What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Trojan cinmus can't remove [Solved]

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I scanned with malwarebytes and it found the trojan cinmus and it keeps appearing after a restart when I removed it with malwarebytes and rescan. What do I need to do?
I googled for trojan cinmus and found this topic: http://forums.malwarebytes.org/index.php?showtopic=89919 which I followed but that didn't help with running those 2 tools in that topic so I'm giving it another try from scratch.

What do I need to do?
Post #2
Hello and welcome to What the Tech.

My name is Michael and I will be helping you with your computer problems.

Be aware that I am currently in training, which means that my replies must first be approved by one of my teachers. This may cause a slight delay in my responses, but keep in mind that this process is only to ensure you are receiving advice of the utmost accuracy.

Please keep the following points in mind:
  • Malware research is often a time consuming process and sometimes multiple tools/methods will have to be employed before an infection is completely dealt with. Please be patient during the process of removal.
  • Read my instructions carefully before carrying them out. Also, consider printing out any instructions in case you lose your Internet connection.
  • If you have any questions, please ask before carrying out a fix. Clearing up any confusion beforehand will save time in the long run. That said, I will try to post instructions as clearly and concisely as possible.
  • Please reply to this thread. Do not start a new topic, and do not request help on other forums during the course of the cleaning process.
  • If you do not reply after three (3) days, your thread will be closed.
IMPORTANT NOTE: Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

I will be back as soon as possible with a response.
Post #3
  • OTL

    Download OTL to your Desktop

  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Select All Users
  • Under the Custom Scan box paste this in
    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    explorer.exe
    winlogon.exe
    Userinit.exe
    svchost.exe
    /md5stop
    %systemroot%\*. /rp /s
    CREATERESTOREPOINT
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Post both logs

[*]aswMBR


  • Please download aswMBR.exe and save it to your desktop.
  • Double click aswMBR.exe to start the tool.
  • When prompted to download virus definitions, please do so.
  • Click Scan. Note: Do NOT attempt any Fix yet.
  • When the scan completes, click Save log, save it to your desktop and post it in your next reply.
  • There should also be another file that is created on your desktop named MBR.dat. Please right-click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.
Post #4
1. OTL logs:

OTL logfile created on: 2012-02-18 18:55:14 - Run 1
OTL by OldTimer - Version 3.2.32.0 Folder = C:\Users\Pappa\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 0000041D | Country: Sweden | Language: SVE | Date Format: yyyy-MM-dd

3,75 Gb Total Physical Memory | 2,32 Gb Available Physical Memory | 61,87% Memory free
7,49 Gb Paging File | 5,95 Gb Available in Paging File | 79,36% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 319,50 Gb Free Space | 68,61% Space Free | Partition Type: NTFS

Computer Name: PAPPA-PC | User Name: Pappa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012-02-18 18:52:54 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Pappa\Desktop\OTL.exe
PRC - [2012-01-03 14:10:42 | 000,063,928 | —- | M] (Adobe Systems Incorporated) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011-11-16 10:17:52 | 002,057,160 | —- | M] () – C:\Program Files (x86)\Baidu\BaiduPlayer\1.0.23.108\BaiduPlayer.exe
PRC - [2011-11-16 10:17:52 | 000,504,776 | —- | M] (Baidu.com, Inc.) – C:\Program Files (x86)\Baidu\BaiduPlayer\1.0.23.108\BaiduP2PService.exe
PRC - [2011-11-03 12:08:24 | 000,521,592 | —- | M] (UUSEE) – C:\Program Files (x86)\Common Files\uusee\UUSeeMediaCenter.exe
PRC - [2010-02-03 15:17:18 | 005,756,544 | —- | M] (ASUSTeK Computer Inc.) – C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe


