Ping.exe with OTL Scan Log included [Closed]

Sooo, i have been fumbling with this Ping.exe virus for the past 3 days's i have run MBAM 5 time's and every time it finds something and supposedly get's rid of it. But the ping.exe just stays there. I noticed alot of people are having issues with this, when its running my CPU % goes up to 99 and most of my memory gets used, and my Google pages redirect all the time. Here is the OTL Log's:

OTL.TXT -
OTL logfile created on: 12/23/2011 12:51:11 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\lathem\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19170)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.23 Gb Available Physical Memory | 74.46% Memory free
6.23 Gb Paging File | 5.18 Gb Available in Paging File | 83.11% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.04 Gb Total Space | 99.90 Gb Free Space | 34.68% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.72 Gb Free Space | 57.23% Space Free | Partition Type: NTFS

Computer Name: ETHAN | User Name: lathem | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\lathem\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Hi-Rez Studios\HiPatchService.exe (Hi-Rez Studios)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
PRC - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation)
PRC - C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation)
PRC - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\PING.EXE (Microsoft Corporation)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Windows\System32\libusbd-nt.exe (http://libusb-win32.sourceforge.net)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Mozilla Firefox\js3250.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files\WinRAR\RarExt.dll ()
MOD - \\.\globalroot\systemroot\system32\mswsock.dll ()


========== Win32 Services (SafeList) ==========

SRV - (XMLProvS) – File not found
SRV - (Movielink Core Service) – File not found
SRV - (GoToAssist) – File not found
SRV - (FastUserSwitchingCompatibility) – File not found
SRV - (HiPatchService) – C:\Program Files\Hi-Rez Studios\HiPatchService.exe (Hi-Rez Studios)
SRV - (Steam Client Service) – C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (Hamachi2Svc) – C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (nvUpdatusService) – C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) – C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter) – C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (libusbd) – C:\Windows\System32\libusbd-nt.exe (http://libusb-win32.sourceforge.net)


========== Driver Services (SafeList) ==========

DRV - (MBAMProtector) – C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (NVHDA) – C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (IDMWFP) – C:\Windows\System32\drivers\idmwfp.sys (Tonec Inc.)
DRV - (LMIRfsClientNP) – C:\Windows\System32\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV - (LMIRfsDriver) – C:\Windows\System32\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV - (SCDEmu) – C:\Windows\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (sptd) – C:\Windows\System32\Drivers\sptd.sys ()
DRV - (Smb) Message-oriented TCP/IP and TCP/IPv6 Protocol (SMB session) – C:\Windows\System32\drivers\smb.sys ()
DRV - (hamachi) – C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (Mo3Fltr) – C:\Windows\System32\drivers\Mo3Fltr.sys ()
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (irsir) – C:\Windows\System32\drivers\irsir.sys (Microsoft Corporation)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (LMouFilt) – C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (NAL) – C:\Windows\System32\drivers\iqvw32.sys (Intel Corporation )
DRV - (HSXHWBS2) – C:\Windows\System32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.)
DRV - (XAudio) – C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (libusb0) – C:\Windows\System32\drivers\libusb0.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://toolbar.inbox.com/help/sa_customize.aspx?tbid=80229
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://toolbar.inbox.com/search/ie.aspx?tbid=80229
IE - HKLM\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
IE - HKLM\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&cl…amp;ibd=1080711
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.com/
IE - HKCU\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Winamp Search"
FF - prefs.js..browser.search.defaultthis.engineName: " "
FF - prefs.js..browser.search.defaulturl: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query="
FF - prefs.js..browser.search.selectedEngine: "Winamp Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.clanaod.net/forums/index.php"
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6778
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:[removed]
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.6.20090220
FF - prefs.js..extensions.enabledItems: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:7.2.3
FF - prefs.js..extensions.enabledItems: {ab91efd4-6975-4081-8552-1b3922ed79e2}:[removed]
FF - prefs.js..extensions.enabledItems: unplug@compunach:2.050
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:[removed]
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.8.0.8855
FF - prefs.js..keyword.URL: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query="
FF - prefs.js..network.proxy.type: 0


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@iWon.com/Plugin: C:\Program Files\iWon\bar\1.bin\NPjfStub.dll File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@mywebsearch.com/Plugin: C:\Program Files\MyWebSearch\bar\1.bin\NPMyWebS.dll File not found
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@eximion.com/KalydoPlayer3.09.00: C:\Users\lathem\AppData\Roaming\Kalydo\KalydoPlayer\npkalydo.dll (Eximion B.V.)
FF - HKCU\Software\MozillaPlugins\@SparkplayMedia.com/Sparkplayer (Beta): C:\Users\lathem\Documents\Sparkplay Media\Sparkplayer (Beta)\npSparkPlayerNS.dll ()
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\lathem\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2009/04/15 20:18:27 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}: C:\PROGRA~1\Crawler\Toolbar\firefox\ [2009/12/22 09:29:48 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\iWon\bar\1.bin
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\MyWebSearch\bar\1.bin
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011/10/30 17:33:44 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.25\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/12/23 10:37:17 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.25\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/12/23 10:37:16 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}: C:\Program Files\PriceGong\2.1.0\FF
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Users\lathem\AppData\Roaming\IDM\idmmzcc3 [2011/03/07 19:00:43 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\SeaMonkey\Extensions\\[removed]: C:\Users\lathem\AppData\Roaming\IDM\idmmzcc3 [2011/03/07 19:00:43 | 000,000,000 | —D | M]

[2010/04/12 20:10:07 | 000,000,000 | —D | M] (No name found) – C:\Users\lathem\AppData\Roaming\Mozilla\Extensions
[2011/12/23 07:57:26 | 000,000,000 | —D | M] (No name found) – C:\Users\lathem\AppData\Roaming\Mozilla\Firefox\Profiles\6kde0878.default\extensions
[2011/03/14 13:47:48 | 000,000,000 | —D | M] (Winamp Toolbar) – C:\Users\lathem\AppData\Roaming\Mozilla\Firefox\Profiles\6kde0878.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2010/04/28 21:39:37 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\lathem\AppData\Roaming\Mozilla\Firefox\Profiles\6kde0878.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/04/27 21:21:20 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\lathem\AppData\Roaming\Mozilla\Firefox\Profiles\6kde0878.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/07/19 00:17:13 | 000,000,000 | —D | M] (HP Detect) – C:\Users\lathem\AppData\Roaming\Mozilla\Firefox\Profiles\6kde0878.default\extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}
[2011/02/22 17:51:47 | 000,000,000 | —D | M] (uTorrentBar Community Toolbar) – C:\Users\lathem\AppData\Roaming\Mozilla\Firefox\Profiles\6kde0878.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2011/02/22 17:51:47 | 000,000,000 | —D | M] (Conduit Engine) – C:\Users\lathem\AppData\Roaming\Mozilla\Firefox\Profiles\6kde0878.default\extensions\[removed]
[2011/02/27 01:08:00 | 000,000,000 | —D | M] (Search Toolbar) – C:\Users\lathem\AppData\Roaming\Mozilla\Firefox\Profiles\6kde0878.default\extensions\[removed]
[2011/09/20 10:44:53 | 000,000,000 | —D | M] ("UnPlug") – C:\Users\lathem\AppData\Roaming\Mozilla\Firefox\Profiles\6kde0878.default\extensions\unplug@compunach
[2011/02/27 01:08:01 | 000,001,919 | —- | M] () – C:\Users\lathem\AppData\Roaming\Mozilla\Firefox\Profiles\6kde0878.default\searchplugins\bing-zugo.xml
[2011/02/22 17:52:28 | 000,000,863 | —- | M] () – C:\Users\lathem\AppData\Roaming\Mozilla\Firefox\Profiles\6kde0878.default\searchplugins\conduit.xml
[2010/10/03 21:14:44 | 000,010,025 | —- | M] () – C:\Users\lathem\AppData\Roaming\Mozilla\Firefox\Profiles\6kde0878.default\searchplugins\mywebsearch.xml
[2011/03/14 14:22:33 | 000,001,196 | —- | M] () – C:\Users\lathem\AppData\Roaming\Mozilla\Firefox\Profiles\6kde0878.default\searchplugins\winamp-search.xml
[2011/12/10 12:54:27 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/12/10 12:54:28 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2010/12/20 00:29:02 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2011/10/30 17:33:44 | 000,000,000 | —D | M] (DivX Plus Web Player HTML5 ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
File not found (No name found) – C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{AB2CE124-6272-4B12-94A9-7303C7397BD1}
[2011/03/07 19:00:43 | 000,000,000 | —D | M] (IDM CC) – C:\USERS\LATHEM\APPDATA\ROAMING\IDM\IDMMZCC3
[2010/04/12 17:29:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/12/09 04:47:06 | 000,012,800 | —- | M] (Nullsoft, Inc.) – C:\Program Files\mozilla firefox\plugins\npwachk.dll

