Spyware / Malware / Virus Removal

zero access rootkit infection [Solved]

29 min read

Looking for the outcome? Ask AI

amitemurray Topic Starter

Post #1January 4, 2012, 5:03 PM UTC

My laptop is infected with the Zero Access Rootkit, as identified by Avast. No internet. Ran Combofix. Still get this message: "Windows cannot start the Internet Connection Sharing Service."

Sunyata

Post #2January 5, 2012, 1:23 AM UTC

Hi amitemurray and welcome to WhatTheTech forums!
I'm Sunyata and I will be helping you with your computer problems.

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts before I post them. This is to ensure that I am giving you the best possible advice. This may cause a delay, but I will do my very best to keep it as short as possible.

Please read the following guidelines which will help to make cleaning your machine easier:

Malware logs are often lengthy and can take a lot of time to research and interpret. Please be patient while I review your logs.
The fixes I will give you are specific to your problem and should only be used for this issue on this machine.
Please make sure to carefully read any instructions posted. If you're not sure, please stop and ask!
Please stay with this thread until I tell you your machine appears to be clean. Absence of symptoms does not necessarily mean that all malware is gone.
PLEASE DO NOT install/uninstall any programs unless asked to.
PLEASE DO NOT run any malware scans other than those requested.
Please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
I will reply back shortly with instructions

Note to Vista and Windows 7 users:

These tools MUST be run from the executable. (.exe) every time you run them
These tools MUST be run With Admin Rights (Right click, choose "Run as Administrator")

Sunyata

Post #3January 5, 2012, 2:06 AM UTC

Hello amitemurray

Please download Farbar Service Scanner and run it on the computer with the issue.
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

amitemurray

Post #4January 5, 2012, 2:43 AM UTC

Hi Sunyata, Thanks for helping me. Here is the Farbar log: Farbar Service Scanner Ran by [removed] (administrator) on 04-01-2012 at 20:38:18 Microsoft Windows XP Professional Service Pack 3 (X86) Boot Mode: Normal **************************************************************** Internet Services: ============ Dnscache Service is not running. Checking service configuration: The start type of Dnscache service is OK. The ImagePath of Dnscache service is OK. The ServiceDll of Dnscache service is OK. Dhcp Service is not running. Checking service configuration: The start type of Dhcp service is OK. The ImagePath of Dhcp service is OK. The ServiceDll of Dhcp service is OK. Tcpip Service is not running. Checking service configuration: The start type of Tcpip service is OK. The ImagePath of Tcpip service is OK. Connection Status: ============== Localhost is blocked. There is no connection to network. Attempt to access Google IP returned error: Other errors Attempt to access Yahoo IP returend error: Other errors File Check: ======== C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit C:\WINDOWS\system32\svchost.exe => MD5 is legit C:\WINDOWS\system32\rpcss.dll => MD5 is legit C:\WINDOWS\system32\services.exe => MD5 is legit Extra List: ======= aswTdi(11) Gpc(6) NetBT(5) PSched(7) Tcpip(3) 0x0C000000040000000100000002000000030000000B000000560000000900000005000000060000 0007000000080000000A000000 Attention! IpSec Tag value is missing and it should be 4 **** End of log ****

Sunyata

Post #5January 5, 2012, 4:10 AM UTC

Hello amitemurray

Please re-run Farbar Service Scanner
Type the following in the edit box after "Search:".

Ipsec

Click "export service" button and post the log created (FSS.txt) in your next reply.

amitemurray

Post #6January 5, 2012, 11:43 AM UTC

Hi Sunyata, I believe this is the log you requested. If not I'll try again. Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\Ipsec] "Type"=dword:00000001 "Start"=dword:00000001 "ErrorControl"=dword:00000001 "ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,\ 52,00,49,00,56,00,45,00,52,00,53,00,5c,00,69,00,70,00,73,00,65,00,63,00,2e,\ 00,73,00,79,00,73,00,00,00 "Group"="PNP_TDI" [HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\Ipsec\Enum] "0"="Root\\LEGACY_IPSEC\\0000" "Count"=dword:00000001 "NextInstance"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_Ipsec] "NextInstance"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_Ipsec\0000] "Service"="IPSec" "Legacy"=dword:00000001 "ConfigFlags"=dword:00000000 "Class"="LegacyDriver" "ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}" "DeviceDesc"="IPSEC driver" "Capabilities"=dword:00000000 "Driver"="{8ECC055D-047F-11D1-A537-0000F8753ED1}\\0019" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_Ipsec\0000\LogConf] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_Ipsec\0000\Control] "ActiveService"="IPSec"

Sunyata

Post #7January 6, 2012, 1:21 AM UTC

Hello amitemurray

Please do the following:

Click WinKey + R to open a run box > type notepad into the open run box > OK > this will open Notepad
Click Format and make certain that Word Wrap is NOT checked.

Copy/Paste the text inside of the code box into the open Notepad

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPSec]
"Tag"=dword:00000004

Now go to File > and click Save As,
From the drop down menu at the top of the box choose Desktop as the location to save this file.
Go down to the File Name box and type in fixme.reg as the file name, then choose All Files as the save as file type.
Then click the save button.
Once you have clicked the save button, close Notepad.
You should now see a file on your desktop that looks like this:
[external image: Posted Image]
Locate the fixme.reg icon on your desktop and double click it, an information box will pop up asking if you want to merge the information in the file into the registry, click YES.
Once the file has run, the information will have merged with your registry so you can delete fixme.reg from your desktop as you won't be needing it any more.

Next,

Please reboot your machine
Re-run a scan with FSS.exe and post the log

Please let us know if your internet is back.

amitemurray

Post #8January 6, 2012, 2:04 AM UTC

Thank you Sunyata! Internet is back! Here is the log you requested: Farbar Service Scanner Ran by [removed] (administrator) on 05-01-2012 at 19:59:55 Microsoft Windows XP Professional Service Pack 3 (X86) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Yahoo IP is accessible. File Check: ======== C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit C:\WINDOWS\system32\svchost.exe => MD5 is legit C:\WINDOWS\system32\rpcss.dll => MD5 is legit C:\WINDOWS\system32\services.exe => MD5 is legit Extra List: ======= aswTdi(11) Gpc(6) IPSec(4) NetBT(5) PSched(7) Tcpip(3) 0x0C000000040000000100000002000000030000000B000000560000000900000005000000060000 0007000000080000000A000000 IpSec Tag value is correct. **** End of log ****

Sunyata

Post #9January 6, 2012, 3:46 AM UTC

Hello amitemurray

Internet is back!

We need to continue with system scans to ensure no malware remains on the system…

First,

Please post the ComboFix.txt file created from your ComboFix run. It can usually be found here:

C:\ComboFix.txt

Next,

Download DDS by sUBs to your desktop.
Your antivirus software might question the file. If it does, turn it off please

Double click DDS.scr to run it and wait for the scan to finish
When finished DDS.txt will open
A small while later, a prompt will open. Answer Yes
DDS will continue scanning
When done, Attach.txt will open
Post DDS.txt and attach Attach.txt

Next,

Please download aswMBR to your desktop.

Double click the aswMBR icon to run it.

Vista and Windows 7 users right click the icon and choose "Run as administrator".
When asked if you want to download Avast's virus definitions please select Yes.
Click the Scan button to start scan.
When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]

In your next reply, please include:

ComboFix.txt
DDS.txt
Attach.txt
The log from aswMBR

What are the issues your machine is having now that the internet is back?

amitemurray

Post #10January 6, 2012, 9:34 PM UTC last edited January 6, 2012, 10:32 PM UTC

Hi Sunyata,
This laptop seems to be working great now–no issues that I can detect, although I see some infected files in the logs below.

ComboFix 12-01-05.04 - Murray Quin 01/06/2012 5:57.10.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.286 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
.
.
((((((((((((((((((((((((( Files Created from 2011-12-06 to 2012-01-06 )))))))))))))))))))))))))))))))
.
.
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-28 18:01 . 2010-11-06 13:58 41184 —-a-w- c:\windows\avastSS.scr
2011-11-28 18:01 . 2010-11-06 13:58 199816 —-a-w- c:\windows\system32\aswBoot.exe
2011-11-28 17:53 . 2011-09-12 10:43 435032 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-11-28 17:53 . 2010-11-06 13:59 314456 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-11-28 17:52 . 2010-11-06 13:58 34392 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-11-28 17:52 . 2010-11-06 13:58 52952 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-11-28 17:52 . 2010-11-06 13:58 111320 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2011-11-28 17:51 . 2010-11-06 13:58 105176 —-a-w- c:\windows\system32\drivers\aswmon.sys
2011-11-28 17:51 . 2010-11-06 13:59 20568 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-11-28 17:48 . 2010-11-06 13:58 30808 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2011-11-23 13:25 . 2005-08-16 10:18 1859584 —-a-w- c:\windows\system32\win32k.sys
2011-11-15 20:29 . 2010-10-30 14:06 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-11-01 16:07 . 2005-08-16 10:18 1288704 —-a-w- c:\windows\system32\ole32.dll
2011-10-31 23:43 . 2005-08-16 10:18 832512 —-a-w- c:\windows\system32\wininet.dll
2011-10-31 23:43 . 2005-08-16 10:18 78336 —-a-w- c:\windows\system32\ieencode.dll
2011-10-31 23:43 . 2005-08-16 10:18 1830912 —-a-w- c:\windows\system32\inetcpl.cpl
2011-10-31 23:43 . 2005-08-16 10:18 17408 —-a-w- c:\windows\system32\corpol.dll
2011-10-28 05:31 . 2005-08-16 10:18 33280 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:33 . 2005-08-16 10:18 2192768 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52 . 2004-08-04 04:59 2069376 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-14 23:38 . 2005-08-16 10:18 456192 —-a-w- c:\windows\system32\encdec.dll
2011-10-10 14:22 . 2005-08-16 10:40 692736 —-a-w- c:\windows\system32\inetcomm.dll
2006-11-23 03:04 . 2005-06-19 00:47 231258 —-a-w- c:\program files\pikachu.exe
2011-11-11 10:01 . 2011-05-04 11:04 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-12-22_16.41.40 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-01-06 11:11 . 2012-01-06 11:11 16384 c:\windows\Temp\Perflib_Perfdata_1e8.dat
+ 2008-09-17 02:13 . 2012-01-04 12:42 22880 c:\windows\system32\Restore\rstrlog.dat
+ 2005-08-16 10:18 . 2012-01-06 01:59 61488 c:\windows\system32\perfc009.dat
- 2005-08-16 10:18 . 2011-12-22 16:34 61488 c:\windows\system32\perfc009.dat
- 2005-08-16 10:18 . 2008-04-13 19:19 75264 c:\windows\system32\drivers\ipsec.sys
+ 2008-09-07 11:57 . 2008-04-13 19:19 75264 c:\windows\system32\drivers\ipsec.sys
+ 2008-09-07 11:57 . 2008-04-13 19:19 75264 c:\windows\system32\dllcache\ipsec.sys
+ 2005-08-16 10:18 . 2012-01-06 01:59 400090 c:\windows\system32\perfh009.dat
- 2005-08-16 10:18 . 2011-12-22 16:34 400090 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Murray Quin^Start Menu^Programs^Startup^Moo0 Magnifier 1.10.lnk]
backup=c:\windows\pss\Moo0 Magnifier 1.10.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 17:55 937920 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2005-08-06 03:05 344064 —-a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
2006-11-01 17:48 1392640 —-a-w- c:\windows\system32\WLTRAY.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-09-08 11:20 122940 —-a-w- c:\windows\system32\DLA\DLACTRLW.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 23:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 16:43 248040 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\rundisabled]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"Dell Wireless Manager UI"=c:\windows\system32\WLTRAY
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [9/12/2011 4:43 AM 435032]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [11/6/2010 7:59 AM 314456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [11/6/2010 7:59 AM 20568]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
.
2012-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-28 21:39]
.
2012-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-28 21:39]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/?ilc=17
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: motive.com\pattta.att
Trusted Zone: motive.com\patttbc.att
TCP: DhcpNameServer = 192.168.2.1
DPF: {0FAA926E-2AF4-11D3-9995-00A0CC3A27A9} - hxxp://tcapps.selu.edu/timecentre/Common/pvcombo.cab
DPF: {7823A620-9DD9-11CF-A662-00AA00C066D2} - hxxp://tcapps.selu.edu/timecentre/Common/iemenu.cab
FF - ProfilePath - c:\documents and settings\Murray Quin\Application Data\Mozilla\Firefox\Profiles\xjnvebmq.default\
FF - prefs.js: browser.search.selectedEngine - Bing
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z128&form=ZGAADF&install_date=20111123&q=
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-06 06:13
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
.
C:\## aswSnx private storage
.
scan completed successfully
hidden files: 1
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(896)
c:\windows\system32\Ati2evxx.dll
c:\windows\System32\BCMLogon.dll
.
- - - - - - - > 'explorer.exe'(184)
c:\windows\system32\WININET.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-01-06 06:19:38
ComboFix-quarantined-files.txt 2012-01-06 12:19
ComboFix2.txt 2011-12-27 23:39
ComboFix3.txt 2011-12-27 21:19
ComboFix4.txt 2011-12-27 20:05
ComboFix5.txt 2012-01-06 11:50
.
Pre-Run: 11,235,389,440 bytes free
Post-Run: 11,217,747,968 bytes free
.
- - End Of File - - 154197F4C8EB5D446F044D6456D7748B