========== Modules (No Company Name) ==========

MOD - [2011-11-16 10:17:54 | 000,680,904 | —- | M] () – C:\Program Files (x86)\Baidu\BaiduPlayer\1.0.23.108\log_report.dll
MOD - [2011-11-16 10:17:54 | 000,119,808 | —- | M] () – C:\Program Files (x86)\Baidu\BaiduPlayer\1.0.23.108\zlib1.dll
MOD - [2011-11-16 10:17:52 | 002,057,160 | —- | M] () – C:\Program Files (x86)\Baidu\BaiduPlayer\1.0.23.108\BaiduPlayer.exe
MOD - [2011-11-16 10:17:52 | 001,717,192 | —- | M] () – C:\Program Files (x86)\Baidu\BaiduPlayer\1.0.23.108\BDPlayer.dll
MOD - [2011-11-16 10:17:52 | 000,738,248 | —- | M] () – C:\Program Files (x86)\Baidu\BaiduPlayer\1.0.23.108\clientstat.dll
MOD - [2011-09-16 12:44:12 | 000,351,096 | —- | M] () – C:\Program Files (x86)\Common Files\uusee\Localserver.dll
MOD - [2010-06-04 03:00:38 | 000,091,512 | —- | M] () – C:\Program Files (x86)\Common Files\uusee\CoCode.dll
MOD - [2010-06-04 02:59:56 | 000,058,744 | —- | M] () – C:\Program Files (x86)\Common Files\uusee\download.dll
MOD - [2009-09-30 04:33:08 | 000,024,576 | R— | M] () – C:\Windows\SysWOW64\AsIO.dll
MOD - [2009-03-25 15:53:14 | 000,053,248 | —- | M] () – C:\Program Files (x86)\ASUS\EPU-4 Engine\AsSpindownTimeout.dll
MOD - [2009-03-19 21:35:52 | 000,208,896 | —- | M] () – C:\Program Files (x86)\ASUS\EPU-4 Engine\AiNap.dll
MOD - [2009-03-19 21:35:50 | 000,008,704 | —- | M] () – C:\Program Files (x86)\ASUS\EPU-4 Engine\vvc.dll
MOD - [2009-01-15 13:55:10 | 000,565,248 | —- | M] () – C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011-04-27 16:21:18 | 000,288,272 | —- | M] (Microsoft Corporation) [On_Demand | Running] – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe – (NisSrv)
SRV:64bit: - [2011-04-27 16:21:18 | 000,012,784 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe – (MsMpSvc)
SRV:64bit: - [2009-09-19 03:17:42 | 000,202,752 | —- | M] (AMD) [Auto | Running] – C:\Windows\SysNative\atiesrxx.exe – (AMD External Events Utility)
SRV:64bit: - [2009-07-14 02:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV:64bit: - [2009-07-14 02:40:01 | 000,193,536 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\appmgmts.dll – (AppMgmt)
SRV - [2012-01-03 14:10:42 | 000,063,928 | —- | M] (Adobe Systems Incorporated) [Auto | Running] – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe – (AdobeARMservice)
SRV - [2010-03-18 12:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009-06-10 22:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2011-06-10 05:34:52 | 000,539,240 | —- | M] (Realtek ) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Rt64win7.sys – (RTL8167)
DRV:64bit: - [2011-04-27 14:25:24 | 000,084,864 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\NisDrvWFP.sys – (NisDrv)
DRV:64bit: - [2011-03-11 07:41:12 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011-03-11 07:41:12 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2010-11-20 14:33:35 | 000,078,720 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2010-11-20 12:07:05 | 000,059,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV:64bit: - [2009-09-19 05:32:38 | 006,170,624 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmdag.sys – (atikmdag)
DRV:64bit: - [2009-08-17 12:20:46 | 001,235,968 | —- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\viahduaa.sys – (VIAHdAudAddService)
DRV:64bit: - [2009-08-06 03:59:00 | 000,987,648 | —- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\Dnetr28ux.sys – (netr28ux)
DRV:64bit: - [2009-07-16 04:38:40 | 000,015,416 | —- | M] () [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\ASACPI.sys – (MTsensor)
DRV:64bit: - [2009-07-14 02:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009-07-14 02:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009-07-14 02:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009-07-14 01:39:20 | 000,023,040 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\WSDPrint.sys – (WSDPrintDevice)
DRV:64bit: - [2009-06-24 11:23:24 | 000,205,472 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\RtHDMIVX.sys – (RTHDMIAzAudService)
DRV:64bit: - [2009-06-10 21:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009-06-10 21:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009-06-10 21:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009-06-10 21:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2009-05-05 05:30:28 | 000,016,440 | —- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\AtiPcie.sys – (AtiPcie) AMD PCI Express (3GIO)
DRV - [2009-07-14 02:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)
DRV - [2007-02-07 19:27:46 | 000,014,104 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | Boot | Running] – C:\Windows\SysWOW64\speedfan.sys – (speedfan)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2084622461-223115633-1812412026-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se/
IE - HKU\S-1-5-21-2084622461-223115633-1812412026-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-2084622461-223115633-1812412026-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F1 95 59 F0 EF 3F CB 01 [binary data]
IE - HKU\S-1-5-21-2084622461-223115633-1812412026-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@baidu.com/npxbdyy: C:\Program Files (x86)\Baidu\BaiduPlayer\1.0.23.108\npxbdyy.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Pappa\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Pappa\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012-02-17 16:53:13 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012-02-17 21:16:43 | 000,000,000 | —D | M]