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl={language}&q={searchTerms}
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.106\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.106\gears.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.106\gcswf32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Acrobat 5.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java™ Platform SE 6 U20 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.0.51204.0\npctrl.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: iWon Toolbar Plugin Stub (Enabled) = C:\Program Files\iWon\bar\1.bin\NPjfStub.dll
CHR - plugin: Sparkplayer (Beta) (Enabled) = C:\Users\lathem\Documents\Sparkplay Media\Sparkplayer (Beta)\npSparkPlayerNS.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Entanglement = C:\Users\lathem\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd\2.1.1_0\
CHR - Extension: Poppit = C:\Users\lathem\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi\2.2_0\
CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo\u003E = C:\Users\lathem\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.126_0\

Hosts file not found
O2 - BHO: (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.)
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (PriceGongBHO Class) - {1631550F-191D-4826-B069-D9439253D926} - C:\Program Files\PriceGong\2.1.0\PriceGongIE.dll File not found
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll File not found
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll (Google Inc.)
O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (no name) - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\PROGRA~1\INBOXT~1\Inbox.dll File not found
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll File not found
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKLM\..\Toolbar: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O3 - HKLM\..\Toolbar: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O3 - HKLM\..\Toolbar: (&Inbox Toolbar) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\PROGRA~1\INBOXT~1\Inbox.dll File not found
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKCU\..\Toolbar\WebBrowser: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (uTorrentBar Toolbar) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (&Inbox Toolbar) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\PROGRA~1\INBOXT~1\Inbox.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm ()
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm ()
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm ()
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000030 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000031 - %SystemRoot%\System32\winrnr.dll File not found
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (Intertrust Technologies, Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = o
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5F44DC27-BC9E-4F56-937F-D1AB76C410BC}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BE28EF96-0BAC-4D54-AA73-72DBBB87C720}: DhcpNameServer = 10.0.0.1
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\inbox {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\PROGRA~1\INBOXT~1\Inbox.dll File not found
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\tbr {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) -C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll) - File not found
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img4.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img4.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 15:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{0a2e57f6-557a-11df-80b5-001d099ca4f2}\Shell - "" = AutoRun
O33 - MountPoints2\{0a2e57f6-557a-11df-80b5-001d099ca4f2}\Shell\AutoRun\command - "" = K:\iStudio.exe
O33 - MountPoints2\{1e74f5b1-0f14-11df-a7f0-001d099ca4f2}\Shell - "" = AutoRun
O33 - MountPoints2\{1e74f5b1-0f14-11df-a7f0-001d099ca4f2}\Shell\AutoRun\command - "" = F:\AUTORUN.EXE
O33 - MountPoints2\{7e063a6d-1d37-11df-b90f-001d099ca4f2}\Shell - "" = AutoRun
O33 - MountPoints2\{7e063a6d-1d37-11df-b90f-001d099ca4f2}\Shell\AutoRun\command - "" = N:\LaunchU3.exe -a
O33 - MountPoints2\{d02d106f-b565-11e0-bd27-001d099ca4f2}\Shell - "" = AutoRun
O33 - MountPoints2\{d02d106f-b565-11e0-bd27-001d099ca4f2}\Shell\AutoRun\command - "" = P:\LaunchU3.exe -a
O33 - MountPoints2\N\Shell - "" = AutoRun
O33 - MountPoints2\N\Shell\AutoRun\command - "" = N:\TC2MInstall.exe
O33 - MountPoints2\P\Shell - "" = AutoRun
O33 - MountPoints2\P\Shell\AutoRun\command - "" = P:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – Reg Error: Key error. File not found