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 15:36:17.32 on Fri 01/06/2012
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_26
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.193 [GMT -6:00]
.
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\1.3.21.79\GoogleCrashHandler.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Murray Quin\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/?ilc=17
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: CIEDownload Object: {67bcf957-85fc-4036-8dc4-d4d80e00a77b} - c:\program files\smart technologies\smart notebook\NotebookPlugin.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\googleafe\GoogleAE.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
mRun: [Apoint] c:\program files\apoint\Apoint.exe
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: motive.com\pattta.att
Trusted Zone: motive.com\patttbc.att
DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxp://echat.bellsouth.net/sdccommon/download/tgctlcm.cab
DPF: {0FAA926E-2AF4-11D3-9995-00A0CC3A27A9} - hxxp://tcapps.selu.edu/timecentre/Common/pvcombo.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} - hxxp://h30155.www3.hp.com/ediags/dd/install/HPInstallMgr_v01_5.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {7823A620-9DD9-11CF-A662-00AA00C066D2} - hxxp://tcapps.selu.edu/timecentre/Common/iemenu.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - hxxp://www.sibelius.com/download/software/win/ActiveXPlugin.cab
DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} - hxxp://tcapps.selu.edu/viewer/activeXViewer/activexviewer.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - file:///C:/Documents%20and%20Settings/Patrick%20Quin/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/swflash.cab
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\docume~1\murray~1\applic~1\mozilla\firefox\profiles\xjnvebmq.default\
FF - prefs.js: browser.search.selectedEngine - Bing
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z128&form=ZGAADF&install_date=20111123&q=
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nppopcaploader.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-9-12 435032]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-11-6 314456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-11-6 20568]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-9-12 44768]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
S2 gupdate1c999ed12312ca2;Google Update Service (gupdate1c999ed12312ca2);c:\program files\google\update\GoogleUpdate.exe [2009-2-28 133104]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-2-28 133104]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
.
=============== Created Last 30 ================
.
.
==================== Find3M ====================
.
2011-11-28 18:01:25 41184 —-a-w- c:\windows\avastSS.scr
2011-11-23 13:25:32 1859584 —-a-w- c:\windows\system32\win32k.sys
2011-11-15 20:29:56 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-11-01 16:07:10 1288704 —-a-w- c:\windows\system32\ole32.dll
2011-10-31 23:43:21 832512 —-a-w- c:\windows\system32\wininet.dll
2011-10-31 23:43:21 78336 —-a-w- c:\windows\system32\ieencode.dll
2011-10-31 23:43:21 1830912 —-a-w- c:\windows\system32\inetcpl.cpl
2011-10-31 23:43:20 17408 —-a-w- c:\windows\system32\corpol.dll
2011-10-28 05:31:48 33280 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:33:08 2192768 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52:03 2069376 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-14 23:38:00 456192 —-a-w- c:\windows\system32\encdec.dll
2011-10-10 14:22:41 692736 —-a-w- c:\windows\system32\inetcomm.dll
2006-11-23 03:04:29 231258 —-a-w- c:\program files\pikachu.exe
.
============= FINISH: 15:37:30.39 ===============

aswMBR version 0.9.9.1297 Copyright© 2011 AVAST Software
Run date: 2012-01-06 15:57:25
—————————–
15:57:25.796 OS Version: Windows 5.1.2600 Service Pack 3
15:57:25.796 Number of processors: 1 586 0xD08
15:57:25.796 ComputerName: DCCB7L91 UserName:
15:57:26.171 Initialize success
15:57:26.218 AVAST engine defs: 12010601
15:57:29.578 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
15:57:29.578 Disk 0 Vendor: Hitachi_HTS541040G9AT00 MB2OA61A Size: 38154MB BusType: 3
15:57:29.593 Disk 0 MBR read successfully
15:57:29.609 Disk 0 MBR scan
15:57:29.609 Disk 0 unknown MBR code
15:57:29.609 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 62 MB offset 63
15:57:29.656 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 33330 MB offset 128520
15:57:29.687 Disk 0 Partition 3 00 DB CP/M / CTOS Dell 8.0 4753 MB offset 68388705
15:57:29.687 Disk 0 scanning sectors +78124095
15:57:29.750 Disk 0 scanning C:\WINDOWS\system32\drivers
15:57:40.406 Service scanning
15:57:41.765 Modules scanning
15:57:58.062 Module: C:\WINDOWS\System32\DLA\DLADResN.SYS **SUSPICIOUS**
15:58:04.078 Disk 0 trace - called modules:
15:58:04.109 ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
15:58:04.109 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x831ceab8]
15:58:04.109 3 CLASSPNP.SYS[f85e4fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8315a940]
15:58:04.562 AVAST engine scan C:\WINDOWS
15:58:14.640 AVAST engine scan C:\WINDOWS\system32
16:00:07.656 AVAST engine scan C:\WINDOWS\system32\drivers
16:00:18.531 AVAST engine scan C:\Documents and Settings\Murray Quin
16:06:58.546 File: C:\Documents and Settings\Murray Quin\My Documents\8a2DcUY.exe **INFECTED** Win32:MalOb-IG [Cryp]
16:11:34.000 AVAST engine scan C:\Documents and Settings\All Users
16:18:50.343 Scan finished successfully
16:21:11.203 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Murray Quin\Desktop\MBR.dat"
16:21:11.203 The log file has been saved successfully to "C:\Documents and Settings\Murray Quin\Desktop\aswMBR.txt"

Attachments:

📎Attach.zip

Sunyata

Post #11January 7, 2012, 2:22 AM UTC

Hello amitemurray

Did you install the following program? Do you know its function?

AutoUpdate

Next,

Please visit Virus Total by clicking here.
Click the Browse button and search for the following files (if present):
- C:\WINDOWS\System32\DLA\DLADResN.SYS
- C:\Documents and Settings\Murray Quin\My Documents\8a2DcUY.exe
Click Open.
Then click Send File.
Please be patient while the files are scanned.
If Virus Total tells you that the file has already been scanned, click "reanalyse now".
Once scanned, copy and paste the links to the results pages in your next reply.

amitemurray

Post #12January 7, 2012, 2:43 AM UTC last edited January 7, 2012, 2:45 AM UTC

Hi Sunyata, I need to ask you to help me with the family desktop. Unfortunately, while you've been working with me on my laptop, the desktop was infected with the Vista Security 2012 virus. My wife needs to do work this weekend. I really appreciate your help. I'm not sure about AutoUpdate. I hope the following is what you wanted: File name: DLADResN.SYS Submission date: 2012-01-07 02:26:06 (UTC) Current status: finished Result: 0/ 43 (0.0%) Antivirus Version Last Update Result AhnLab-V3 2012.01.06.00 2012.01.06 - AntiVir 7.11.20.194 2012.01.06 - Antiy-AVL 2.0.3.7 2012.01.07 - Avast 6.0.1289.0 2012.01.06 - AVG 10.0.0.1190 2012.01.06 - BitDefender 7.2 2012.01.07 - ByteHero 1.0.0.1 2011.12.31 - CAT-QuickHeal 12.00 2012.01.06 - ClamAV 0.97.3.0 2012.01.06 - Commtouch 5.3.2.6 2012.01.06 - Comodo 11204 2012.01.06 - DrWeb 5.0.2.03300 2012.01.07 - Emsisoft 5.1.0.11 2012.01.07 - eSafe 7.0.17.0 2012.01.03 - eTrust-Vet 37.0.9668 2012.01.06 - F-Prot 4.6.5.141 2012.01.06 - F-Secure 9.0.16440.0 2012.01.07 - Fortinet 4.3.388.0 2012.01.07 - GData 22.336/22.629 2012.01.07 - Ikarus T3.1.1.109.0 2012.01.06 - Jiangmin 13.0.900 2012.01.06 - K7AntiVirus 9.123.5881 2012.01.06 - Kaspersky 9.0.0.837 2012.01.06 - McAfee 5.400.0.1158 2012.01.07 - McAfee-GW-Edition 2010.1E 2012.01.07 - Microsoft 1.7903 2012.01.06 - NOD32 6773 2012.01.06 - Norman 6.07.13 2012.01.06 - nProtect 2012-01-06.01 2012.01.06 - Panda 10.0.3.5 2012.01.06 - PCTools 8.0.0.5 2012.01.07 - Prevx 3.0 2012.01.07 - Rising 23.91.04.02 2012.01.06 - Sophos 4.73.0 2012.01.07 - SUPERAntiSpyware 4.40.0.1006 2012.01.07 - Symantec 20111.2.0.82 2012.01.07 - TheHacker 6.7.0.1.373 2012.01.06 - TrendMicro 9.500.0.1008 2012.01.06 - TrendMicro-HouseCall 9.500.0.1008 2012.01.07 - VBA32 3.12.16.4 2012.01.06 - VIPRE 11362 2012.01.06 - ViRobot 2012.1.6.4867 2012.01.06 - VirusBuster 14.1.154.0 2012.01.06 - Additional information MD5 : 83545593e297f50a8e2524b4c071a153 SHA1 : 90a51b9f51c5b58622268c42e2d6fcebdfc67b8f SHA256: 25b18fef62395abb1eb4c17d81d9eb31759f6c5dbaa5cdb192949055d69e3071 File name: 8a2DcUY.exe Submission date: 2012-01-07 02:33:13 (UTC) Current status: finished Result: 28/ 43 (65.1%) Antivirus Version Last Update Result AhnLab-V3 2012.01.06.00 2012.01.06 Trojan/Win32.FakeAV AntiVir 7.11.20.194 2012.01.06 TR/Drop.Injector.aroh Antiy-AVL 2.0.3.7 2012.01.07 - Avast 6.0.1289.0 2012.01.06 Win32:MalOb-IG [Cryp] AVG 10.0.0.1190 2012.01.06 Win32/Cryptor BitDefender 7.2 2012.01.07 Gen:Variant.Kazy.50644 ByteHero 1.0.0.1 2011.12.31 Trojan.Win32.Heur.Gen CAT-QuickHeal 12.00 2012.01.06 - ClamAV 0.97.3.0 2012.01.06 Trojan.Kazy-3077 Commtouch 5.3.2.6 2012.01.06 - Comodo 11204 2012.01.06 UnclassifiedMalware DrWeb 5.0.2.03300 2012.01.07 - Emsisoft 5.1.0.11 2012.01.07 Virus.Win32.Cryptor!IK eSafe 7.0.17.0 2012.01.03 Win32.FakeAlert.Rena eTrust-Vet 37.0.9668 2012.01.06 - F-Prot 4.6.5.141 2012.01.06 - F-Secure 9.0.16440.0 2012.01.07 Rogue:W32/FakeAv.HN Fortinet 4.3.388.0 2012.01.07 W32/FakeAlert_Rena.BV!tr GData 22 2012.01.07 Gen:Variant.Kazy.50644 Ikarus T3.1.1.109.0 2012.01.06 Virus.Win32.Cryptor Jiangmin 13.0.900 2012.01.06 - K7AntiVirus 9.123.5881 2012.01.06 Trojan Kaspersky 9.0.0.837 2012.01.06 Trojan-Dropper.Win32.Injector.aroh McAfee 5.400.0.1158 2012.01.07 FakeAlert-Rena.bv McAfee-GW-Edition 2010.1E 2012.01.07 FakeAlert-Rena.bv Microsoft 1.7903 2012.01.06 Trojan:Win32/Sirefef.P NOD32 6773 2012.01.06 a variant of Win32/Kryptik.YCD Norman 6.07.13 2012.01.06 W32/Suspicious_Gen2.UTVJK nProtect 2012-01-06.01 2012.01.06 - Panda 10.0.3.5 2012.01.06 Suspicious file PCTools 8.0.0.5 2012.01.07 Trojan.Gen Prevx 3.0 2012.01.07 - Rising 23.91.04.02 2012.01.06 Trojan.Win32.Generic.12AD8771 Sophos 4.73.0 2012.01.07 Mal/FakeAV-PP SUPERAntiSpyware 4.40.0.1006 2012.01.07 - Symantec 20111.2.0.82 2012.01.07 Trojan.Gen TheHacker 6.7.0.1.373 2012.01.06 Trojan/Dropper.Injector.armm TrendMicro 9.500.0.1008 2012.01.06 - TrendMicro-HouseCall 9.500.0.1008 2012.01.07 - VBA32 3.12.16.4 2012.01.06 - VIPRE 11362 2012.01.06 Trojan.Win32.Generic!BT ViRobot 2012.1.6.4867 2012.01.06 - VirusBuster 14.1.154.0 2012.01.06 - Additional information MD5 : 64fec5ac433e76846fbc5e89311ca01f SHA1 : 66ab17f32e21fdb5df7ef6e869f1696fb3a0069a SHA256: 570e4e527cdb0330ff4adda0b11403912eecb444eb23da3923c29980e8d24476