[2010-08-19 23:57:10 | 000,000,000 | —D | M] (No name found) – C:\Users\Pappa\AppData\Roaming\Mozilla\Extensions
[2012-01-05 23:32:30 | 000,000,000 | —D | M] (No name found) – C:\Users\Pappa\AppData\Roaming\Mozilla\Firefox\Profiles\vayipwjv.default\extensions
[2011-09-29 19:21:34 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
() (No name found) – C:\USERS\PAPPA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\VAYIPWJV.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012-02-17 16:53:13 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012-02-02 23:15:11 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012-02-02 23:15:11 | 000,002,040 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Pappa\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Pappa\AppData\Local\Google\Chrome\Application\17.0.963.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Pappa\AppData\Local\Google\Chrome\Application\17.0.963.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Pappa\AppData\Local\Google\Chrome\Application\17.0.963.56\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: BaiduPlayer Browser Plugin (Enabled) = C:\Program Files (x86)\Baidu\BaiduPlayer\1.0.23.108\npxbdyy.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Pappa\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: AdBlock = C:\Users\Pappa\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.2.5_0\

O1 HOSTS File: ([2012-02-17 21:19:25 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UUSeeMediaCenter] C:\Program Files (x86)\Common Files\uusee\UUSeeMediaCenter.exe (UUSEE)
O4 - HKU\S-1-5-21-2084622461-223115633-1812412026-1000..\Run: [BAIDUMEDIA] C:\Program Files (x86)\Baidu\BaiduPlayer\1.0.23.108\BaiduPlayer.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2084622461-223115633-1812412026-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2084622461-223115633-1812412026-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: 使用UUSee下载 - C:\Program Files (x86)\uusee\geturltodown.htm ()
O8:64bit: - Extra context menu item: 使用UUSee加速播放 - C:\Program Files (x86)\uusee\geturltoplay.htm ()
O8 - Extra context menu item: 使用UUSee下载 - C:\Program Files (x86)\uusee\geturltodown.htm ()
O8 - Extra context menu item: 使用UUSee加速播放 - C:\Program Files (x86)\uusee\geturltoplay.htm ()
O9 - Extra Button: 小游戏 - {998A88A0-A355-809B-831C-B83A80000991} - http://www.ugege.com/ File not found
O9 - Extra 'Tools' menuitem : 小游戏 - {998A88A0-A355-809B-831C-B83A80000991} - http://www.ugege.com/ File not found
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{05C5E550-361D-4C02-BCBD-D75EEFA63FB0}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{848BEF6C-D4B0-44C6-B38C-911E57507566}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012-02-18 18:53:07 | 004,729,344 | —- | C] (AVAST Software) – C:\Users\Pappa\Desktop\aswMBR.exe
[2012-02-18 18:53:04 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\Pappa\Desktop\OTL.exe
[2012-02-17 22:50:17 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Roaming\Baidu
[2012-02-17 21:42:16 | 000,000,000 | —D | C] – C:\ProgramData\Baidu
[2012-02-17 21:22:33 | 000,000,000 | —D | C] – C:\Windows\temp
[2012-02-17 21:19:31 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012-02-17 21:13:39 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012-02-17 21:13:39 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012-02-17 21:13:39 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012-02-17 21:13:36 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2012-02-17 21:13:34 | 000,000,000 | —D | C] – C:\Qoobox
[2012-02-17 15:44:18 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{FE11B924-1E4A-4DA4-AD1D-2C719B04DF25}
[2012-02-17 15:44:06 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{3C1E465B-A7AF-4DA7-95FA-40B2441972F5}
[2012-02-16 14:57:53 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{84FB9C9F-B478-4847-99A4-ABBDB9D135EF}
[2012-02-16 14:57:40 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{3163D581-DF5B-4054-BD35-3FCA0F3F90CD}
[2012-02-15 15:20:13 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{AE40E37F-87F3-4709-BFE2-94575B016E9E}
[2012-02-15 15:19:57 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{F3633E5E-3D73-40A8-8DDB-A0141C1C292F}
[2012-02-14 14:56:51 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{7E5929E6-3F17-4C77-83B8-DDECBF9BA39C}
[2012-02-14 14:56:37 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{F57E6715-EBFF-4F8C-8597-5BCA7EBF9845}
[2012-02-13 23:37:16 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{C3DF87FD-4860-41FB-B2F0-B542940898E1}
[2012-02-13 23:37:03 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{9435BB16-982C-4190-9173-36EEF5CFDE57}
[2012-02-12 22:34:11 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{630FC4AB-6D4E-4EEA-8142-F4F1B118772A}