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.ac3acm - C:\Windows\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.bdmpeg - C:\Windows\System32\bdmpega.acm ()
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: msacm.lhacm - C:\Windows\System32\lhacm.acm (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: vidc.mpeg - C:\Windows\System32\bdmpegv.dll ()
Drivers32: VIDC.XFR1 - C:\Windows\System32\xfcodec.dll ()
Drivers32: VIDC.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\System32\yv12vfw.dll (www.helixcommunity.org)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/12/23 12:50:18 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\lathem\Desktop\OTL.exe
[2011/12/22 07:29:37 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2011/12/22 07:29:37 | 000,000,000 | —D | C] – C:\Program Files\LogMeIn Hamachi
[2011/12/16 08:06:05 | 000,000,000 | —D | C] – C:\Users\lathem\AppData\Local\SWTOR
[2011/12/15 09:56:10 | 003,602,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2011/12/15 09:56:09 | 003,550,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2011/12/15 09:56:08 | 000,429,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\EncDec.dll
[2011/12/15 09:56:06 | 002,043,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/12/15 09:56:01 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2011/12/15 09:55:56 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\csrsrv.dll
[2011/12/15 09:55:54 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/12/15 09:55:52 | 000,105,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/12/15 09:55:50 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/12/15 09:55:50 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/12/15 09:55:50 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/12/15 09:55:50 | 000,602,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/12/15 09:55:50 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/12/15 09:55:50 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/12/15 09:55:50 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/12/15 09:55:50 | 000,174,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/12/15 09:55:50 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/12/15 09:55:50 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/12/15 09:55:50 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/12/15 09:55:50 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2011/12/15 09:55:50 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2011/12/15 09:55:50 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/12/15 09:55:50 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/12/15 09:55:50 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/12/12 15:27:39 | 000,000,000 | —D | C] – C:\Users\lathem\AppData\Local\Chromium
[2011/12/12 12:32:56 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hi-Rez Studios
[2011/12/12 12:32:50 | 000,000,000 | —D | C] – C:\Program Files\Hi-Rez Studios
[2011/12/10 12:53:41 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011/12/08 03:43:13 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA
[2011/12/08 03:27:20 | 000,000,000 | —D | C] – C:\Program Files\Electronic Arts
[2011/12/08 03:27:13 | 000,000,000 | —D | C] – C:\Users\lathem\AppData\Roaming\Origin
[2011/12/08 03:26:33 | 000,000,000 | —D | C] – C:\Users\lathem\AppData\Local\Origin
[2011/12/08 03:26:22 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
[2011/12/08 03:26:13 | 000,000,000 | —D | C] – C:\Program Files\Origin Games
[2011/12/08 03:26:02 | 000,000,000 | —D | C] – C:\Program Files\Origin
[2011/12/07 10:48:49 | 000,000,000 | —D | C] – C:\Users\lathem\Documents\Stronghold Kingdoms
[2011/12/01 13:01:12 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011/12/01 13:00:55 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2011/12/01 12:57:54 | 000,000,000 | —D | C] – C:\Program Files\Apple Software Update
[2011/11/26 08:59:56 | 000,000,000 | —D | C] – C:\Users\lathem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Fix
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/12/23 12:49:51 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\lathem\Desktop\OTL.exe
[2011/12/23 12:39:31 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/12/23 12:39:31 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/12/23 12:15:01 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/23 12:06:00 | 000,000,354 | —- | M] () – C:\Windows\tasks\At26.job
[2011/12/23 12:06:00 | 000,000,352 | —- | M] () – C:\Windows\tasks\At25.job
[2011/12/23 11:06:04 | 000,000,354 | —- | M] () – C:\Windows\tasks\At24.job
[2011/12/23 11:06:01 | 000,000,352 | —- | M] () – C:\Windows\tasks\At23.job
[2011/12/23 10:45:10 | 000,915,156 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/12/23 10:45:10 | 000,210,382 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/12/23 10:40:41 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/23 10:40:29 | 000,000,352 | —- | M] () – C:\Windows\tasks\At17.job
[2011/12/23 10:40:26 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/12/23 10:06:00 | 000,000,354 | —- | M] () – C:\Windows\tasks\At22.job
[2011/12/23 10:06:00 | 000,000,352 | —- | M] () – C:\Windows\tasks\At21.job
[2011/12/23 09:06:00 | 000,000,354 | —- | M] () – C:\Windows\tasks\At20.job
[2011/12/23 09:06:00 | 000,000,352 | —- | M] () – C:\Windows\tasks\At19.job
[2011/12/23 08:25:53 | 000,000,420 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{41F7D201-9173-47E0-9167-17E82134E3D9}.job
[2011/12/23 08:06:00 | 000,000,354 | —- | M] () – C:\Windows\tasks\At18.job
[2011/12/23 07:31:44 | 000,000,354 | —- | M] () – C:\Windows\tasks\At8.job
[2011/12/23 07:31:44 | 000,000,354 | —- | M] () – C:\Windows\tasks\At6.job
[2011/12/23 07:31:44 | 000,000,354 | —- | M] () – C:\Windows\tasks\At4.job
[2011/12/23 07:31:44 | 000,000,354 | —- | M] () – C:\Windows\tasks\At16.job
[2011/12/23 07:31:44 | 000,000,354 | —- | M] () – C:\Windows\tasks\At14.job
[2011/12/23 07:31:44 | 000,000,354 | —- | M] () – C:\Windows\tasks\At12.job
[2011/12/23 07:31:44 | 000,000,354 | —- | M] () – C:\Windows\tasks\At10.job
[2011/12/23 07:31:44 | 000,000,352 | —- | M] () – C:\Windows\tasks\At9.job
[2011/12/23 07:31:44 | 000,000,352 | —- | M] () – C:\Windows\tasks\At7.job
[2011/12/23 07:31:44 | 000,000,352 | —- | M] () – C:\Windows\tasks\At5.job
[2011/12/23 07:31:44 | 000,000,352 | —- | M] () – C:\Windows\tasks\At3.job
[2011/12/23 07:31:44 | 000,000,352 | —- | M] () – C:\Windows\tasks\At15.job
[2011/12/23 07:31:44 | 000,000,352 | —- | M] () – C:\Windows\tasks\At13.job
[2011/12/23 07:31:44 | 000,000,352 | —- | M] () – C:\Windows\tasks\At11.job
[2011/12/23 07:31:43 | 000,000,354 | —- | M] () – C:\Windows\tasks\At48.job
[2011/12/23 07:31:43 | 000,000,354 | —- | M] () – C:\Windows\tasks\At46.job
[2011/12/23 07:31:43 | 000,000,354 | —- | M] () – C:\Windows\tasks\At44.job
[2011/12/23 07:31:43 | 000,000,354 | —- | M] () – C:\Windows\tasks\At2.job
[2011/12/23 07:31:43 | 000,000,352 | —- | M] () – C:\Windows\tasks\At47.job
[2011/12/23 07:31:43 | 000,000,352 | —- | M] () – C:\Windows\tasks\At45.job
[2011/12/23 07:31:43 | 000,000,352 | —- | M] () – C:\Windows\tasks\At43.job
[2011/12/23 07:31:43 | 000,000,352 | —- | M] () – C:\Windows\tasks\At1.job
[2011/12/22 20:06:00 | 000,000,354 | —- | M] () – C:\Windows\tasks\At42.job
[2011/12/22 20:06:00 | 000,000,352 | —- | M] () – C:\Windows\tasks\At41.job