Sunyata

Post #13January 7, 2012, 5:05 PM UTC

Hello amitemurray

If you'd like to take care of your Vista Security 2012 first, then return to finish your laptop, that is fine.
Vista Security 2012 can be difficult and the tools below might not run. But give them a try and if they don't run, we will deal with that.

Please download OTL to your desktop.

If you are using Firefox, make sure that your download settings are as follows:

-Tools->Options->Main tab
-Set to "Always ask me where to Save the files".
Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
Check the boxes beside LOP Check and Purity Check.
In the window under Custom Scans/Fixes copy and paste the following

netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lîk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Deskuop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results Install|LastSuccessTime /rs
%USERPROFILE%\..|smtmp;true;true;true /FP
%temp%\smtmp\*.* /s >
/md5start
iexplore.*
explorer.*
winlogon.*
dll
zx.dll
hlp.dat
/md5stop

Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Next,

Please download aswMBR to your desktop.

Double click the aswMBR icon to run it.

Vista and Windows 7 users right click the icon and choose "Run as administrator".
When asked if you want to download Avast's virus definitions please select Yes.
Click the Scan button to start scan.
When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]

In your next post, please include:

OTL.txt
Extras.txt
The aswMBR log

amitemurray

Post #14January 7, 2012, 11:44 PM UTC

Hi Sunyata,
Thanks for switching horses in midstream! I was able to restore this Vista desktop to several days ago, and have internet (question: why doesn't System Restore ever work on my XP laptop?). Here are the logs from the desktop:

OTL logfile created on: 1/7/2012 4:08:20 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Margaret\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19170)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.99 Gb Total Physical Memory | 1.66 Gb Available Physical Memory | 55.50% Memory free
6.20 Gb Paging File | 4.81 Gb Available in Paging File | 77.55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.29 Gb Total Space | 148.01 Gb Free Space | 51.34% Space Free | Partition Type: NTFS
Drive D: | 9.77 Gb Total Space | 0.00 Gb Free Space | 0.05% Space Free | Partition Type: NTFS

Computer Name: FAMLIYPC | User Name: Patrick | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Margaret\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Margaret\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Users\Margaret\AppData\Roaming\Smilebox\SmileboxTray.exe (Smilebox, Inc.)
PRC - C:\Program Files\SMART Technologies\SMART Product Drivers\Aware.exe (SMART Technologies ULC)
PRC - C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTSNMPAgent.exe (SMART Technologies ULC)
PRC - C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTBoardTools.exe (SMART Technologies ULC)
PRC - C:\Program Files\SMART Technologies\SMART Product Drivers\Marker.exe (SMART Technologies ULC)
PRC - C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTBoardService.exe (SMART Technologies)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Belkin\Router Setup and Monitor\dlnaPlugin.exe (Affinegy, Inc.)
PRC - C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe (Affinegy, Inc.)
PRC - C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe (Affinegy, Inc.)
PRC - C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe (Affinegy, Inc.)
PRC - C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Nero\Update\NASvc.exe (Nero AG)
PRC - C:\Program Files\Belkin\Belkin USB Print and Storage Center\Connect.exe (Belkin International, Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe ()
PRC - C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe ()
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe (Creative Labs)
PRC - C:\Program Files\Pure Digital Technologies\FlipShare\FlipShareService.exe ()
PRC - C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
PRC - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

========== Modules (No Company Name) ==========

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\c1c06a392871267db27f7cbc40e1c4fb\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\f9c36ea806e77872dce891c77b68fac3\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll ()
MOD - C:\Program Files\SMART Technologies\SMART Product Drivers\ZipArchive.dll ()
MOD - C:\Program Files\SMART Technologies\SMART Product Drivers\QtNetwork4.dll ()
MOD - C:\Program Files\SMART Technologies\SMART Product Drivers\QtGui4.dll ()
MOD - C:\Program Files\SMART Technologies\SMART Product Drivers\QtCore4.dll ()
MOD - C:\Program Files\Belkin\Router Setup and Monitor\BelkinServicePS.dll ()
MOD - C:\Program Files\Belkin\Router Setup and Monitor\gateways\GenericBelkinGatewayLOC.dll ()
MOD - C:\Program Files\Belkin\Router Setup and Monitor\QtGui4.dll ()
MOD - C:\Program Files\Belkin\Router Setup and Monitor\QtXml4.dll ()
MOD - C:\Program Files\Belkin\Router Setup and Monitor\QtCore4.dll ()
MOD - C:\Program Files\Belkin\Router Setup and Monitor\QtNetwork4.dll ()
MOD - C:\Program Files\Belkin\Router Setup and Monitor\imageformats\qjpeg4.dll ()
MOD - C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkLocalBackup.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()

========== Win32 Services (SafeList) ==========

SRV - (Akamai) – c:\program files\common files\akamai/netsession_win_b427739.dll ()
SRV - (AffinegyService) – C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe (Affinegy, Inc.)
SRV - (avg9emc) – C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (NAUpdate) – C:\Program Files\Nero\Update\NASvc.exe (Nero AG)
SRV - (ACDaemon) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (Belkin Local Backup Service) – C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe ()
SRV - (Belkin Network USB Helper) – C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe ()
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (ZuneWlanCfgSvc) – C:\Windows\System32\ZuneWlanCfgSvc.exe (Microsoft Corporation)
SRV - (ZuneNetworkSvc) – c:\Program Files\Zune\ZuneNss.exe (Microsoft Corporation)
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (Creative Labs Licensing Service) – C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe (Creative Labs)
SRV - (FlipShare Service) – C:\Program Files\Pure Digital Technologies\FlipShare\FlipShareService.exe ()
SRV - (DockLoginService) – C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
SRV - (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter) – C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (AvgMfx86) – C:\Windows\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgTdiX) – C:\Windows\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (SMARTMouseFilterx86) – C:\Windows\System32\drivers\SMARTMouseFilterx86.sys (SMART Technologies ULC)
DRV - (SMARTVTabletPCx86) – C:\Windows\System32\drivers\SMARTVTabletPCx86.sys (SMART Technologies ULC)
DRV - (SMARTVHidMini2000x86) – C:\Windows\System32\drivers\SMARTVHidMini2000x86.sys (SMART Technologies ULC)
DRV - (AvgLdx86) – C:\Windows\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (sxuptp) – C:\Windows\System32\drivers\sxuptp.sys (silex technology, Inc.)
DRV - (StarOpen) – C:\Windows\System32\drivers\StarOpen.sys ()
DRV - (dfmirage) – C:\Windows\System32\drivers\dfmirage.sys (DemoForge, LLC)
DRV - (TIEHDUSB) – C:\Windows\System32\drivers\tiehdusb.sys (Texas Instruments Incorporated)
DRV - (RTL8169) – C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation )
DRV - (RtNdPt60) – C:\Windows\System32\drivers\RtNdPt60.sys (Windows ® Codename Longhorn DDK provider)
DRV - (sscdmdm) – C:\Windows\System32\drivers\sscdmdm.sys (MCCI Corporation)
DRV - (sscdmdfl) – C:\Windows\System32\drivers\sscdmdfl.sys (MCCI Corporation)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) – C:\Windows\System32\drivers\sscdbus.sys (MCCI Corporation)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.foxtab.com/?s=0&chnl;=irn…p;cr=1338713102

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&cl;…amp;ibd=2081202
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.foxtab.com/?s=0&chnl;=irn…p;cr=1338713102
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.com/ig/dell?hl=en&cl;…amp;ibd=2081202
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Foxtab Web Search"
FF - prefs.js..browser.search.selectedEngine: "Foxtab Web Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.6.8
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.2
FF - prefs.js..extensions.enabledItems: {6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}:1.3.1
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..extensions.enabledItems: {AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.63
FF - prefs.js..extensions.enabledItems: [removed]:2.3.3
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100119091315
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: [removed]:3.12.2.16749
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.4
FF - prefs.js..extensions.enabledItems: {113c2360-15a3-11de-8c30-0800200c9a66}:0.9
FF - prefs.js..keyword.URL: "http://www.bing.com/search?pc=ZUGO&form;=ZGAADF&q;="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\Patrick\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll (Move Networks)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Patrick\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Patrick\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\Patrick\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/01/03 14:05:50 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/11/20 04:14:25 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Users\Patrick\AppData\Roaming\Move Networks [2009/06/28 18:43:25 | 000,000,000 | —D | M]