[2012-02-12 22:33:57 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{F684C54A-FF66-4649-AE8A-A552A2ED50C0}
[2012-02-11 23:05:27 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{AAF2B698-F476-460C-AE5D-30615C16AFEB}
[2012-02-11 23:05:14 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{8F0DED42-67BE-4C42-92DD-6AF9940F0B28}
[2012-02-10 15:18:56 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{39EBAD5A-2C49-4B45-9D44-259FB34C1A49}
[2012-02-10 15:18:40 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{FD614828-47BE-4B30-A9FB-0B6438B2E348}
[2012-02-09 15:23:01 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{0701841A-BB0E-4D5F-A104-58C1A3E9D73D}
[2012-02-09 15:22:45 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{55C1606A-CDC3-40B0-B0EB-1111B39C9D26}
[2012-02-08 15:15:28 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{D5EE07BE-42E6-4909-A412-9A59B5FC9F34}
[2012-02-08 15:15:12 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{B5F50A79-4A3C-4F81-AC60-90380E4721A4}
[2012-02-07 15:30:20 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{AB77D752-5559-464D-A7AC-1B50CDA0CFC8}
[2012-02-07 15:30:06 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{F2E15229-F8ED-41F0-A005-3DE7192C2C58}
[2012-02-06 13:33:32 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{553798DA-9EC6-45F8-97DF-72E8CADA6576}
[2012-02-06 13:33:20 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{25D8C61E-D939-4293-A156-26674CBE0C9E}
[2012-02-05 22:16:35 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{152AD721-66A6-412C-A722-753E81075426}
[2012-02-05 22:16:20 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{F8C10A31-FE76-458F-9734-F737AEEDD685}
[2012-02-04 22:20:10 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{836850C0-F7AD-49FD-90D4-22745D192D0B}
[2012-02-04 22:19:55 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{73627C39-909C-432B-936B-4CAC7789B912}
[2012-02-03 15:13:26 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{AE81AB42-E2DD-4799-B18C-F70C2B7BBD37}
[2012-02-03 15:13:11 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{093D2195-056F-4ACF-9D67-21A9C5B8D64F}
[2012-02-02 15:27:10 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{DF9959CC-FB39-44EA-BB2E-96C2B34B22C9}
[2012-02-02 15:26:57 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{44E9BE5F-246C-42A5-843B-EE18AC965554}
[2012-02-01 16:09:41 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{E7D5F6E8-42CD-44F4-B42C-C9C41A6787EA}
[2012-02-01 16:09:26 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{E247D724-5762-4E1F-86F0-2F950616FD94}
[2012-01-31 15:10:43 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{08F42313-898E-4EE5-A728-1B4B2DC2FA9B}
[2012-01-31 15:10:29 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{86248B80-48EB-4360-9818-3F488FEA59C4}
[2012-01-30 13:43:43 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{CF077561-CC80-4B4B-AD60-6D6364EDE0C5}
[2012-01-30 13:43:29 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{93A6CD1E-D549-4FCD-A3E8-693686F2F45B}
[2012-01-29 22:21:54 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{C627ACAC-2382-4C73-9874-844AA966F9A8}
[2012-01-29 22:21:38 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{EEE9C91B-B948-4E02-8677-6938C3CEF108}
[2012-01-28 22:56:11 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{6D3A16A2-2FD0-419B-BEE0-A1FCD45A5F9C}
[2012-01-28 22:55:57 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{FC3DC148-8358-4EED-8E1A-E54744E68470}
[2012-01-27 23:33:31 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{D07E9E53-A1F2-4F11-8359-802557352030}
[2012-01-27 23:33:14 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{9651BC9D-62F6-4B18-8007-73EABBEE2999}
[2012-01-26 22:33:40 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{486546E3-1F31-49E9-A7D1-9EC2328A7A60}
[2012-01-26 22:33:27 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{BD1FC657-2938-4983-8FA2-C3AF9D7DF868}
[2012-01-25 22:29:01 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{E79DE498-35CD-4F7D-9A66-274E33CDCCC1}
[2012-01-25 22:28:46 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{109287D3-0D0A-4EA1-9E98-B95508B0D722}
[2012-01-24 14:55:48 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{5343C601-E4AF-46E5-BCD0-10EDE8FBF077}
[2012-01-24 14:55:36 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{B29373F4-4DEF-4183-8DA8-066F6D7ED0F3}
[2012-01-23 23:49:05 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{B2A5D989-0DD5-4DAF-8378-B3B4964C41C8}
[2012-01-23 23:48:54 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{017F6FE8-9FAB-481C-BD2D-251502E0DEBB}
[2012-01-23 11:48:25 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{D57DBDDD-FE34-42B5-9CDD-7475618F1AF1}