[2011/12/22 19:06:00 | 000,000,354 | —- | M] () – C:\Windows\tasks\At40.job
[2011/12/22 19:06:00 | 000,000,352 | —- | M] () – C:\Windows\tasks\At39.job
[2011/12/22 18:06:00 | 000,000,354 | —- | M] () – C:\Windows\tasks\At38.job
[2011/12/22 18:06:00 | 000,000,352 | —- | M] () – C:\Windows\tasks\At37.job
[2011/12/22 17:06:00 | 000,000,354 | —- | M] () – C:\Windows\tasks\At36.job
[2011/12/22 17:06:00 | 000,000,352 | —- | M] () – C:\Windows\tasks\At35.job
[2011/12/22 16:06:00 | 000,000,354 | —- | M] () – C:\Windows\tasks\At34.job
[2011/12/22 16:06:00 | 000,000,352 | —- | M] () – C:\Windows\tasks\At33.job
[2011/12/22 15:26:00 | 000,000,562 | —- | M] () – C:\Windows\tasks\Norton Security Scan for Aaron's.job
[2011/12/22 15:06:00 | 000,000,354 | —- | M] () – C:\Windows\tasks\At32.job
[2011/12/22 15:06:00 | 000,000,352 | —- | M] () – C:\Windows\tasks\At31.job
[2011/12/22 14:06:00 | 000,000,354 | —- | M] () – C:\Windows\tasks\At30.job
[2011/12/22 14:06:00 | 000,000,352 | —- | M] () – C:\Windows\tasks\At29.job
[2011/12/22 13:06:00 | 000,000,354 | —- | M] () – C:\Windows\tasks\At28.job
[2011/12/22 13:06:00 | 000,000,352 | —- | M] () – C:\Windows\tasks\At27.job
[2011/12/17 20:36:46 | 000,057,344 | —- | M] () – C:\Users\lathem\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/16 09:47:50 | 221,850,716 | —- | M] () – C:\Windows\MEMORY.DMP
[2011/12/16 08:44:49 | 000,000,112 | —- | M] () – C:\ProgramData\mTpGv5Pg.dat
[2011/12/16 08:24:40 | 000,000,000 | —- | M] () – C:\Windows\System32\17V1con7P.com.b
[2011/12/16 08:20:52 | 000,103,365 | —- | M] () – C:\Windows\System32\itusbcore.dat
[2011/12/16 08:20:52 | 000,000,197 | —- | M] () – C:\Windows\System32\itlsvc.dat
[2011/12/16 03:26:26 | 000,277,184 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/12/15 20:00:34 | 000,001,074 | -HS- | M] () – C:\Users\lathem\AppData\Local\wrtxqe4s5omf0cvp3ugj1w488u8g
[2011/12/15 20:00:34 | 000,001,074 | -HS- | M] () – C:\ProgramData\wrtxqe4s5omf0cvp3ugj1w488u8g
[2011/12/12 13:09:50 | 000,001,806 | —- | M] () – C:\Users\Public\Desktop\Tribes Ascend.lnk
[2011/12/12 12:32:56 | 000,001,808 | —- | M] () – C:\Users\Public\Desktop\Hi-Command.lnk
[2011/12/12 11:46:45 | 000,001,261 | —- | M] () – C:\Users\lathem\Desktop\Star Wars - The Old Republic.lnk
[2011/12/08 03:26:22 | 000,000,769 | —- | M] () – C:\Users\Public\Desktop\Origin.lnk
[2011/12/06 15:21:20 | 000,001,757 | —- | M] () – C:\Users\lathem\Desktop\Mozilla Firefox.lnk
[2011/12/06 14:24:30 | 000,008,622 | -HS- | M] () – C:\Users\lathem\AppData\Local\261bne73l573x
[2011/12/06 14:24:30 | 000,008,622 | -HS- | M] () – C:\ProgramData\261bne73l573x
[2011/11/29 13:24:12 | 000,000,003 | —- | M] () – C:\Windows\System32\HRUPPROG.DIE.NOW
[2011/11/26 14:40:00 | 000,000,827 | —- | M] () – C:\Users\lathem\Application Data\Microsoft\Internet Explorer\Quick Launch\Winamp.lnk
[2011/11/26 14:39:57 | 000,000,827 | —- | M] () – C:\Users\lathem\Desktop\Winamp.lnk
[2011/11/26 14:39:38 | 000,000,910 | —- | M] () – C:\Users\lathem\Application Data\Microsoft\Internet Explorer\Quick Launch\VLC media player.lnk
[2011/11/26 14:39:33 | 000,000,910 | —- | M] () – C:\Users\lathem\Desktop\VLC media player.lnk
[2011/11/26 14:39:19 | 000,000,772 | —- | M] () – C:\Users\lathem\Application Data\Microsoft\Internet Explorer\Quick Launch\Ventrilo.lnk
[2011/11/26 14:39:07 | 000,000,772 | —- | M] () – C:\Users\lathem\Desktop\Ventrilo.lnk
[2011/11/26 14:30:40 | 000,000,629 | —- | M] () – C:\Users\lathem\Application Data\Microsoft\Internet Explorer\Quick Launch\Play League of Legends.lnk
[2011/11/26 14:30:34 | 000,001,775 | —- | M] () – C:\Users\lathem\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/11/26 09:25:05 | 000,002,032 | —- | M] () – C:\Users\lathem\AppData\Local\d3d9caps.dat
[2011/11/26 09:06:07 | 000,000,456 | —- | M] () – C:\ProgramData\ptWwgKhlkQeXWE
[2011/11/26 09:05:03 | 000,000,320 | —- | M] () – C:\ProgramData\~ptWwgKhlkQeXWE
[2011/11/26 09:05:03 | 000,000,224 | —- | M] () – C:\ProgramData\~ptWwgKhlkQeXWEr
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/16 09:47:50 | 221,850,716 | —- | C] () – C:\Windows\MEMORY.DMP
[2011/12/16 08:24:40 | 000,000,000 | —- | C] () – C:\Windows\System32\17V1con7P.com.b
[2011/12/16 08:20:52 | 000,103,365 | —- | C] () – C:\Windows\System32\itusbcore.dat
[2011/12/16 08:20:52 | 000,000,197 | —- | C] () – C:\Windows\System32\itlsvc.dat
[2011/12/16 08:17:12 | 000,000,112 | —- | C] () – C:\ProgramData\mTpGv5Pg.dat
[2011/12/16 08:17:11 | 000,000,354 | —- | C] () – C:\Windows\tasks\At48.job
[2011/12/16 08:17:10 | 000,000,354 | —- | C] () – C:\Windows\tasks\At46.job
[2011/12/16 08:17:10 | 000,000,352 | —- | C] () – C:\Windows\tasks\At47.job
[2011/12/16 08:17:09 | 000,000,354 | —- | C] () – C:\Windows\tasks\At44.job
[2011/12/16 08:17:09 | 000,000,352 | —- | C] () – C:\Windows\tasks\At45.job
[2011/12/16 08:17:09 | 000,000,352 | —- | C] () – C:\Windows\tasks\At43.job
[2011/12/16 08:17:08 | 000,000,354 | —- | C] () – C:\Windows\tasks\At42.job
[2011/12/16 08:17:08 | 000,000,354 | —- | C] () – C:\Windows\tasks\At40.job
[2011/12/16 08:17:08 | 000,000,352 | —- | C] () – C:\Windows\tasks\At41.job
[2011/12/16 08:17:07 | 000,000,354 | —- | C] () – C:\Windows\tasks\At38.job
[2011/12/16 08:17:07 | 000,000,352 | —- | C] () – C:\Windows\tasks\At39.job
[2011/12/16 08:17:06 | 000,000,354 | —- | C] () – C:\Windows\tasks\At36.job
[2011/12/16 08:17:06 | 000,000,352 | —- | C] () – C:\Windows\tasks\At37.job
[2011/12/16 08:17:06 | 000,000,352 | —- | C] () – C:\Windows\tasks\At35.job
[2011/12/16 08:17:05 | 000,000,354 | —- | C] () – C:\Windows\tasks\At34.job
[2011/12/16 08:17:05 | 000,000,354 | —- | C] () – C:\Windows\tasks\At32.job
[2011/12/16 08:17:05 | 000,000,352 | —- | C] () – C:\Windows\tasks\At33.job
[2011/12/16 08:17:04 | 000,000,354 | —- | C] () – C:\Windows\tasks\At30.job
[2011/12/16 08:17:04 | 000,000,352 | —- | C] () – C:\Windows\tasks\At31.job
[2011/12/16 08:17:04 | 000,000,352 | —- | C] () – C:\Windows\tasks\At29.job
[2011/12/16 08:17:03 | 000,000,354 | —- | C] () – C:\Windows\tasks\At28.job
[2011/12/16 08:17:03 | 000,000,352 | —- | C] () – C:\Windows\tasks\At27.job
[2011/12/16 08:17:02 | 000,000,354 | —- | C] () – C:\Windows\tasks\At26.job
[2011/12/16 08:17:02 | 000,000,354 | —- | C] () – C:\Windows\tasks\At24.job
[2011/12/16 08:17:02 | 000,000,352 | —- | C] () – C:\Windows\tasks\At25.job
[2011/12/16 08:17:01 | 000,000,354 | —- | C] () – C:\Windows\tasks\At22.job
[2011/12/16 08:17:01 | 000,000,352 | —- | C] () – C:\Windows\tasks\At23.job
[2011/12/16 08:17:00 | 000,000,354 | —- | C] () – C:\Windows\tasks\At20.job
[2011/12/16 08:17:00 | 000,000,352 | —- | C] () – C:\Windows\tasks\At21.job
[2011/12/16 08:17:00 | 000,000,352 | —- | C] () – C:\Windows\tasks\At19.job
[2011/12/16 08:16:59 | 000,000,354 | —- | C] () – C:\Windows\tasks\At18.job
[2011/12/16 08:16:59 | 000,000,354 | —- | C] () – C:\Windows\tasks\At16.job
[2011/12/16 08:16:59 | 000,000,352 | —- | C] () – C:\Windows\tasks\At17.job
[2011/12/16 08:16:58 | 000,000,354 | —- | C] () – C:\Windows\tasks\At14.job
[2011/12/16 08:16:58 | 000,000,352 | —- | C] () – C:\Windows\tasks\At15.job
[2011/12/16 08:16:57 | 000,000,354 | —- | C] () – C:\Windows\tasks\At12.job
[2011/12/16 08:16:57 | 000,000,352 | —- | C] () – C:\Windows\tasks\At13.job
[2011/12/16 08:16:56 | 000,000,352 | —- | C] () – C:\Windows\tasks\At11.job
[2011/12/16 08:16:55 | 000,000,354 | —- | C] () – C:\Windows\tasks\At10.job