[2009/02/15 17:22:09 | 000,000,000 | —D | M] (No name found) – C:\Users\Patrick\AppData\Roaming\Mozilla\Extensions
[2008/12/08 19:03:00 | 000,000,000 | —D | M] (No name found) – C:\Users\Patrick\AppData\Roaming\Mozilla\Extensions\{6334D996-EA3E-4a0e-AA8D-15BA56B37241}
[2009/02/15 17:22:09 | 000,000,000 | —D | M] (No name found) – C:\Users\Patrick\AppData\Roaming\Mozilla\Extensions\[removed]
[2008/12/08 21:28:38 | 000,000,000 | —D | M] (No name found) – C:\Users\Patrick\AppData\Roaming\Mozilla\Extensions\[removed]
[2011/07/12 12:17:19 | 000,000,000 | —D | M] (No name found) – C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\eht8wzm6.default\extensions
[2010/03/13 12:39:40 | 000,000,000 | —D | M] (No name found) – C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\eht8wzm6.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}
[2010/03/13 12:47:22 | 000,000,000 | —D | M] ("Vfox3") – C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\eht8wzm6.default\extensions\{113c2360-15a3-11de-8c30-0800200c9a66}
[2009/06/24 21:06:56 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\eht8wzm6.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/03/13 12:39:49 | 000,000,000 | —D | M] (No name found) – C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\eht8wzm6.default\extensions\{2fbc1200-ad13-11db-abbd-0800200c9a66}
[2010/03/06 15:43:09 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\eht8wzm6.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/12/24 09:58:47 | 000,000,000 | —D | M] (Fire.fm) – C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\eht8wzm6.default\extensions\{6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}
[2010/03/13 12:39:33 | 000,000,000 | —D | M] (No name found) – C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\eht8wzm6.default\extensions\{9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e}
[2010/07/28 20:53:05 | 000,000,000 | —D | M] ("DVDVideoSoft Menu") – C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\eht8wzm6.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010/03/13 12:40:07 | 000,000,000 | —D | M] ("StumbleUpon") – C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\eht8wzm6.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}
[2010/04/13 14:15:24 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\eht8wzm6.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/04/13 14:15:20 | 000,000,000 | —D | M] (Download Statusbar) – C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\eht8wzm6.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2010/11/08 17:18:28 | 000,000,000 | —D | M] (FoxTab) – C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\eht8wzm6.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}
[2011/04/03 21:14:39 | 000,000,000 | —D | M] (Search Toolbar) – C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\eht8wzm6.default\extensions\[removed]
[2010/03/06 15:43:09 | 000,000,000 | —D | M] (Sxipper) – C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\eht8wzm6.default\extensions\[removed]
[2011/05/25 06:05:15 | 000,000,000 | —D | M] (Ask Toolbar) – C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\eht8wzm6.default\extensions\[removed]
[2011/04/04 05:24:54 | 000,005,427 | —- | M] () – C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\eht8wzm6.default\searchplugins\Foxtab Web Search.xml
[2011/03/28 19:45:45 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/03/13 12:38:20 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Program Files\Mozilla Firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/01/26 16:40:58 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2009/06/28 18:43:25 | 000,000,000 | —D | M] (Move Media Player) – C:\USERS\PATRICK\APPDATA\ROAMING\MOVE NETWORKS
[2011/01/26 16:40:45 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/05/08 10:03:46 | 001,152,488 | —- | M] () – C:\Program Files\mozilla firefox\plugins\NPFxViewer.dll

========== Chrome ==========

CHR - default_search_provider: FoxTab Search ()
CHR - default_search_provider: search_url = http://search.foxtab.com/?q={searchTerms}&…p;cr=1338713102
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Patrick\AppData\Local\Google\Chrome\Application\8.0.552.224\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Users\Patrick\AppData\Local\Google\Chrome\Application\8.0.552.224\gears.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Patrick\AppData\Local\Google\Chrome\Application\8.0.552.224\gcswf32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Triscape FxFoto Control and Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPFxViewer.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: BrowserPlus (from Yahoo!) v2.9.8 (Enabled) = C:\Users\Patrick\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll
CHR - plugin: Move Streaming Media Player (Enabled) = C:\Users\Patrick\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.50917.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

O1 HOSTS File: ([2006/09/18 15:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (FrostWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O3 - HKLM\..\Toolbar: (FrostWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (FrostWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [InstaLAN] C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe (Affinegy, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SMART Board Service] C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTBoardService.exe (SMART Technologies)
O4 - HKLM..\Run: [SMART SNMP Agent] C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTSNMPAgent.exe (SMART Technologies ULC)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowLegacyWebView = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowUnhashedWebView = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuPinnedList = 1
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\Patrick\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Patrick\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Se&nd; to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 File not found
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found
O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe File not found
O9 - Extra 'Tools' menuitem : &FlashGet; - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe File not found
O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{57F7E94E-D0B1-42C9-A36A-1D789F20B231}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\qv {0B4BB6DC-D020-4173-97F2-3AD91AFD6559} - C:\Program Files\QuickVerse 2010\qvprotwrapper.dll (Findex Inc.)
O20 - AppInit_DLLs: (avgrsstx.dll) -C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll) - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop WallPaper: C:\Users\Patrick\Pictures\Backgrounds\PP7 Heisman.jpg
O24 - Desktop BackupWallPaper: C:\Users\Patrick\Pictures\Backgrounds\PP7 Heisman.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/12/11 17:37:14 | 000,000,074 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{09917962-c7dc-11dd-a037-00219b183205}\Shell\AutoRun\command - "" = F:\Setup_FlipShare.exe
O33 - MountPoints2\{09917962-c7dc-11dd-a037-00219b183205}\Shell\Setup FlipShare\command - "" = F:\Setup_FlipShare.exe
O33 - MountPoints2\{fdafcd9c-34f7-11e0-a5c4-00219b183205}\Shell\Setup\command - "" = F:\setup.exe
O33 - MountPoints2\{fdafcd9f-34f7-11e0-a5c4-00219b183205}\Shell - "" = AutoRun
O33 - MountPoints2\{fdafcd9f-34f7-11e0-a5c4-00219b183205}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/01/05 20:56:44 | 000,000,000 | —D | C] – C:\Windows\TEMP
[2012/01/05 20:40:21 | 000,000,000 | —D | C] – C:\Users\Patrick\AppData\Local\temp(67)
[2012/01/05 20:31:18 | 000,000,000 | —D | C] – C:\ComboFix
[2012/01/05 20:28:55 | 000,000,000 | —D | C] – C:\Qoobox
[2012/01/05 18:28:59 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2012/01/05 05:54:19 | 000,000,000 | —D | C] – C:\Users\Patrick\AppData\Roaming\Leadertech
[2012/01/05 05:53:30 | 000,000,000 | —D | C] – C:\Users\Public\Documents\LogiShrd
[2012/01/05 05:53:13 | 000,000,000 | —D | C] – C:\ProgramData\Logishrd
[2012/01/05 05:53:11 | 000,000,000 | —D | C] – C:\Program Files\Logitech
[2012/01/05 05:53:06 | 000,000,000 | —D | C] – C:\Users\Patrick\AppData\Roaming\Logitech
[2012/01/05 05:53:03 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Logishrd
[2012/01/05 05:52:13 | 000,000,000 | —D | C] – C:\Users\Patrick\AppData\Roaming\Logishrd
[2011/12/15 06:36:39 | 000,000,000 | —D | C] – C:\found.003
[2011/12/15 03:08:29 | 000,000,000 | —D | C] – C:\42fd4bfb158e7429c5aa41
[2011/12/14 13:07:06 | 003,602,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2011/12/14 13:07:06 | 003,550,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2011/12/14 13:07:01 | 000,429,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\EncDec.dll
[2011/12/14 13:06:58 | 002,043,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/12/14 13:06:54 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\csrsrv.dll
[2011/12/14 13:06:53 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2011/12/14 13:06:50 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/12/14 13:06:49 | 000,105,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/12/14 13:06:48 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/12/14 13:06:48 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/12/14 13:06:48 | 000,602,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/12/14 13:06:48 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/12/14 13:06:48 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/12/14 13:06:48 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/12/14 13:06:48 | 000,174,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/12/14 13:06:48 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/12/14 13:06:48 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/12/14 13:06:48 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/12/14 13:06:48 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2011/12/14 13:06:48 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2011/12/14 13:06:48 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/12/14 13:06:48 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/12/14 13:06:48 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/12/14 13:06:47 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb

========== Files - Modified Within 30 Days ==========

[2012/01/07 15:58:59 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/01/07 15:20:59 | 000,000,916 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4253253780-2263761584-637675255-1000UA.job
[2012/01/07 14:34:12 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/01/07 14:34:12 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/01/07 10:07:34 | 000,000,000 | —- | M] () – C:\Users\Patrick\AppData\Local\prvlcl.dat
[2012/01/07 08:40:34 | 000,651,624 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/01/07 08:40:34 | 000,122,258 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/01/07 08:34:25 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/01/07 08:34:25 | 000,000,276 | —- | M] () – C:\Windows\tasks\RtlNICDiagVistaStart.job
[2012/01/07 08:34:11 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/01/07 08:34:09 | 3209,875,456 | -HS- | M] () – C:\hiberfil.sys
[2012/01/07 08:21:49 | 000,000,864 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4253253780-2263761584-637675255-1000Core.job
[2012/01/07 08:20:00 | 091,427,201 | —- | M] () – C:\Windows\System32\drivers\Avg\incavi.avm
[2012/01/05 22:00:03 | 000,831,072 | —- | M] () – C:\Users\Patrick\Desktop\mcneill__krajcik_teach.pdf
[2012/01/05 20:15:20 | 000,010,114 | -HS- | M] () – C:\ProgramData\15wsyw72s701ub5lg7xwn23k2o2v66202upu6846f6xi08
[2011/12/25 22:00:00 | 000,000,388 | —- | M] () – C:\Windows\tasks\SmartDefrag.job
[2011/12/15 06:39:50 | 000,402,424 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/12/10 15:24:06 | 000,020,464 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys

========== Files Created - No Company Name ==========

[2012/01/05 22:00:02 | 000,831,072 | —- | C] () – C:\Users\Patrick\Desktop\mcneill__krajcik_teach.pdf
[2012/01/05 16:17:29 | 000,010,114 | -HS- | C] () – C:\ProgramData\15wsyw72s701ub5lg7xwn23k2o2v66202upu6846f6xi08
[2010/05/08 10:03:48 | 000,000,063 | -H– | C] () – C:\ProgramData\Ts_infos.ini
[2010/04/26 20:55:21 | 000,000,000 | —- | C] () – C:\Users\Patrick\AppData\Local\prvlcl.dat
[2010/04/11 11:22:24 | 000,000,018 | —- | C] () – C:\Windows\gfact.ini
[2010/04/11 11:22:24 | 000,000,002 | —- | C] () – C:\Windows\PRCONTROL.ini
[2009/09/18 01:56:58 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/09/18 01:56:58 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2008/12/24 21:32:18 | 000,129,024 | —- | C] () – C:\Windows\System32\AVERM.dll
[2008/12/24 21:32:18 | 000,028,672 | —- | C] () – C:\Windows\System32\AVEQT.dll
[2008/12/21 11:46:47 | 000,061,208 | —- | C] () – C:\Windows\System32\MPEG4E-uninstall.exe
[2008/12/10 20:27:34 | 000,000,680 | —- | C] () – C:\Users\Patrick\AppData\Local\d3d9caps.dat
[2008/12/09 16:42:10 | 000,000,000 | —- | C] () – C:\ProgramData\LauncherAccess.dt
[2008/12/09 16:34:28 | 000,005,632 | —- | C] () – C:\Windows\System32\drivers\StarOpen.sys
[2008/12/08 17:38:57 | 000,029,696 | —- | C] () – C:\Users\Patrick\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/12/01 20:23:15 | 001,953,696 | —- | C] () – C:\Windows\System32\igklg400.dll
[2008/12/01 20:23:15 | 001,533,360 | —- | C] () – C:\Windows\System32\igklg450.dll
[2008/12/01 20:23:15 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1409.dll
[2008/12/01 20:23:15 | 000,104,636 | —- | C] () – C:\Windows\System32\igmedcompkrn.dll
[2008/12/01 20:21:14 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/12/01 18:38:47 | 000,101,376 | —- | C] () – C:\Windows\System32\APOMngr.dll
[2008/12/01 18:38:47 | 000,066,560 | —- | C] () – C:\Windows\System32\CmdRtr.dll
[2008/12/01 18:38:47 | 000,000,628 | —- | C] () – C:\Windows\System32\PCI_VEN_1102&DEV;_FF05&SUBSYS;_00001102.ini
[2008/10/28 04:32:40 | 000,950,272 | —- | C] () – C:\Windows\System32\MPEG4Evfw.dll
[2008/02/19 00:33:34 | 000,446,352 | —- | C] () – C:\Windows\System32\OpenQuicktimeLib.dll
[2008/02/03 17:11:25 | 000,000,000 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2006/11/02 06:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 06:47:37 | 000,402,424 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 06:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 04:33:01 | 000,651,624 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 04:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 04:33:01 | 000,122,258 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 04:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 04:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 04:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 02:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 02:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 01:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 01:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2005/10/09 20:33:54 | 000,137,216 | —- | C] () – C:\Windows\System32\secdel.dll

