 0xfffff80002e01dd3, 0xfffff880034c3a10, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 121611-17659-01. 12/16/2011 6:17:30 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the RasMan service. 12/16/2011 6:17:00 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the MMCSS service. 12/16/2011 6:17:00 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the hnmsvc service. 12/16/2011 6:16:30 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the EapHost service. 12/16/2011 6:15:30 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the gpsvc service. 12/16/2011 6:15:00 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the BITS service. 12/16/2011 6:14:30 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the wuauserv service. 12/16/2011 6:14:00 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Appinfo service. 12/16/2011 6:13:02 PM, Error: NetBT [4321] - The name "OWNER-WORK :0" could not be registered on the interface with IP address 192.168.0.20. The computer with the IP address 192.168.0.18 did not allow the name to be claimed by this computer. 12/16/2011 5:39:24 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000003b (0x00000000c0000005, 0xfffff80002df9dd3, 0xfffff88002657a10, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 121611-37783-01. 12/16/2011 5:31:42 PM, Error: Microsoft-Windows-WMPNSS-Service [14353] - A media delivery engine with ID '0' was not initialized due to error '0x80070005' when adding the URL 'http://+:10243/WMPNSSv4/938658039/'. Restart your computer, and then restart the WMPNetworkSvc service. If the problem persists, reinstall Windows Media Player if possible. 12/16/2011 5:31:42 PM, Error: Microsoft-Windows-WMPNSS-Service [14349] - A new media server was not initialized because the Windows Media Delivery Engine did not initialize due to error '0x80070005'. Restart your computer, and then restart the WMPNetworkSvc service. If the problem persists, reinstall Windows Media Player if possible. 12/16/2011 4:12:29 PM, Error: NetBT [4321] - The name "BLACKIE :0" could not be registered on the interface with IP address 192.168.0.20. The computer with the IP address 192.168.0.42 did not allow the name to be claimed by this computer. 12/16/2011 10:29:31 PM, Error: NetBT [4321] - The name "INSPIRE :0" could not be registered on the interface with IP address 192.168.0.20. The computer with the IP address 192.168.0.17 did not allow the name to be claimed by this computer. 12/16/2011 10:09:51 PM, Error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0. 12/16/2011 10:05:23 AM, Error: VDS Basic Provider [1] - Unexpected failure. Error code: D@01010004 12/16/2011 10:05:12 AM, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 12/15/2011 11:09:45 AM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. 12/15/2011 11:05:29 AM, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver. 12/14/2011 3:24:56 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F} 12/14/2011 3:24:56 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF} 12/14/2011 2:12:27 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\System32\bcmihvsrv64.dll Error Code: 21 12/14/2011 2:07:49 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030} 12/14/2011 2:07:49 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} 12/14/2011 2:07:48 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 12/14/2011 2:07:41 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC} 12/14/2011 2:07:36 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache spldr Wanarpv6 12/14/2011 2:07:36 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start. 12/14/2011 2:00:03 PM, Error: Service Control Manager [7000] - The Windows Presentation Foundation Font Cache 3.0.0.0 service failed to start due to the following error: A device attached to the system is not functioning. 12/11/2011 4:29:55 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:00:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89} 12/11/2011 4:00:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E} 12/11/2011 4:00:00 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr Tcpip tdx vwififlt Wanarpv6 WfpLwf 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The TCP/IP Registry Compatibility service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning. 12/11/2011 4:00:00 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning. . ==== End Of File ===========================