[2011/12/16 08:16:55 | 000,000,352 | —- | C] () – C:\Windows\tasks\At9.job
[2011/12/16 08:16:54 | 000,000,354 | —- | C] () – C:\Windows\tasks\At8.job
[2011/12/16 08:16:54 | 000,000,352 | —- | C] () – C:\Windows\tasks\At7.job
[2011/12/16 08:16:53 | 000,000,354 | —- | C] () – C:\Windows\tasks\At6.job
[2011/12/16 08:16:53 | 000,000,354 | —- | C] () – C:\Windows\tasks\At4.job
[2011/12/16 08:16:53 | 000,000,352 | —- | C] () – C:\Windows\tasks\At5.job
[2011/12/16 08:16:52 | 000,000,354 | —- | C] () – C:\Windows\tasks\At2.job
[2011/12/16 08:16:52 | 000,000,352 | —- | C] () – C:\Windows\tasks\At3.job
[2011/12/16 08:16:51 | 000,000,352 | —- | C] () – C:\Windows\tasks\At1.job
[2011/12/15 20:00:34 | 000,001,074 | -HS- | C] () – C:\Users\lathem\AppData\Local\wrtxqe4s5omf0cvp3ugj1w488u8g
[2011/12/15 20:00:34 | 000,001,074 | -HS- | C] () – C:\ProgramData\wrtxqe4s5omf0cvp3ugj1w488u8g
[2011/12/12 13:09:50 | 000,001,806 | —- | C] () – C:\Users\Public\Desktop\Tribes Ascend.lnk
[2011/12/12 12:32:56 | 000,001,808 | —- | C] () – C:\Users\Public\Desktop\Hi-Command.lnk
[2011/12/12 11:46:45 | 000,001,261 | —- | C] () – C:\Users\lathem\Desktop\Star Wars - The Old Republic.lnk
[2011/12/08 03:26:22 | 000,000,769 | —- | C] () – C:\Users\Public\Desktop\Origin.lnk
[2011/12/06 15:29:49 | 000,001,212 | —- | C] () – C:\Users\lathem\Desktop\exefix_vista.reg
[2011/12/06 12:50:28 | 000,008,622 | -HS- | C] () – C:\Users\lathem\AppData\Local\261bne73l573x
[2011/12/06 12:50:28 | 000,008,622 | -HS- | C] () – C:\ProgramData\261bne73l573x
[2011/11/29 13:24:12 | 000,000,003 | —- | C] () – C:\Windows\System32\HRUPPROG.DIE.NOW
[2011/11/26 14:40:00 | 000,000,827 | —- | C] () – C:\Users\lathem\Application Data\Microsoft\Internet Explorer\Quick Launch\Winamp.lnk
[2011/11/26 14:39:57 | 000,000,827 | —- | C] () – C:\Users\lathem\Desktop\Winamp.lnk
[2011/11/26 14:39:38 | 000,000,910 | —- | C] () – C:\Users\lathem\Application Data\Microsoft\Internet Explorer\Quick Launch\VLC media player.lnk
[2011/11/26 14:39:33 | 000,000,910 | —- | C] () – C:\Users\lathem\Desktop\VLC media player.lnk
[2011/11/26 14:39:19 | 000,000,772 | —- | C] () – C:\Users\lathem\Application Data\Microsoft\Internet Explorer\Quick Launch\Ventrilo.lnk
[2011/11/26 14:39:07 | 000,000,772 | —- | C] () – C:\Users\lathem\Desktop\Ventrilo.lnk
[2011/11/26 14:30:40 | 000,000,629 | —- | C] () – C:\Users\lathem\Application Data\Microsoft\Internet Explorer\Quick Launch\Play League of Legends.lnk
[2011/11/26 14:30:34 | 000,001,775 | —- | C] () – C:\Users\lathem\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/11/26 09:00:01 | 000,000,320 | —- | C] () – C:\ProgramData\~ptWwgKhlkQeXWE
[2011/11/26 09:00:01 | 000,000,224 | —- | C] () – C:\ProgramData\~ptWwgKhlkQeXWEr
[2011/11/26 08:59:42 | 000,000,456 | —- | C] () – C:\ProgramData\ptWwgKhlkQeXWE
[2011/10/13 14:30:24 | 000,042,392 | —- | C] () – C:\Windows\System32\xfcodec.dll
[2011/09/27 15:38:00 | 000,000,127 | —- | C] () – C:\Windows\System32\MRT.INI
[2011/08/03 02:31:54 | 000,311,912 | —- | C] () – C:\Windows\System32\nvStreaming.exe
[2011/07/07 05:43:10 | 000,499,200 | —- | C] () – C:\Windows\System32\WZDPlay.dll
[2011/06/29 01:52:46 | 000,017,089 | —- | C] () – C:\Users\lathem\AppData\Roaming\UserTile.png
[2011/05/03 10:22:36 | 000,000,054 | —- | C] () – C:\Windows\Quicken.ini
[2011/04/09 17:55:28 | 000,179,261 | —- | C] () – C:\Windows\System32\xlive.dll.cat
[2011/02/28 10:06:31 | 000,153,703 | —- | C] () – C:\Windows\hphins26.dat.temp
[2011/02/28 10:06:31 | 000,000,787 | —- | C] () – C:\Windows\hphmdl26.dat.temp
[2011/02/27 10:55:36 | 000,153,703 | —- | C] () – C:\Windows\hphins26.dat
[2011/02/27 10:55:36 | 000,000,787 | —- | C] () – C:\Windows\hphmdl26.dat
[2011/02/10 22:10:25 | 000,002,032 | —- | C] () – C:\Users\lathem\AppData\Local\d3d9caps.dat
[2010/11/21 23:10:32 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/05/18 16:15:47 | 000,033,792 | —- | C] () – C:\Windows\System32\drivers\libusb0.sys
[2010/05/01 17:49:52 | 000,000,101 | —- | C] () – C:\Windows\lexstat.ini
[2010/05/01 17:49:34 | 000,086,016 | —- | C] () – C:\Windows\System32\LXBKIH.EXE
[2010/05/01 17:49:33 | 000,077,824 | —- | C] () – C:\Windows\System32\LXBKLCNP.DLL
[2010/05/01 17:49:33 | 000,040,960 | —- | C] () – C:\Windows\System32\INSTMON.EXE
[2010/05/01 17:49:32 | 000,040,960 | —- | C] () – C:\Windows\System32\lxbkvs.dll
[2010/04/14 22:30:42 | 000,000,005 | —- | C] () – C:\Windows\treeskp.sys
[2010/04/14 22:30:42 | 000,000,005 | —- | C] () – C:\Windows\sbacknt.bin
[2010/03/22 16:22:55 | 000,003,012 | —- | C] () – C:\Users\lathem\AppData\Roaming\wklnhst.dat
[2010/03/16 22:48:42 | 000,057,344 | —- | C] () – C:\Users\lathem\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/23 22:22:29 | 000,164,352 | —- | C] () – C:\Windows\System32\unrar.dll
[2009/12/23 22:22:28 | 000,000,038 | —- | C] () – C:\Windows\avisplitter.ini
[2009/12/23 22:22:26 | 000,007,680 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2009/12/18 01:54:45 | 000,755,027 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2009/12/18 01:54:45 | 000,159,839 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2009/12/03 07:56:11 | 000,001,847 | —- | C] () – C:\Windows\hpwmdl23.dat.temp
[2009/11/26 08:42:04 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2009/09/10 18:30:02 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/09/10 18:30:02 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/09/10 18:28:40 | 000,066,560 | —- | C] () – C:\Windows\System32\drivers\smb.sys
[2009/08/03 14:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 14:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/07/08 19:03:02 | 000,058,880 | —- | C] () – C:\Windows\System32\bdmpegv.dll
[2009/06/14 20:29:36 | 000,011,136 | —- | C] () – C:\Windows\System32\drivers\Mo3Fltr.sys
[2009/04/15 19:42:17 | 000,186,583 | —- | C] () – C:\Windows\hpwins23.dat
[2009/04/14 02:00:50 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/10/25 03:30:45 | 000,001,847 | —- | C] () – C:\Windows\hpwmdl23.dat
[2008/07/11 03:40:03 | 003,107,788 | —- | C] () – C:\Windows\System32\atiumdva.dat
[2008/07/11 03:40:03 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2008/07/11 03:40:03 | 000,154,206 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2008/07/11 03:40:03 | 000,081,920 | —- | C] () – C:\Windows\System32\ATIODE.exe
[2008/07/11 03:40:03 | 000,040,960 | —- | C] () – C:\Windows\System32\ATIODCLI.exe
[2008/07/11 03:40:01 | 000,876,544 | —- | C] () – C:\Windows\System32\TEACico2.dll
[2008/07/10 19:46:03 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2006/11/02 06:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 06:47:37 | 000,277,184 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 06:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 04:33:01 | 000,915,156 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 04:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 04:33:01 | 000,210,382 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 04:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 04:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 02:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 02:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 01:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 01:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2002/09/13 05:40:06 | 000,000,266 | —- | C] () – C:\Windows\System32\lxbkcoin.ini