========== LOP Check ==========

[2008/12/22 19:19:38 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\4Media Software Studio
[2009/09/02 20:44:10 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\Any DVD Converter Professional
[2011/04/04 14:25:52 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\Any Video Converter
[2010/05/15 12:00:08 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\Canon
[2011/04/03 20:05:07 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\DVDVideoSoft
[2010/07/28 20:53:05 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\DVDVideoSoftIEHelpers
[2008/12/14 12:33:31 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\FlashGet
[2008/12/15 17:51:26 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\FLV Extract
[2011/07/11 19:38:55 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\FrostWire
[2008/12/18 07:49:02 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\GrabPro
[2011/02/23 21:21:03 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\gtk-2.0
[2009/02/16 17:33:10 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\IObit
[2008/12/08 19:28:32 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\KeePass
[2008/12/14 20:42:38 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\Launchy
[2012/01/05 05:54:19 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\Leadertech
[2008/12/15 17:49:43 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\Mp3tag
[2008/12/21 17:39:05 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\Orbit
[2008/12/08 19:02:58 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\Participatory Culture Foundation
[2008/12/14 22:05:47 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\PCF-VLC
[2011/08/31 14:56:09 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\QuickVerse 2010
[2008/12/09 16:45:14 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\Samsung
[2008/12/10 21:54:24 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\scar5
[2010/05/08 10:31:22 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\Skinux
[2010/09/04 10:02:34 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\SMART Technologies
[2010/09/04 09:18:59 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\SMART Technologies Inc
[2008/12/08 21:28:35 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\Songbird2
[2009/01/30 20:29:36 | 000,000,000 | —D | M] – C:\Users\Patrick\AppData\Roaming\Winsplit Revolution
[2012/01/07 08:34:25 | 000,000,276 | —- | M] () – C:\Windows\Tasks\RtlNICDiagVistaStart.job
[2012/01/07 08:33:11 | 000,032,586 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2011/12/25 22:00:00 | 000,000,388 | —- | M] () – C:\Windows\Tasks\SmartDefrag.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2008/12/11 17:37:14 | 000,000,074 | —- | M] () – C:\autoexec.bat
[2009/04/11 00:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2012/01/05 20:55:05 | 000,018,763 | —- | M] () – C:\ComboFix.txt
[2006/09/18 15:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2008/12/01 20:23:25 | 000,003,426 | RH– | M] () – C:\dell.sdr
[2012/01/07 08:34:09 | 3209,875,456 | -HS- | M] () – C:\hiberfil.sys
[2012/01/07 08:34:07 | 3523,694,592 | -HS- | M] () – C:\pagefile.sys
[2010/11/13 09:43:40 | 000,000,027 | —- | M] () – C:\wizard.txt

< %systemroot%\Fonts\*.com >
[2006/11/02 06:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 06:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 06:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/11/21 20:41:45 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 15:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/11/02 06:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/01/20 20:43:21 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2008/01/20 21:14:18 | 016,846,848 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2008/01/20 21:14:08 | 000,106,496 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2008/01/20 21:14:18 | 000,020,480 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 04:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 04:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lîk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Deskuop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results Install|LastSuccessTime /rs >

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.EXE >
[2008/10/29 00:20:29 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008/10/29 00:29:41 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008/10/29 21:59:17 | 002,927,616 | —- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009/04/11 00:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\explorer.exe
[2009/04/11 00:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008/10/27 20:15:02 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008/01/20 20:24:24 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: EXPLORER.EXE.MUI >
[2006/11/02 06:41:18 | 000,036,864 | —- | M] (Microsoft Corporation) MD5=192DD053B43250E264383CDC3D564A18 – C:\Windows\en-US\explorer.exe.mui
[2006/11/02 06:41:18 | 000,036,864 | —- | M] (Microsoft Corporation) MD5=192DD053B43250E264383CDC3D564A18 – C:\Windows\winsxs\x86_microsoft-windows-explorer.resources_31bf3856ad364e35_6.0.6000.16386_en-us_03bbc52176b6ba20\explorer.exe.mui

< MD5 for: IEXPLORE.EXE >
[2011/07/23 05:02:27 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=04D1DC458C723B291179F8449ACC281D – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19120_none_12355fcb2fdc2111\iexplore.exe
[2008/12/01 20:17:51 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=07ED775D6DB4BFA96D7CFB09EB228418 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16681_none_2d26424d1d17e8b7\iexplore.exe
[2009/01/14 22:14:36 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=0844F5B9CB3BB85A917D347EF1565B6C – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16809_none_2d84c7c91ccfce35\iexplore.exe
[2011/09/30 17:49:11 | 000,638,216 | —- | M] (Microsoft Corporation) MD5=0E1695AD4C30E72D68170F01B4818A80 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23250_none_129e8cd2491214ae\iexplore.exe
[2008/12/01 20:15:30 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=157F8DE991396C536820D7FA5C8DCF7D – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16711_none_2d71f3a71cdf2247\iexplore.exe
[2008/12/01 20:18:40 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=182CAF7403705ACCB51211A761080B8F – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20777_none_2dc0b0c03628049a\iexplore.exe
[2008/10/01 21:50:01 | 000,633,632 | —- | M] (Microsoft Corporation) MD5=19403B64906C9EAC627E3C10847B0FDA – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16757_none_2d4cb5b31cfa2a15\iexplore.exe
[2009/11/21 00:42:38 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=1B6362BB14FCEB9E76BCF9A953B04788 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18865_none_120f459f2ff7e1f8\iexplore.exe
[2009/03/02 22:18:52 | 000,636,072 | —- | M] (Microsoft Corporation) MD5=1DD66A2851DACDEC32EAE8F9A8865ABD – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.21023_none_2df29b2236034119\iexplore.exe
[2009/04/24 10:25:27 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=1F44940EF1D07D0BDAF80E55853DFBD0 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16851_none_2d46b5dd1cff8f32\iexplore.exe
[2010/02/23 09:06:13 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=25DB705A7DC85C208B3CF2D20F118AA7 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22995_none_127872a6492dd595\iexplore.exe
[2011/11/03 01:33:09 | 000,638,240 | —- | M] (Microsoft Corporation) MD5=2A268DF89913A0E927091077878EDB3E – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23266_none_1299bea24914c8a9\iexplore.exe
[2009/04/11 00:27:44 | 000,636,080 | —- | M] (Microsoft Corporation) MD5=2C5168C856455CC43C4B4E1CC1920001 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6002.18005_none_314d791517204c15\iexplore.exe
[2009/08/26 23:23:17 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=2E48756F12C21F46895036AC089AAD97 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18828_none_123d862d2fd4be39\iexplore.exe
[2010/01/02 08:58:26 | 000,638,216 | —- | M] (Microsoft Corporation) MD5=3D8DA00B028DEA9517066F1CECBFC4A2 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22973_none_128c11ea491f6b05\iexplore.exe
[2010/05/04 00:32:18 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=48A6109E8DF0365195298CC527B7426A – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23019_none_12d2cb5048e98eab\iexplore.exe
[2010/09/08 00:26:34 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=4A719476A6393B1DCACFEB4F3AC6599C – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23067_none_129abb204913e7b2\iexplore.exe
[2009/07/22 00:04:09 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=4B5AEA50CE77FBA4C2D169622DC9B489 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22903_none_12d7c15e48e6a76e\iexplore.exe
[2008/10/15 22:27:53 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=4CBA2F58668F2D5F3259CBE73E227F25 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20937_none_2debf43c36078f24\iexplore.exe
[2011/07/23 05:42:34 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=4D08A4234D645EFCB30605CC0BFA87F4 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23216_none_12cfce3e48ec3cf4\iexplore.exe
[2008/12/01 20:15:30 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=4DBD95312B1C96C5285D38F1D748CD4D – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20868_none_2dcc82dc361eff27\iexplore.exe
[2010/11/02 00:03:13 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=5AB037B17F8A87D052F5A88E0D29A3C8 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18999_none_11f2d8e9300c984e\iexplore.exe
[2008/01/20 20:23:50 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=5B92133D3E7FB2644677686305E29E81 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18000_none_2f62000919fe80c9\iexplore.exe
[2010/05/04 00:00:35 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=5C9B1062EA7A44E8F6BFDE994B68C7AA – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18928_none_123d88132fd4bb60\iexplore.exe
[2008/10/01 21:32:01 | 000,633,632 | —- | M] (Microsoft Corporation) MD5=6655B851D9EEF7C83395EE52D551B448 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20927_none_2df6c42835ff7333\iexplore.exe
[2010/06/26 00:06:48 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=7420BE0E7D3D1320054F7ACA0594953D – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18943_none_1222e6c92fe9748f\iexplore.exe
[2010/12/18 01:19:44 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=7852371DA9EFBC17B645558E23780EAC – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23111_none_12cacae648f0c11a\iexplore.exe
[2011/09/30 17:07:49 | 000,638,216 | —- | M] (Microsoft Corporation) MD5=7ACBBC85FCE4989B533220FC3B291633 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19154_none_1218f12f2ff0da40\iexplore.exe
[2009/08/27 07:31:08 | 000,638,216 | —- | M] (Microsoft Corporation) MD5=7DD482E4A2E3CBB0A72F718C342F5B75 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22918_none_12d1f2e448ea4212\iexplore.exe
[2011/05/28 01:09:20 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=7EE10C5413AD7ED1AF9E8FAE1B58FC3E – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23181_none_127f1b72492984b1\iexplore.exe
[2010/01/02 00:40:20 | 000,638,216 | —- | M] (Microsoft Corporation) MD5=88BD42DAE7CFFEB256CA7145A15E4843 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18882_none_11f6a4e9300acdd5\iexplore.exe
[2009/03/02 22:32:44 | 000,636,072 | —- | M] (Microsoft Corporation) MD5=8BA2B7A05F88BE0D45237A0994AD8366 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22389_none_2f9e23da3354de78\iexplore.exe
[2010/11/02 01:13:47 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=92A17B0A89D14815AACC62CD190B6CE3 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23091_none_127449a04931a37b\iexplore.exe
[2008/12/01 20:18:40 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=9437CA21CD48C9B6BFD6F5AC0143D251 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16643_none_2d5382911cf5aba1\iexplore.exe
[2011/02/22 01:18:28 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=9CE5543464432CA73134F170FA2BF823 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23143_none_12ac5bb64907479b\iexplore.exe
[2009/03/02 22:40:22 | 000,636,072 | —- | M] (Microsoft Corporation) MD5=9E6C1527D9A2C64BFD780AA23075380F – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18226_none_2f5265b91a094b03\iexplore.exe
[2008/12/01 20:17:51 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=9F1427F203CA078005C9943800929640 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20823_none_2df2c11a360310b0\iexplore.exe
[2010/02/23 00:39:16 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=9F52FBE99C749E3F32C75124F09F1B03 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18904_none_124f26c32fc81e22\iexplore.exe
[2011/12/24 17:50:20 | 000,182,856 | —- | M] () MD5=B382935AB01B27D0E14F267DBF288896 – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
[2009/03/08 15:09:24 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18702_none_124d22632fc9f126\iexplore.exe
[2010/12/18 00:28:35 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=B988D7F127B94BD5BF8356FE81B985C4 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19019_none_1249306b2fcbec08\iexplore.exe
[2011/02/22 00:21:12 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=C1D36A2CBE0CEC4DF593DB1288CF586E – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19048_none_1227c05d2fe52684\iexplore.exe
[2009/07/21 15:53:43 | 000,638,216 | —- | M] (Microsoft Corporation) MD5=C33BD196A0301F9B23D9A003D30ED8B0 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18813_none_124354a72fd12395\iexplore.exe
[2011/11/03 00:23:19 | 000,638,240 | —- | M] (Microsoft Corporation) MD5=CCDB0B2D1F2E016966B1DB1097E24842 – C:\Program Files\Internet Explorer\iexplore.exe
[2011/11/03 00:23:19 | 000,638,240 | —- | M] (Microsoft Corporation) MD5=CCDB0B2D1F2E016966B1DB1097E24842 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19170_none_11ff502f3004acc6\iexplore.exe
[2009/04/24 10:03:18 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=D5271AC4A06AD9D1E2EA0151B79B2657 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.21046_none_2ddffc283610c500\iexplore.exe
[2010/09/08 00:02:42 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=D5A730DFDEAE005373E62BC2A866E3BB – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18975_none_120477992ffffb10\iexplore.exe
[2009/04/24 10:01:36 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=D6157423C117F24D24695866A1D0A93F – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22418_none_2fe8d4ea331cfeb1\iexplore.exe
[2008/10/15 22:42:58 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=D762642A109433EEDCD332B0A9511137 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16764_none_2d3ee4e91d04fa01\iexplore.exe
[2009/11/21 09:05:17 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=E7F8DF50E483D165BB01F367D3519AA7 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22956_none_12a4b2a0490c7f28\iexplore.exe
[2009/03/02 22:22:10 | 000,636,072 | —- | M] (Microsoft Corporation) MD5=EA4BE33726155F89D89A3FE7142878E0 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16830_none_2d5b556b1cf03df9\iexplore.exe
[2011/05/28 00:09:21 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=ED65737D70FDEAC29F738E77D2496EE5 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19088_none_11fc80ad30059648\iexplore.exe
[2010/06/26 00:52:42 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=F05B3A2C6CB319DD1377AD566CF5ECE5 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23040_none_12a958f24909fe6f\iexplore.exe
[2009/01/14 22:18:47 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=F0B1CA517977BA2FF6DA33F1B966C488 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20996_none_2daa146a36391d73\iexplore.exe
[2009/04/24 10:08:04 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=F294D8EEB05C835EC44A12CE0A1DFE7A – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18248_none_2f3ec6751a17b593\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2006/11/02 06:41:15 | 000,016,384 | —- | M] (Microsoft Corporation) MD5=3CCDDDBC49DEACA370F39A9F0E146A1B – C:\Windows\winsxs\x86_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_6.0.6000.16386_en-us_3b55b11a57da5590\iexplore.exe.mui
[2009/03/08 15:27:11 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/03/08 15:27:11 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Windows\winsxs\x86_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_8.0.6001.18702_en-us_207795706a90d6c1\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE-058FE8F5.PF >
[2012/01/07 16:03:27 | 000,348,474 | —- | M] () MD5=9D465EF462E1EE243E3B6361DCABD429 – C:\Windows\Prefetch\IEXPLORE.EXE-058FE8F5.pf