[2012-01-23 11:48:09 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{1FACE632-1FBB-40D2-9E0B-19F0B40F850E}
[2012-01-22 22:33:43 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{BF3B0F0D-1357-46F1-A25A-FE83C16C8D1E}
[2012-01-22 22:33:28 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{033AC495-8A20-4B20-AF9A-E3A1500CD6B3}
[2012-01-21 22:36:07 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{C25D8386-7CC3-40B3-88AB-74B949E183B9}
[2012-01-21 22:35:50 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{7F39917D-ED73-4CDE-AFDC-6B79CD80C8A9}
[2012-01-21 02:53:15 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{6C177480-4C6C-42D0-A6DD-C6051C5CC258}
[2012-01-21 02:53:03 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{0CD3131D-C131-4992-96F8-C753E4F80025}
[2012-01-20 14:52:31 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{07CBE7B9-29E3-40D0-9587-276F1E5E37C4}
[2012-01-20 14:52:15 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{6DE0EC3C-E7F1-40C3-9ADE-FFC7244CF686}
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012-02-18 18:53:43 | 004,729,344 | —- | M] (AVAST Software) – C:\Users\Pappa\Desktop\aswMBR.exe
[2012-02-18 18:52:54 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Pappa\Desktop\OTL.exe
[2012-02-18 18:51:44 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012-02-18 18:51:40 | 3018,461,184 | -HS- | M] () – C:\hiberfil.sys
[2012-02-18 00:42:00 | 000,001,004 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2084622461-223115633-1812412026-1000UA.job
[2012-02-17 21:42:00 | 000,000,952 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2084622461-223115633-1812412026-1000Core.job
[2012-02-17 21:32:13 | 000,023,392 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012-02-17 21:32:13 | 000,023,392 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012-02-17 21:19:25 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2012-02-17 21:17:56 | 000,004,004 | —- | M] () – C:\Users\Pappa\Documents\Document.rtf
[2012-02-17 17:21:54 | 000,001,109 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012-02-17 16:55:20 | 000,735,438 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012-02-17 16:55:20 | 000,618,132 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012-02-17 16:55:20 | 000,107,412 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012-02-16 22:42:51 | 000,002,359 | —- | M] () – C:\Users\Pappa\Desktop\Google Chrome.lnk
[2012-02-15 15:18:43 | 000,266,592 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012-02-02 23:15:14 | 000,002,044 | —- | M] () – C:\Users\Pappa\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012-02-17 21:17:56 | 000,004,004 | —- | C] () – C:\Users\Pappa\Documents\Document.rtf
[2012-02-17 21:13:39 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012-02-17 21:13:39 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012-02-17 21:13:39 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012-02-17 21:13:39 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012-02-17 21:13:39 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012-02-17 17:21:54 | 000,001,109 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2011-11-21 14:52:48 | 000,000,891 | —- | C] () – C:\Windows\SysWow64\bdsecushr.dat
[2010-12-23 16:47:41 | 000,734,810 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2010-08-19 23:52:43 | 000,007,605 | —- | C] () – C:\Users\Pappa\AppData\Local\Resmon.ResmonCfg
[2010-08-19 22:11:09 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2010-08-19 21:57:03 | 000,024,576 | R— | C] () – C:\Windows\SysWow64\AsIO.dll
[2010-08-19 21:57:03 | 000,013,440 | R— | C] () – C:\Windows\SysWow64\drivers\AsIO.sys
[2010-08-19 21:57:01 | 000,011,832 | —- | C] () – C:\Windows\SysWow64\drivers\AsInsHelp64.sys
[2010-08-19 21:57:01 | 000,010,216 | —- | C] () – C:\Windows\SysWow64\drivers\AsInsHelp32.sys
[2010-08-19 21:54:11 | 000,047,013 | —- | C] () – C:\Windows\Ascd_log.ini
[2010-08-19 21:53:49 | 000,001,769 | —- | C] () – C:\Windows\Language_trs.ini
[2010-08-19 21:53:46 | 000,036,551 | —- | C] () – C:\Windows\Ascd_tmp.ini
[2009-07-14 06:38:36 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009-07-14 03:35:51 | 000,000,741 | —- | C] () – C:\Windows\SysWow64\NOISE.DAT
[2009-07-14 03:34:42 | 000,215,943 | —- | C] () – C:\Windows\SysWow64\dssec.dat
[2009-07-14 01:10:29 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009-07-14 00:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009-07-13 22:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009-06-10 22:26:10 | 000,673,088 | —- | C] () – C:\Windows\SysWow64\mlang.dat
[2009-04-02 13:30:14 | 000,010,296 | —- | C] () – C:\Windows\SysWow64\drivers\ASUSHWIO.SYS
[2009-02-21 12:35:10 | 000,049,152 | R— | C] () – C:\Windows\DAOD.exe
[2006-09-13 12:06:10 | 000,045,056 | —- | C] () – C:\Windows\SysWow64\gtapi.dll