========== LOP Check ==========

[2010/06/19 04:14:03 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\DAEMON Tools Lite
[2011/12/16 07:50:05 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\DMCache
[2010/12/04 19:23:54 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\DriverCure
[2010/11/07 19:12:09 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\Firefly Studios
[2011/06/29 04:03:50 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\Hi-Rez Studios
[2011/10/30 17:36:04 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\IDM
[2011/01/30 01:23:31 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\Kalydo
[2011/07/24 07:29:53 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\Lionhead Studios
[2010/11/04 20:21:25 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\LolClient
[2011/12/08 03:27:39 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\Origin
[2010/12/04 19:23:54 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\ParetoLogic
[2011/06/29 01:52:45 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\PeerNetworking
[2011/03/08 22:11:56 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\Rovio
[2011/02/02 19:06:26 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\SPORE
[2011/02/28 20:03:59 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\SystemRequirementsLab
[2010/04/22 14:26:58 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\Template
[2011/12/16 07:47:05 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\uTorrent
[2010/04/14 22:30:26 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\vghd
[2010/10/06 18:37:54 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\W Photo Studio
[2010/10/06 18:34:24 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\W Photo Studio Viewer
[2010/10/06 18:37:19 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\Walgreens
[2011/02/04 12:50:07 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\wargaming.net
[2011/07/07 05:43:52 | 000,000,000 | —D | M] – C:\Users\lathem\AppData\Roaming\WarZone
[2011/12/23 07:31:43 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At1.job
[2011/12/23 07:31:44 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At10.job
[2011/12/23 07:31:44 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At11.job
[2011/12/23 07:31:44 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At12.job
[2011/12/23 07:31:44 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At13.job
[2011/12/23 07:31:44 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At14.job
[2011/12/23 07:31:44 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At15.job
[2011/12/23 07:31:44 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At16.job
[2011/12/23 10:40:29 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At17.job
[2011/12/23 08:06:00 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At18.job
[2011/12/23 09:06:00 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At19.job
[2011/12/23 07:31:43 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At2.job
[2011/12/23 09:06:00 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At20.job
[2011/12/23 10:06:00 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At21.job
[2011/12/23 10:06:00 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At22.job
[2011/12/23 11:06:01 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At23.job
[2011/12/23 11:06:04 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At24.job
[2011/12/23 12:06:00 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At25.job
[2011/12/23 12:06:00 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At26.job
[2011/12/22 13:06:00 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At27.job
[2011/12/22 13:06:00 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At28.job
[2011/12/22 14:06:00 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At29.job
[2011/12/23 07:31:44 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At3.job
[2011/12/22 14:06:00 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At30.job
[2011/12/22 15:06:00 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At31.job
[2011/12/22 15:06:00 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At32.job
[2011/12/22 16:06:00 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At33.job
[2011/12/22 16:06:00 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At34.job
[2011/12/22 17:06:00 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At35.job
[2011/12/22 17:06:00 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At36.job
[2011/12/22 18:06:00 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At37.job
[2011/12/22 18:06:00 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At38.job
[2011/12/22 19:06:00 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At39.job
[2011/12/23 07:31:44 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At4.job
[2011/12/22 19:06:00 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At40.job
[2011/12/22 20:06:00 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At41.job
[2011/12/22 20:06:00 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At42.job
[2011/12/23 07:31:43 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At43.job
[2011/12/23 07:31:43 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At44.job
[2011/12/23 07:31:43 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At45.job
[2011/12/23 07:31:43 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At46.job
[2011/12/23 07:31:43 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At47.job
[2011/12/23 07:31:43 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At48.job
[2011/12/23 07:31:44 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At5.job
[2011/12/23 07:31:44 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At6.job
[2011/12/23 07:31:44 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At7.job
[2011/12/23 07:31:44 | 000,000,354 | —- | M] () – C:\Windows\Tasks\At8.job
[2011/12/23 07:31:44 | 000,000,352 | —- | M] () – C:\Windows\Tasks\At9.job
[2011/12/23 10:39:27 | 000,032,552 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2011/12/23 08:25:53 | 000,000,420 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{41F7D201-9173-47E0-9167-17E82134E3D9}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2011/02/21 22:09:22 | 000,001,024 | —- | M] () – C:\.rnd
[2006/09/18 15:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/11 00:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2006/09/18 15:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2008/07/11 03:40:15 | 000,005,025 | RH– | M] () – C:\dell.sdr
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1028.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1031.txt
[2007/11/07 08:00:40 | 000,010,134 | —- | M] () – C:\eula.1033.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1036.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1040.txt
[2007/11/07 08:00:40 | 000,000,118 | —- | M] () – C:\eula.1041.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1042.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.2052.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.3082.txt
[2007/11/07 08:00:40 | 000,001,110 | —- | M] () – C:\globdata.ini
[2007/11/07 08:03:18 | 000,562,688 | —- | M] (Microsoft Corporation) – C:\install.exe
[2007/11/07 08:00:40 | 000,000,843 | —- | M] () – C:\install.ini
[2010/01/06 19:54:14 | 000,000,272 | —- | M] () – C:\INSTALL.LOG
[2007/11/07 08:03:18 | 000,076,304 | —- | M] (Microsoft Corporation) – C:\install.res.1028.dll
[2007/11/07 08:03:18 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.1031.dll
[2007/11/07 08:03:18 | 000,091,152 | —- | M] (Microsoft Corporation) – C:\install.res.1033.dll
[2007/11/07 08:03:18 | 000,097,296 | —- | M] (Microsoft Corporation) – C:\install.res.1036.dll
[2007/11/07 08:03:18 | 000,095,248 | —- | M] (Microsoft Corporation) – C:\install.res.1040.dll
[2007/11/07 08:03:18 | 000,081,424 | —- | M] (Microsoft Corporation) – C:\install.res.1041.dll
[2007/11/07 08:03:18 | 000,079,888 | —- | M] (Microsoft Corporation) – C:\install.res.1042.dll
[2007/11/07 08:03:18 | 000,075,792 | —- | M] (Microsoft Corporation) – C:\install.res.2052.dll
[2007/11/07 08:03:18 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.3082.dll
[2010/05/01 17:46:41 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/05/01 17:46:41 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2011/12/23 10:40:22 | 3533,127,680 | -HS- | M] () – C:\pagefile.sys
[2010/12/19 03:33:18 | 000,000,515 | —- | M] () – C:\scramble.log
[2007/11/07 08:00:40 | 000,005,686 | —- | M] () – C:\vcredist.bmp
[2007/11/07 08:12:28 | 000,232,960 | —- | M] () – C:\VC_RED.MSI

< %systemroot%\Fonts\*.com >
[2006/11/02 06:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 06:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 06:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2010/03/12 21:15:31 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 15:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/08/12 09:58:10 | 000,314,880 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\hpfpp082.dll
[2007/10/20 18:21:50 | 000,278,016 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\hpzpp5mu.dll
[2006/11/02 06:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2010/12/08 13:11:54 | 000,053,632 | —- | M] (LogMeIn, Inc.) – C:\Windows\system32\spool\prtprocs\w32x86\LMIproc.dll
[2003/07/29 03:27:40 | 000,078,336 | —- | M] () – C:\Windows\system32\spool\prtprocs\w32x86\LXBKPP5C.DLL

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/04/12 20:30:46 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 04:34:05 | LS\x00\x00\x00\x00

Hi Cobretti12,



My name is NoodleTech. I would be glad to assist you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• Please be aware that removing malware is not without risk and while unrecoverable damage to systems is rare, it can happen and may require a re-format and re-install of your operating system. Because of this it is a good idea to back-up anything important saved on your computer.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Do not delete anything unless instructed to.
• DO NOT use tools such as ComboFix without supervision.
• Please continue to review my answers until I tell you your machine appears to be clean. Absence of symptoms does not mean that everything is clean.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.
• Failure to respond within 3 days will result in this topic being closed - If you need more time to complete the steps required, please let me know.

===================================================

Please download aswMBR.exe and save it to your desktop. 

Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)

Click Scan

• Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review.
• Note - do NOT attempt any Fix yet.
• You will also notice another file created on the desktop named MBR.dat.
• Right click that file and select Send To>Compressed (zipped) file.
• Attach that zipped file in your next reply as well.

===================================================

Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
• Press Start Scan.
  