< MD5 for: WINLOGON.EXE >
[2009/04/11 00:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\System32\winlogon.exe
[2009/04/11 00:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2011/12/24 17:50:20 | 000,182,856 | —- | M] () MD5=B382935AB01B27D0E14F267DBF288896 – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/01/20 20:24:49 | 000,314,880 | —- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2008/01/20 20:25:40 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=26AC28BF50DC112BAA794A83E08588F0 – C:\Windows\System32\en-US\winlogon.exe.mui
[2008/01/20 20:25:40 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=26AC28BF50DC112BAA794A83E08588F0 – C:\Windows\winsxs\x86_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.0.6001.18000_en-us_caf8918b0416723a\winlogon.exe.mui
[2006/11/02 06:40:50 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=A1D2856F3EC3C86EBBF1442B0245A8B3 – C:\Windows\winsxs\x86_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.0.6000.16386_en-us_c8c1cf8f072b6166\winlogon.exe.mui

< MD5 for: WINLOGON.EXE-DEDDC9B6.PF >
[2012/01/07 08:23:54 | 000,031,588 | —- | M] () MD5=4D10E2A862853DF8E2284AD2951AA950 – C:\Windows\Prefetch\WINLOGON.EXE-DEDDC9B6.pf

< MD5 for: WINLOGON.MOF >
[2006/09/18 15:41:56 | 000,002,794 | —- | M] () MD5=545C578F290B9CDD280966939935B9EA – C:\Windows\System32\wbem\winlogon.mof
[2006/09/18 15:41:56 | 000,002,794 | —- | M] () MD5=545C578F290B9CDD280966939935B9EA – C:\Windows\winsxs\x86_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.0.6000.16386_none_7e0207d478fccc94\winlogon.mof

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:FB1B13D8

< End of report >

OTL Extras logfile created on: 1/7/2012 4:08:20 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Margaret\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19170)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.99 Gb Total Physical Memory | 1.66 Gb Available Physical Memory | 55.50% Memory free
6.20 Gb Paging File | 4.81 Gb Available in Paging File | 77.55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.29 Gb Total Space | 148.01 Gb Free Space | 51.34% Space Free | Partition Type: NTFS
Drive D: | 9.77 Gb Total Space | 0.00 Gb Free Space | 0.05% Space Free | Partition Type: NTFS