  • If Malicious objects are found, DO NOT cure them.
  • Choose Skip then click on Continue.
• Copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)

ComboFix 11-12-23.01 - lathem 12/23/2011 15:11:15.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3069.2150 [GMT -6:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\program files\Search Toolbar
c:\program files\Search Toolbar\icon.ico
c:\program files\Search Toolbar\SearchToolbar.dll
c:\program files\Search Toolbar\SearchToolbarUninstall.exe
c:\program files\Search Toolbar\SearchToolbarUpdater.exe
c:\programdata\~ptWwgKhlkQeXWE
c:\programdata\~ptWwgKhlkQeXWEr
c:\programdata\ptWwgKhlkQeXWE
c:\programdata\wrtxqe4s5omf0cvp3ugj1w488u8g
c:\users\Aaron's\AppData\Local\._Revolution_
c:\users\Aaron's\AppData\Local\{B8C0D23A-2F7B-44EA-8B19-921125964E73}
c:\users\Aaron's\AppData\Local\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome.manifest
c:\users\Aaron's\AppData\Local\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\_cfg.js
c:\users\Aaron's\AppData\Local\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\overlay.xul
c:\users\Aaron's\AppData\Local\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\install.rdf
c:\users\Aaron's\AppData\Local\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome.manifest
c:\users\Aaron's\AppData\Local\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\_cfg.js
c:\users\Aaron's\AppData\Local\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\overlay.xul
c:\users\Aaron's\AppData\Local\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\install.rdf
c:\users\Aaron's\AppData\Local\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome.manifest
c:\users\Aaron's\AppData\Local\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\_cfg.js
c:\users\Aaron's\AppData\Local\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\overlay.xul
c:\users\Aaron's\AppData\Local\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\install.rdf
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome.manifest
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\_cfg.js
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\overlay.xul
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\install.rdf
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome.manifest
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\_cfg.js
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\overlay.xul
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\install.rdf
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome.manifest
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\_cfg.js
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\overlay.xul
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\install.rdf
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome.manifest
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\_cfg.js
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\overlay.xul
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\install.rdf
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome.manifest
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\_cfg.js
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\overlay.xul
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\install.rdf
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome.manifest
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\_cfg.js
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\overlay.xul
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\install.rdf
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome.manifest
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\_cfg.js
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\overlay.xul
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\install.rdf
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome.manifest
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\_cfg.js
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\chrome\content\overlay.xul
c:\users\Aaron's\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\{B8C0D23A-2F7B-44EA-8B19-921125964E73}\install.rdf
c:\users\lathem\AppData\Local\Adobe\AdobeUpdate\Adobeup.dll
c:\users\lathem\AppData\Local\Geckofx\GeckofxUpdate\Geckofxupdt32.dll
c:\users\lathem\AppData\Local\Yahoo!\Yahoo!Update\Yahoo!updt32.dll
c:\users\lathem\AppData\Roaming\IDM\idmmzcc3
c:\users\lathem\AppData\Roaming\IDM\idmmzcc3\chrome.manifest
c:\users\lathem\AppData\Roaming\IDM\idmmzcc3\chrome\idmmzcc.jar
c:\users\lathem\AppData\Roaming\IDM\idmmzcc3\components\idmmzcc.dll
c:\users\lathem\AppData\Roaming\IDM\idmmzcc3\components\iIDMMzCC.xpt
c:\users\lathem\AppData\Roaming\IDM\idmmzcc3\components2\idmhelper.js
c:\users\lathem\AppData\Roaming\IDM\idmmzcc3\components2\idmhelper2.js
c:\users\lathem\AppData\Roaming\IDM\idmmzcc3\components2\idmmzcc.dll
c:\users\lathem\AppData\Roaming\IDM\idmmzcc3\components2\idmmzcc64.dll
c:\users\lathem\AppData\Roaming\IDM\idmmzcc3\components2\iIDMHelper.xpt
c:\users\lathem\AppData\Roaming\IDM\idmmzcc3\components2\iIDMHelper2.xpt
c:\users\lathem\AppData\Roaming\IDM\idmmzcc3\components2\iIDMMzCC.xpt
c:\users\lathem\AppData\Roaming\IDM\idmmzcc3\install.js
c:\users\lathem\AppData\Roaming\IDM\idmmzcc3\install.rdf
c:\users\lathem\AppData\Roaming\IDM\idmmzcc3\META-INF\manifest.mf
c:\users\lathem\AppData\Roaming\IDM\idmmzcc3\META-INF\zigbert.rsa
c:\users\lathem\AppData\Roaming\IDM\idmmzcc3\META-INF\zigbert.sf
c:\users\lathem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Fix
c:\users\lathem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Fix\System Fix.lnk
c:\users\lathem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Fix\Uninstall System Fix.lnk
c:\users\lathem\AppData\Roaming\Microsoft\Windows\Templates\wrtxqe4s5omf0cvp3ugj1w488u8g
c:\users\lathem\AppData\Roaming\Mozilla\Firefox\Profiles\6kde0878.default\searchplugins\bing-zugo.xml
c:\users\lathem\wevtapi.dll
c:\windows\$NtUninstallKB6466$\1873835762\@
c:\windows\$NtUninstallKB6466$\1873835762\bckfg.tmp
c:\windows\$NtUninstallKB6466$\1873835762\cfg.ini
c:\windows\$NtUninstallKB6466$\1873835762\Desktop.ini
c:\windows\$NtUninstallKB6466$\1873835762\keywords
c:\windows\$NtUninstallKB6466$\1873835762\kwrd.dll
c:\windows\$NtUninstallKB6466$\1873835762\L\qnbwvoto
c:\windows\$NtUninstallKB6466$\1873835762\lsflt7.ver
c:\windows\$NtUninstallKB6466$\1873835762\U\00000001.@
c:\windows\$NtUninstallKB6466$\1873835762\U\00000002.@
c:\windows\$NtUninstallKB6466$\1873835762\U\00000004.@
c:\windows\$NtUninstallKB6466$\1873835762\U\80000000.@
c:\windows\$NtUninstallKB6466$\1873835762\U\80000004.@
c:\windows\$NtUninstallKB6466$\1873835762\U\80000032.@
c:\windows\$NtUninstallKB6466$\2525816594
c:\windows\bwUnin-8.1.1.50-8876480SL.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-11-23 to 2011-12-23 )))))))))))))))))))))))))))))))
.
.
2011-12-23 21:22 . 2011-12-23 21:22 ——– d—–w- c:\users\lathem\AppData\Local\temp
2011-12-23 21:22 . 2011-12-23 21:22 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp
2011-12-23 21:22 . 2011-12-23 21:22 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-12-23 21:22 . 2011-12-23 21:22 ——– d—–w- c:\users\Aaron's\AppData\Local\temp
2011-12-22 13:29 . 2011-12-22 13:29 ——– d—–w- c:\program files\LogMeIn Hamachi
2011-12-16 14:06 . 2011-12-16 14:06 ——– d—–w- c:\users\lathem\AppData\Local\SWTOR
2011-12-15 15:56 . 2011-10-27 08:01 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-12-15 15:56 . 2011-10-27 08:01 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-12-15 15:56 . 2011-10-14 16:02 429056 —-a-w- c:\windows\system32\EncDec.dll
2011-12-15 15:56 . 2011-11-23 13:37 2043904 —-a-w- c:\windows\system32\win32k.sys
2011-12-15 15:56 . 2011-11-08 14:42 2048 —-a-w- c:\windows\system32\tzres.dll
2011-12-15 15:49 . 2011-11-21 10:47 6823496 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F360AD07-8848-4A0E-AA20-8CA462EBDB84}\mpengine.dll
2011-12-12 21:27 . 2011-12-12 21:27 ——– d—–w- c:\users\lathem\AppData\Local\Chromium
2011-12-12 18:32 . 2011-12-12 18:33 ——– d—–w- c:\program files\Hi-Rez Studios
2011-12-08 09:27 . 2011-12-08 09:43 ——– d—–w- c:\program files\Electronic Arts
2011-12-08 09:27 . 2011-12-08 09:27 ——– d—–w- c:\users\lathem\AppData\Roaming\Origin
2011-12-08 09:26 . 2011-12-08 09:26 ——– d—–w- c:\users\lathem\AppData\Local\Origin
2011-12-08 09:26 . 2011-12-08 09:26 ——– d—–w- c:\program files\Origin Games
2011-12-08 09:26 . 2011-12-08 09:26 ——– d—–w- c:\program files\Origin
2011-12-01 18:57 . 2011-12-01 18:57 ——– d—–w- c:\program files\Apple Software Update
2011-11-29 12:25 . 2011-11-29 12:25 4380832 —-a-w- c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-14 23:09 . 2011-11-14 23:09 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-24 20:29 . 2011-10-24 20:29 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-10-24 20:29 . 2011-10-24 20:29 69632 —-a-w- c:\windows\system32\QuickTime.qts
2011-10-13 20:30 . 2011-10-13 20:30 42392 —-a-w- c:\windows\system32\xfcodec.dll
2010-10-01 00:36 . 2010-02-18 05:01 119808 —-a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2010-07-28 1267024]
.
[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2010-12-09 18:51 3911776 —-a-w- c:\program files\uTorrentBar\tbuTor.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension]