Computer Name: FAMLIYPC | User Name: Patrick | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Mp3tag] – "C:\Program Files\Mp3tag\Mp3tag.exe" "/fp:%1" (Florian Heidenreich)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Orbitdownloader\orbitdm.exe" = C:\Program Files\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit – (Orbitdownloader.com)
"C:\Program Files\Orbitdownloader\orbitnet.exe" = C:\Program Files\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit – (Orbitdownloader.com)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00253DF5-5478-4E1E-A5F5-68D00B8B165D}" = lport=12001 | protocol=17 | dir=in | name=smart webserver handshake multicast port |
"{033C2FDF-AE65-4522-9B7C-F4198A5906A8}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{039A6B07-F5C0-4E12-B49C-463830E4D5D4}" = lport=55055 | protocol=6 | dir=in | name=akamai netsession interface |
"{0CC99F8F-4FC5-4850-B396-AD530D455A8B}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{14DA1342-1B21-4BA4-A11D-5A0ABE4AF4AA}" = rport=445 | protocol=6 | dir=out | app=system |
"{182B405D-6E88-4939-9717-AB9D70BD7C2B}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{18489898-04E4-4CC9-8D5F-B6E2E45B913A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{198B38F3-715E-4F65-852D-F804F7AAB1ED}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{1BEA39D5-CF37-4B32-A414-D8A3B5B3851E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{1CB03319-6345-49D7-85FC-923FD0CA0A72}" = lport=10244 | protocol=6 | dir=in | app=system |
"{2146F03B-1160-4C53-9A4F-0BD95BD8E5EB}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{2ED35059-FEC0-471D-848C-4105852A0672}" = lport=19540 | protocol=17 | dir=in | name=sxuptp |
"{3436D960-22C1-4CA6-A89E-E79E279A243D}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3830AC74-72B2-4FCA-AA47-139E1635FC17}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{387C2602-37AF-4846-BF6E-C556BD113FF8}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{39F3CBB9-9BEC-489C-A2C6-D1537B0980BA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3C9D7C2C-D0D7-4AD8-84DD-78A7A4B1AF8F}" = lport=137 | protocol=17 | dir=in | app=system |
"{43F37DB9-CF02-44EE-821D-7777C34A0A0B}" = rport=137 | protocol=17 | dir=out | app=system |
"{52538EBF-8ADC-43D4-B67B-2E8D287335A8}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{588ADFEA-675D-4397-8828-ED033CE0FF1B}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{5D40932C-44F3-49B1-A3D4-017D2787F312}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{631D8D58-E041-4EEE-B762-3A2FB1E0D7B8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6550E763-A5AB-446C-8768-3AE1A121F349}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6689B7B3-6D49-4FFE-A825-C15A251D7392}" = rport=10244 | protocol=6 | dir=out | app=system |
"{68DED736-FD13-49DC-ABB3-CADC4B3F94BA}" = rport=10243 | protocol=6 | dir=out | app=system |
"{6A854A23-3E59-458C-BCB3-F03A7A8DBE0F}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6EAEFAB0-3BE8-4094-A7BE-8CF5F6F40A3E}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{73BF55BC-C0B7-47AF-8ADA-13DA164E6FEA}" = lport=10244 | protocol=6 | dir=in | app=system |
"{774612DF-6DA7-44EC-AE54-D5AB96553DB6}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{78BFCCF6-23C7-4782-B09A-3FA03D647772}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7DBE2A74-93B4-4901-A844-16D7E9345F67}" = lport=3390 | protocol=6 | dir=in | app=system |
"{85AFC9D2-98E0-45E4-A878-0C9F9326C3C3}" = lport=139 | protocol=6 | dir=in | app=system |
"{85BB7F5A-54B4-4DF0-88C0-C9A7FA1673EB}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8868ED0D-4655-4ABC-87C9-4E06418F1566}" = lport=3390 | protocol=6 | dir=in | app=system |
"{9AE32BA4-C7B7-4397-AD05-148266F2428E}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{9B09049C-342D-41FB-8821-ACC862428483}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A2E177A3-3D9C-4B2E-BEDF-819E67A27977}" = rport=138 | protocol=17 | dir=out | app=system |
"{A4CACB0D-6E8E-4A17-80E7-5460BF7E71E7}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A63B4B47-41A0-474F-B187-438EBF04595D}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A7AC5D7C-6640-4B52-B496-D2947F176073}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A8D3B6FA-E069-4C43-818A-7DD40127161D}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{A979AAE5-C6E8-4262-BEDA-1CCB8AB9AB44}" = rport=10244 | protocol=6 | dir=out | app=system |
"{A9948FB5-8B62-46B3-B221-B32BF964223E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{B51D8C0D-26D3-4825-B996-DBBB1EDEE633}" = lport=138 | protocol=17 | dir=in | app=system |
"{BA1B0C0A-2A34-45C2-B056-1C5679A72B12}" = lport=2869 | protocol=6 | dir=in | app=system |
"{C314E426-E25D-4AE6-A20D-7B5793343477}" = lport=10243 | protocol=6 | dir=in | app=system |
"{CFE39855-3B83-4933-B2D0-20D5847224CF}" = rport=139 | protocol=6 | dir=out | app=system |
"{D1710C69-58C4-4CBF-B87D-62D493E145CD}" = lport=445 | protocol=6 | dir=in | app=system |
"{D8936BC1-3338-4CD1-9E87-88A1A5CAFC18}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EB597432-C932-445E-A52D-85B4F85A5C64}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{EBBB8C5A-E2B0-4B0A-BD08-A75153D9AF6B}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{FA4D695E-FF1F-4383-8E75-E8DC9B0F1A24}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{FC0511F7-F3DA-4D56-B476-DD649ACB3028}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04280874-5DB6-42A7-A3D6-DD9BB58B0849}" = protocol=6 | dir=in | app=c:\program files\smart technologies\smart product drivers\ucgui.exe |
"{07E2A2DC-9474-4488-AC6C-3A71357CA741}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{085FB9B7-A12A-4278-967B-B1897F9F3521}" = protocol=6 | dir=in | app=c:\program files\belkin\router setup and monitor\belkinsetup.exe |
"{0DBF9C01-B4F6-40CB-8693-8D6C62B828E0}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{0E7E9FB7-5B26-4A99-BE9C-A0FD70B1E82A}" = protocol=6 | dir=in | app=c:\program files\smart technologies\smart product drivers\smartsnmpagent.exe |
"{1B14B5A6-41F3-4B77-823C-19C5F48DBCFA}" = dir=in | app=c:\program files\avg\avg9\avgnsx.exe |
"{1EEF560C-BA75-4420-8333-808CDC0B7C81}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{2017914B-49E9-4904-AD54-EA80C606F33E}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{209CA455-A16B-469A-9A21-BE52D017FD7D}" = protocol=6 | dir=in | app=c:\program files\belkin\router setup and monitor\belkinsetup.exe |
"{2591DE80-A06C-4E3A-AF77-0768C52D734A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{285F73A5-F513-4018-BCA4-7A7868539176}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{2B5C92A7-F894-4520-9659-B2D4D7DD92E2}" = protocol=6 | dir=in | app=c:\program files\smart technologies\smart product drivers\ucservice.exe |
"{3000B31E-921B-4A31-A12C-CFA30904DEDC}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |
"{348E9C42-FD65-45EE-BEE6-A2F8324AF50A}" = protocol=17 | dir=in | app=c:\program files\smart technologies\smart product drivers\webserver.exe |
"{3642E352-B022-4D5C-97FB-0E9A3FDEA9F9}" = dir=in | app=c:\program files\belkin\belkin usb print and storage center\connect.exe |
"{3BA8B27F-E16B-45C5-9FC5-F9D85740A88C}" = protocol=17 | dir=in | app=c:\program files\smart technologies\smart product drivers\webserver.exe |
"{3F798CD1-5312-4651-A742-77D0C49DE125}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{418F6466-8E64-46C1-8F54-BE548D287937}" = protocol=17 | dir=in | app=c:\program files\smart technologies\smart product drivers\ucgui.exe |
"{4C628798-9A3F-497D-9B2C-E46BDA8B09D4}" = protocol=17 | dir=in | app=c:\program files\smart technologies\smart product drivers\ucservice.exe |
"{4F53CB57-2461-4D1B-9E2A-C7DE1FF52F91}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5A8981B6-2E9A-4D18-97AF-8F5AFC0B58E5}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{5D45F3B8-8A84-40B3-B17A-7033502F7190}" = protocol=6 | dir=in | app=c:\users\patrick\desktop\videoconvertersetup.exe |
"{5E1604DC-1E85-4EB9-A2AC-D8669B7D1E43}" = protocol=6 | dir=in | app=c:\program files\smart technologies\smart product drivers\webserver.exe |
"{60F460F3-72B4-4231-AEE3-07D3B32F073A}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{62BEB50D-F4E3-4166-A9FB-736BA5BA3315}" = protocol=17 | dir=in | app=c:\program files\frostwire\frostwire.exe |
"{63E1305C-E71B-4D5C-BB6B-26D7BC7F2FA8}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{6653BC26-BAC4-450C-82D0-60B1543EC6D0}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{6A6F36A9-BD0A-4014-A3B4-77005566430B}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{6B4B538D-AE1E-4729-8BF8-A768151CF688}" = protocol=6 | dir=in | app=c:\program files\smart technologies\smart product drivers\webserver.exe |
"{6B4C57C1-0632-496A-8184-3FFFF563B074}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{6C3BC1A5-8883-40CC-91BA-E9E850E45273}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{7177EBB8-4A95-4236-ADBB-BCE6A4EC2EC5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7438DDEC-ABD2-4E29-AB6F-BC9AA11F453C}" = protocol=6 | dir=in | app=c:\program files\frostwire\frostwire.exe |
"{758DFEF5-083E-40B7-92BD-63D7FD44C03D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{7E40E97A-2D76-45D2-8CE4-E8531CF06501}" = protocol=17 | dir=in | app=c:\users\patrick\desktop\videoconvertersetup.exe |
"{80D7DA32-8FA0-4B2A-AE5A-9480D6460164}" = protocol=17 | dir=in | app=c:\program files\belkin\router setup and monitor\belkinsetup.exe |
"{82F6137B-AC3D-4B5A-B15C-ECF9F7A420E8}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{85370477-B87D-4C4B-9A7B-3161F6BA0BA9}" = dir=in | app=c:\program files\avg\avg8\avgupd.exe |
"{8562D1AE-EC75-4416-8948-DA7F16E436A3}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{88A48D7E-A65E-4E08-904C-447799B1026C}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8E0DC556-F5E0-43D3-B7D7-1757E462ABD7}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |
"{8F3D5F4D-A653-45E7-84A6-DCC754360748}" = protocol=6 | dir=in | app=c:\program files\smart technologies\smart product drivers\ucservice.exe |
"{96B701B5-9D13-4F57-8C16-A1B861C6E68F}" = protocol=6 | dir=in | app=c:\program files\smart technologies\smart product drivers\ucgui.exe |
"{9AC9438E-AC1F-4CDD-B32E-CA7BCE05EC01}" = protocol=6 | dir=out | app=system |
"{9DE43C43-589F-4B7B-9BCF-757E3BD14311}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A7522A94-7261-42F5-B20F-92FD34484354}" = protocol=6 | dir=in | app=c:\program files\smart technologies\smart product drivers\smartsnmpagent.exe |
"{A7D77070-5E58-4CD4-8BC3-972E8365A0DC}" = protocol=17 | dir=in | app=c:\program files\smart technologies\smart product drivers\ucgui.exe |
"{A814A9E6-8D55-4B54-8C88-85E85B3B438A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{B2DA274E-ADAE-4B3B-A16E-8D4271729E08}" = protocol=17 | dir=in | app=c:\program files\smart technologies\smart product drivers\smartsnmpagent.exe |
"{B9C5CAE3-BBA5-43B4-B6F5-4F31D58E475C}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{BE59F90D-A95A-4EFC-8CAA-2F49E79AC957}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{BEE2E021-1F90-41BC-AC8A-6EE12E8F4978}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{C2632CE3-E3FD-4D64-8370-A86EC54C6C4F}" = protocol=17 | dir=in | app=c:\program files\smart technologies\smart product drivers\ucservice.exe |
"{C382C44A-D29B-4383-9C2B-B6185DC710FA}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{CBF84D2F-9BB2-4B7B-94FD-7E7347465DCE}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{CE5FCDB4-05CC-466A-A4C7-695AD200E907}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |
"{D8F4EABA-6AC5-417A-8D8A-A3D5A96C4345}" = protocol=17 | dir=in | app=c:\program files\smart technologies\smart product drivers\smartsnmpagent.exe |
"{DCF0CC30-3541-4A1F-BD40-9629BA1118DC}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{E5952B12-E1C4-484A-9B96-5DC664265FC4}" = dir=in | app=c:\program files\belkin\router setup and monitor\belkinsetup.exe |
"{EA81F3A4-C468-4DD5-A266-E18050728AD6}" = dir=in | app=c:\program files\avg\avg8\avgemc.exe |
"{EB4663D2-C398-4C54-99F9-AA8F9CD8EAC4}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{F0FAFCC8-F23E-4C47-8661-0B2B35815998}" = protocol=17 | dir=in | app=c:\program files\belkin\router setup and monitor\belkinsetup.exe |
"{F2F6A95E-C23C-43E1-BA75-258BF34C61A3}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{F6D942F1-C343-4C1C-8CF5-AEC1A3A9F5E5}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |
"{FF4CC4AF-C4A3-464A-B671-4CCA0CC59BC2}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{4FD3F1E4-BF39-4927-A7D2-A568029FD1EE}C:\users\margaret\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\margaret\appdata\local\akamai\netsession_win.exe |
"TCP Query User{5329B400-C435-432F-B87B-840F996A92FF}C:\program files\flashget\flashget.exe" = protocol=6 | dir=in | app=c:\program files\flashget\flashget.exe |
"TCP Query User{6B566B3D-6C63-4A0F-A586-DE5F617F2084}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{9C4A3CFF-199D-409A-8C7D-E850CEFD30C8}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{9F828A3F-CE25-4BFB-86A2-33608D7BFE90}C:\program files\participatory culture foundation\miro\xulrunner\python\miro_downloader.exe" = protocol=6 | dir=in | app=c:\program files\participatory culture foundation\miro\xulrunner\python\miro_downloader.exe |
"TCP Query User{D72D1D00-53A5-476E-AEE8-37D7AFD94A9F}C:\program files\frostwire\frostwire.exe" = protocol=6 | dir=in | app=c:\program files\frostwire\frostwire.exe |
"TCP Query User{DD44BD5E-5C05-4320-A564-63BE10299B0D}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{E4E096C0-88F3-466C-9683-7A47B13AA3A5}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{EE6490F8-8454-49D6-8397-A0A34677A518}C:\program files\orbitdownloader\orbitnet.exe" = protocol=6 | dir=in | app=c:\program files\orbitdownloader\orbitnet.exe |
"UDP Query User{6CA0F2A1-376D-4830-B3C1-89829D96A810}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"UDP Query User{84800F7E-85DA-450E-A741-5E3CE25950FF}C:\program files\orbitdownloader\orbitnet.exe" = protocol=17 | dir=in | app=c:\program files\orbitdownloader\orbitnet.exe |
"UDP Query User{8B1FEE36-98B3-4A10-820C-0E8F596EBB06}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{941E2197-DBA7-4027-AC95-3D0DAC2EAF73}C:\users\margaret\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\margaret\appdata\local\akamai\netsession_win.exe |
"UDP Query User{A201AFE0-1F55-41F8-AAAF-7809C0D7E16B}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{BEB16521-7BF7-456C-AA1E-F2071C832469}C:\program files\participatory culture foundation\miro\xulrunner\python\miro_downloader.exe" = protocol=17 | dir=in | app=c:\program files\participatory culture foundation\miro\xulrunner\python\miro_downloader.exe |
"UDP Query User{EA3B6A63-6451-4127-8FB9-265489E400F2}C:\program files\frostwire\frostwire.exe" = protocol=17 | dir=in | app=c:\program files\frostwire\frostwire.exe |
"UDP Query User{F054617A-F6C3-408B-8F49-5C127B5EFF83}C:\program files\flashget\flashget.exe" = protocol=17 | dir=in | app=c:\program files\flashget\flashget.exe |
"UDP Query User{FE4709EC-8A03-41C0-B06B-0C4965786D1A}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0076E1AC-9E7B-4B9F-A62A-4CC9511AD8E3}" = Zune Language Pack (FR)
"{007B37D9-0C45-4202-834B-DD5FAAE99D63}" = ArcSoft Print Creations - Slimline Card
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE
"{0D025345-1033-4F35-A5CE-68CDCDE6CC03}" = Evernote
"{0FAAA044-04CF-4766-84A2-A6A95CE196BD}" = Samsung PC Studio 3
"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{1FECF5F8-8E75-432C-9FF7-1C04F1956B54}" = Realtek Ethernet Network Card Diagnostic tool for Windows Vista
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 22
"{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}" = Microsoft SQL Server 2005 Tools Express Edition
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
"{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}" = essvatgt
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{353FE16B-30FE-469A-BF55-B978F4218003}" = iTunes
"{370BCBBA-67D7-4535-ADCD-58CD1C8DEC99}" = Zune Language Pack (DE)
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40EC6323-497B-44DA-8A88-74578622D9B3}" = Zune Language Pack (IT)
"{42938595-0D83-404D-9F73-F8177FDD531A}" = ESScore
"{43602F34-1AA3-44FB-AEB2-D08C2C73743F}" = Paint.NET v3.36
"{4537EA4B-F603-4181-89FB-2953FC695AB1}" = netbrdg
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CE6C6E8-0DAD-4757-86ED-7FB4035BA98B}" = SMART Product Drivers
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{5316DFC9-CE99-4458-9AB3-E8726EDE0210}" = skin0001
"{53C6D09E-EAB6-49E5-BA4C-BA7FF13830FB}" = Sound Blaster Audigy ADVANCED MB
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{56589DFE-0C29-4DFE-8E42-887B771ECD23}" = ArcSoft Print Creations - Photo Book
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B7B6D4D-8F9B-4CB3-8CA4-BCA9CC4C1A22}" = EDocs
"{6C1E7AA1-44E9-446D-AAB2-0DE6D9EFEAB1}" = Safari
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{70C592EC-AE9B-4734-928B-676E824FB41E}" = MFC RunTime files
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{7670D32F-DAE6-4E49-8C8B-B3F08B5B1686}" = Microsoft SQL Server Native Client
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7732DA71-2FB6-5C99-D0D9-58A2DB360895}" = FlipShare
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{82CA0A0C-A3EC-4167-B694-909205B2EDEC}" = muvee Plugin 1.0
"{842BEE12-CCCB-43F4-ABAF-CBA6DFE2583D}" = Nero BurnLite 10
"{853A4763-6643-4604-8D64-28BDD8925F4C}" = Apple Application Support
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{888FFC82-688D-46AB-A776-B417885432B6}" = Zune
"{8943CE61-53BD-475E-90E1-A580869E98A2}" = staticcr
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
"{9550F8A6-3D21-4544-8B87-F9FE7E01B964}" = SMART Notebook
"{9591C049-5CAE-4E89-A8D9-191F1899628B}" = ArcSoft Print Creations - Funhouse
"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A12458AA-2E22-4451-A8ED-E2601FA0032A}" = QuickVerse 2010
"{A8B94669-8654-4126-BD28-D0D2412CDED6}" = TI Connect 1.6
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB627AF2-9C7E-4DBD-816B-3B2646B81E89}" = Nero BurnLite 10
"{AC76BA86-7AD7-1033-7B44-A92000000001}" = Adobe Reader 9.2
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
"{B0D83FCD-9D42-43ED-8315-250326AADA02}" = ArcSoft Print Creations - Scrapbook
"{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}" = OfotoXMI
"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{B935C985-A17F-484B-8470-09E4FC27DC26}" = Dell-eBay
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{BEF106F8-2689-4530-925A-E1117836E8CD}" = Google SketchUp 7
"{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio 3
"{CA9ED5E4-1548-485B-A293-417840060158}" = ArcSoft Print Creations - Photo Calendar
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CAE8A0F1-B498-4C23-95FA-55047E730C8F}" = ArcSoft Print Creations
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare software
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{E4144962-A9C5-4898-9252-ED59BC5A4F15}" = Geo CS Test Gen
"{E6B4117F-AC59-4B13-9274-EB136E8897EE}" = ArcSoft Print Creations - Album Page
"{E7084B89-69E0-46B3-A118-8F99D06988CD}" = Microsoft SQL Server VSS Writer
"{E82FBDF4-8C05-4513-B8D8-2331145FCA11}_is1" = Any Video to DVD Converter and Burner 2.3.0
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE
"{EE4ACABF-531E-419A-9225-B8E0FA4955AF}" = Zune Language Pack (ES)
"{F04F9557-81A9-4293-BC49-2C216FA325A7}" = ArcSoft Print Creations - Greeting Card
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
"{F6CB42B9-F033-4152-8813-FF11DA8E6A78}" = Dell Dock
"{F850707C-B6A0-4B56-8709-F89CF8F9AC6D}" = Eraser
"{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone Configuration Utility
"{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock
"3ivx MPEG-4 5.0.3" = 3ivx MPEG-4 5.0.3 (remove only)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Akamai" = Akamai NetSession Interface Service
"Any Audio Converter_is1" = Any Audio Converter 1.1.0
"Any DVD Converter Professional_is1" = Any DVD Converter Professional 3.7.6
"Any Video Converter_is1" = Any Video Converter 2.6.7
"AVG9Uninstall" = AVG Free 9.0
"Belkin Setup and Router Monitor_is1" = Belkin Setup and Router Monitor
"Belkin USB Print and Storage Center" = Belkin USB Print and Storage Center
"CanoScan Toolbox 5.0" = Canon CanoScan Toolbox 5.0
"CCleaner" = CCleaner (remove only)
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"FastStone Capture" = FastStone Capture 5.3
"Free Disk Analyzer" = Free Disk Analyzer
"Free DVD Decrypter_is1" = Free DVD Decrypter version 1.5
"Free Studio_is1" = Free Studio version 4.8
"Free Video Converter" = Free Video Converter
"FrostWire" = FrostWire 4.21.5
"GoToAssist" = GoToAssist 8.0.0.514
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{E4144962-A9C5-4898-9252-ED59BC5A4F15}" = Geo CS Test Gen
"iPod To Computer Transfer_is1" = iPod To Computer Transfer 4.8
"KeePass Password Safe_is1" = KeePass Password Safe 1.13
"LimeWire" = LimeWire 5.5.16
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.60.0.1800
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Miro" = Miro
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"Mp3tag" = Mp3tag v2.42
"MPEG4E" = MPEG4E VFW - H.264/MPEG-4 AVC codec (remove only)
"OpenXX{5508822C-77F2-4174-9D48-7C3720DCB357}" = Open++
"Orbit_is1" = Orbit Downloader
"Revo Uninstaller" = Revo Uninstaller 1.75
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"Screen Capturer" = Screen Capturer
"Search Toolbar" = Search Toolbar
"Smart Defrag_is1" = Smart Defrag 1.10
"Songbird 20081124" = Songbird 1.0.0 (20081124)
"TipCam" = TipCam 2.0
"Ultra Video Joiner_is1" = Ultra Video Joiner 4.7.1127
"Uninstall_is1" = Uninstall 1.0.0.1
"Unlocker" = Unlocker 1.8.7
"ViceVersa FREE_is1" = ViceVersa Free 1.0.5
"Video Mover_is1" = Video Mover
"WinGimp-2.0_is1" = Gimp 2.6.0
"WinRAR archiver" = WinRAR archiver
"WinSplit Revolution" = WinSplit Revolution (v8.07)
"Zune" = Zune

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Eraser" = Eraser
"Google Chrome" = Google Chrome
"Move Media Player" = Move Media Player
"Muziic Player & Encoder" = Muziic Player & Encoder
"QUICKMEDIACONVERTER" = Player
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.8

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/5/2012 10:09:18 PM | Computer Name = FamliyPC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.19170, time stamp
0x4eb21c98, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception
code 0xc0000005, fault offset 0x025f0e83, process id 0x1598, application start time
0x01cccc09f4c1f0b9.

Error - 1/5/2012 10:13:06 PM | Computer Name = FamliyPC | Source = WinMgmt | ID = 10
Description =

Error - 1/5/2012 10:23:39 PM | Computer Name = FamliyPC | Source = WinMgmt | ID = 10
Description =

Error - 1/5/2012 10:43:30 PM | Computer Name = FamliyPC | Source = WinMgmt | ID = 10
Description =

Error - 1/5/2012 10:47:30 PM | Computer Name = FamliyPC | Source = WinMgmt | ID = 10
Description =

Error - 1/5/2012 11:00:30 PM | Computer Name = FamliyPC | Source = WinMgmt | ID = 10
Description =

Error - 1/5/2012 11:02:34 PM | Computer Name = FamliyPC | Source = Application Error | ID = 1000
Description = Faulting application BkBackupScheduler.exe, version 0.0.0.0, time
stamp 0x4b7bb5f8, faulting module unknown, version 0.0.0.0, time stamp 0x00000000,
exception code 0xc0000005, fault offset 0x00000000, process id 0x194, application
start time 0x01cccc1f25880d92.

Error - 1/5/2012 11:06:00 PM | Computer Name = FamliyPC | Source = WinMgmt | ID = 10
Description =

Error - 1/6/2012 10:47:46 PM | Computer Name = FamliyPC | Source = Application Error | ID = 1000
Description = Faulting application BkBackupScheduler.exe, version 0.0.0.0, time
stamp 0x4b7bb5f8, faulting module unknown, version 0.0.0.0, time stamp 0x00000000,
exception code 0xc0000005, fault offset 0x00000000, process id 0xa98, application
start time 0x01cccc2011cebf42.

Error - 1/6/2012 11:00:41 PM | Computer Name = FamliyPC | Source = WinMgmt | ID = 10
Description =

[ Media Center Events ]
Error - 12/18/2008 10:22:26 PM | Computer Name = FamliyPC | Source = ehReplay | ID = 700
Description =

Error - 12/18/2008 10:22:27 PM | Computer Name = FamliyPC | Source = McrMgr | ID = 109
Description =

Error - 12/18/2008 10:27:53 PM | Computer Name = FamliyPC | Source = McrMgr | ID = 107
Description =

Error - 12/18/2008 10:28:37 PM | Computer Name = FamliyPC | Source = McrMgr | ID = 109
Description =

Error - 1/4/2009 2:55:05 PM | Computer Name = FamliyPC | Source = McrMgr | ID = 107
Description =

Error - 1/4/2009 2:59:05 PM | Computer Name = FamliyPC | Source = McrMgr | ID = 107
Description =

Error - 1/4/2009 5:51:19 PM | Computer Name = FamliyPC | Source = McrMgr | ID = 109
Description =

Error - 1/15/2009 10:16:20 PM | Computer Name = FamliyPC | Source = McrMgr | ID = 107
Description =

Error - 1/15/2009 10:20:20 PM | Computer Name = FamliyPC | Source = McrMgr | ID = 107
Description =

Error - 7/12/2009 5:33:01 PM | Computer Name = FamliyPC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ OSession Events ]
Error - 10/3/2010 12:39:10 PM | Computer Name = FamliyPC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 12454
seconds with 660 seconds of active time. This session ended with a crash.

Error - 2/13/2011 8:39:57 PM | Computer Name = FamliyPC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 10565
seconds with 60 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 1/6/2012 11:03:53 PM | Computer Name = FamliyPC | Source = DCOM | ID = 10005
Description =

Error - 1/6/2012 11:03:53 PM | Computer Name = FamliyPC | Source = Service Control Manager | ID = 7009
Description =

Error - 1/6/2012 11:08:50 PM | Computer Name = FamliyPC | Source = Service Control Manager | ID = 7022
Description =

Error - 1/6/2012 11:30:08 PM | Computer Name = FamliyPC | Source = DCOM | ID = 10010
Description =

Error - 1/6/2012 11:31:42 PM | Computer Name = FamliyPC | Source = Service Control Manager | ID = 7043
Description =

Error - 1/6/2012 11:32:15 PM | Computer Name = FamliyPC | Source = Service Control Manager | ID = 7011
Description =

Error - 1/7/2012 12:30:57 AM | Computer Name = FamliyPC | Source = disk | ID = 262151
Description = The device, \Device\Harddisk0\DR0, has a bad block.

Error - 1/7/2012 12:30:58 AM | Computer Name = FamliyPC | Source = disk | ID = 262151
Description = The device, \Device\Harddisk0\DR0, has a bad block.

Error - 1/7/2012 11:11:24 AM | Computer Name = FamliyPC | Source = disk | ID = 262151
Description = The device, \Device\Harddisk0\DR0, has a bad block.

Error - 1/7/2012 11:11:25 AM | Computer Name = FamliyPC | Source = disk | ID = 262151
Description = The device, \Device\Harddisk0\DR0, has a bad block.

< End of report >

aswMBR version 0.9.9.1297 Copyright© 2011 AVAST Software
Run date: 2012-01-07 16:20:51
—————————–
16:20:51.670 OS Version: Windows 6.0.6002 Service Pack 2
16:20:51.670 Number of processors: 4 586 0xF0B
16:20:51.671 ComputerName: FAMLIYPC UserName: Patrick
16:20:53.733 Initialize success
16:22:15.940 AVAST engine defs: 12010701
16:22:33.240 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
16:22:33.242 Disk 0 Vendor: SAMSUNG_HD322HJ 1AC01113 Size: 305245MB BusType: 3
16:22:33.257 Disk 0 MBR read successfully
16:22:33.259 Disk 0 MBR scan
16:22:33.264 Disk 0 Windows VISTA default MBR code
16:22:33.268 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 39 MB offset 63
16:22:33.275 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10000 MB offset 81920
16:22:33.290 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 295204 MB offset 20561920
16:22:33.297 Disk 0 scanning sectors +625140400
16:22:33.363 Disk 0 scanning C:\Windows\system32\drivers
16:22:46.835 Service scanning
16:22:47.972 Modules scanning
16:22:54.756 Disk 0 trace - called modules:
16:22:54.803 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
16:22:54.808 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x856900e0]
16:22:54.813 3 CLASSPNP.SYS[8a39f8b3] -> nt!IofCallDriver -> [0x8497eb50]
16:22:54.818 5 acpi.sys[8069e6bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x853a5b98]
16:22:56.554 AVAST engine scan C:\Windows
16:23:01.061 AVAST engine scan C:\Windows\system32
16:25:16.674 AVAST engine scan C:\Windows\system32\drivers
16:25:36.253 AVAST engine scan C:\Users\Patrick
17:12:00.685 AVAST engine scan C:\ProgramData
17:22:54.608 Scan finished successfully
17:36:39.231 Disk 0 MBR has been saved successfully to "C:\Users\Margaret\Desktop\MBR.dat"
17:36:39.248 The log file has been saved successfully to "C:\Users\Margaret\Desktop\aswMBR.txt"

amitemurray

Post #15January 7, 2012, 11:45 PM UTC last edited January 7, 2012, 11:49 PM UTC

(accidental duplicate post)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

zero access rootkit infection [Solved]

✨ Ask AI

Ask AI