@="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
[HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
2011-01-25 10:40 67680 —-a-w- c:\program files\Internet Download Manager\IDMShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-11 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-05-11 4452352]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-08-15 1955208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer5"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=c:\windows\pss\Logitech SetPoint.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^lathem^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^DesktopVideoPlayer.LNK]
path=c:\users\lathem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DesktopVideoPlayer.LNK
backup=c:\windows\pss\DesktopVideoPlayer.LNK.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 07:04 39792 —-a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2011-09-27 13:22 59240 —-a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dellsupportcenter]
2009-05-21 16:13 206064 —-a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-07-28 23:08 1259376 —-a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EADM]
2011-11-07 19:27 28846216 —-a-w- c:\program files\Origin\Origin.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-19 07:33 125952 —-a-w- c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2010-10-01 00:36 30192 —-a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GSpot Update]
2011-12-05 15:19 134144 —-a-w- c:\users\lathem\AppData\Local\ATI\ATIUpdate\ATIup.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
2011-02-01 14:27 3265944 —-a-w- c:\program files\Internet Download Manager\IDMan.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2011-08-15 22:18 1955208 —-a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando Media Booster]
2011-06-29 07:09 3077528 —-a-w- c:\program files\Pando Networks\Media Booster\PMB.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 20:28 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-04-11 06:28 1233920 —-a-w- c:\program files\Windows Sidebar\sidebar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2011-09-08 13:25 1242448 —-a-w- c:\program files\Steam\Steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 17:43 248040 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-07-11 02:10 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2011-02-22 23:50 395640 —-a-w- c:\program files\uTorrent\uTorrent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2010-12-09 10:45 74752 —-a-w- c:\program files\Winamp\winampa.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 07:38 1008184 —-a-w- c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-19 07:33 202240 —-a-w- c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [2011-01-25 85768]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x]
R2 XMLProvS;Network ProService;c:\windows\System32\svchost.exe [2008-01-19 21504]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]
R3 Mo3Fltr;MMO Mouse;c:\windows\system32\drivers\Mo3Fltr.sys [2008-04-15 11136]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-10-01 30192]
R4 gupdate1ca8451162c6f07;Google Update Service (gupdate1ca8451162c6f07);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 133104]
R4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 133104]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-02-01 691696]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2011-08-15 1361288]
S2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files\Hi-Rez Studios\HiPatchService.exe [2011-12-02 14216]
S2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;c:\windows\system32\libusbd-nt.exe [2005-03-10 18944]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-08-03 379496]
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2005-03-10 33792]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2011-05-10 139368]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
xmlpros REG_MULTI_SZ XMLProvS
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 04:25]
.
2011-12-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 04:25]
.
2011-12-22 c:\windows\Tasks\Norton Security Scan for Aaron's.job
- c:\program files\Norton Security Scan\Norton Security Scan\Engine\2.7.0.52\Nss.exe [2010-02-04 17:54]
.
2011-12-23 c:\windows\Tasks\User_Feed_Synchronization-{41F7D201-9173-47E0-9167-17E82134E3D9}.job
- c:\windows\system32\msfeedssync.exe [2011-12-15 04:44]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: &Winamp Search - c:\programdata\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - c:\users\lathem\AppData\Roaming\Mozilla\Firefox\Profiles\6kde0878.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - Winamp Search
FF - prefs.js: browser.startup.homepage - hxxp://www.clanaod.net/forums/index.php
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
FF - prefs.js: network.proxy.type - 0
FF - Ext: Skype Click to Call: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} - c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Conduit Engine : [removed] - %profile%\extensions\[removed]
FF - Ext: Search Toolbar: [removed] - %profile%\extensions\[removed]
FF - Ext: UnPlug: unplug@compunach - %profile%\extensions\unplug@compunach
FF - Ext: Winamp Toolbar: {0b38152b-1b20-484d-a11f-5e04a9b0661f} - %profile%\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF - Ext: HP Detect: {ab91efd4-6975-4081-8552-1b3922ed79e2} - %profile%\extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}
FF - Ext: uTorrentBar Community Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - %profile%\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: DivX Plus Web Player HTML5 : {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF - user.js: yahoo.homepage.dontask - true
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{30F9B915-B755-4826-820B-08FBA6BD249D} - c:\program files\ConduitEngine\ConduitEngine.dll
BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll
Toolbar-{30F9B915-B755-4826-820B-08FBA6BD249D} - c:\program files\ConduitEngine\ConduitEngine.dll
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll
WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - c:\program files\ConduitEngine\ConduitEngine.dll
Notify-GoToAssist - c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll
MSConfigStartUp-1446972117 - c:\users\lathem\AppData\Local\Temp\nss4C8E.tmp\xd87tpp.hsb
MSConfigStartUp-Akamai NetSession Interface - c:\users\lathem\AppData\Local\Akamai\netsession_win.exe
MSConfigStartUp-Apple Update - c:\users\lathem\AppData\Local\Adobe\AdobeUpdate\Adobeup.dll
MSConfigStartUp-Configuring - c:\users\lathem\AppData\Local\Temp\1160817308.txt
MSConfigStartUp-GoogleNotifierNotifier - c:\programdata\GoogleNotifierNotifier.dll
MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
MSConfigStartUp-LogMeIn GUI - c:\program files\LogMeIn\x86\LogMeInSystray.exe
MSConfigStartUp-ovLtSvlXCxH - c:\programdata\ovLtSvlXCxH.exe
MSConfigStartUp-StartCCC - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
AddRemove-CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1 - c:\program files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1\HXFSETUP.EXE
AddRemove-conduitEngine - c:\progra~1\CONDUI~1\ConduitEngineUninstall.exe
AddRemove-EADM - c:\program files\Electronic Arts\EADM\EADMUI\EADMUninstall.exe
AddRemove-GoToAssist - c:\program files\Citrix\GoToAssist\514\G2AUninstaller.exe
AddRemove-MegaTrainer XL_is1 - c:\program files\MegaDev\MD-Trainers\MegaTrainer XL\unins000.exe
AddRemove-Movielink Manager - c:\program files\Blockbuster\BLOCKBUSTERMovielink\Movielink Util.exe
AddRemove-Search Toolbar - c:\program files\Search Toolbar\SearchToolbarUninstall.exe
AddRemove-{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1 - c:\games\World_of_Tanks_closed_Beta\unins000.exe
AddRemove-{612AD33D-9824-4E87-8396-92374E91C4BB}_is1 - c:\program files\Inbox Toolbar\unins000.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-23 15:22
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3e,f9,4c,26,0b,7e,68,4d,9e,11,72,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3e,f9,4c,26,0b,7e,68,4d,9e,11,72,\
.
[HKEY_USERS\S-1-5-21-3607922397-1838791560-119583975-1002\Software\SecuROM\License information*]
"datasecu"=hex:3c,45,d8,a1,b2,e6,b6,26,62,dd,34,18,cd,4a,6d,8c,08,97,8c,d0,6f,
6c,0c,6b,bf,93,96,e4,c2,7a,ac,da,1f,12,01,3d,9c,1a,55,b4,fb,9e,2d,e8,2d,58,\
"rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44
.
[HKEY_USERS\S-1-5-21-3607922397-1838791560-119583975-1002_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):3c,16,70,47,16,3c,41,f3,b9,00,49,29,16,8d,31,19,df,ea,31,2c,8e,
e1,09,84,de,b8,ab,e6,bf,74,e1,81,e7,22,05,fe,9a,45,ce,31,00,00,00,00,00,00,\
.
[HKEY_USERS\S-1-5-21-3607922397-1838791560-119583975-1002_Classes\CLSID\{cf911575-4927-4c5c-a42a-33da528bf6c3}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:000000c3
"Therad"=dword:00000015
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-12-23 15:26:28
ComboFix-quarantined-files.txt 2011-12-23 21:26
.
Pre-Run: 105,818,218,496 bytes free
Post-Run: 113,887,588,352 bytes free
.
- - End Of File - - 07B6A4BD661973A30F5F5FE8413117D1


Longest hour of my life lol