========== LOP Check ==========

[2012-02-17 22:50:17 | 000,000,000 | —D | M] – C:\Users\Pappa\AppData\Roaming\Baidu
[2010-08-22 17:25:45 | 000,000,000 | —D | M] – C:\Users\Pappa\AppData\Roaming\Tibia
[2011-12-16 23:15:23 | 000,032,638 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: EXPLORER.EXE >
[2011-02-26 07:23:14 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011-02-26 06:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009-07-14 02:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011-02-26 06:51:13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009-10-31 06:45:39 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011-02-26 06:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011-02-25 07:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\ERDNT\cache86\explorer.exe
[2011-02-25 07:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2011-02-25 07:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011-02-26 07:14:34 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010-11-20 13:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009-08-03 07:19:07 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011-02-25 06:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2011-02-25 06:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009-10-31 07:34:59 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009-08-03 06:49:47 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010-11-20 14:24:45 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009-10-31 07:38:38 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009-08-03 06:35:50 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009-07-14 02:39:10 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009-10-31 07:00:51 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011-02-26 07:26:45 | 002,870,784 | —- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009-08-03 07:17:37 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe

< MD5 for: SVCHOST.EXE >
[2009-07-14 02:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\ERDNT\cache86\svchost.exe
[2009-07-14 02:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\SysWOW64\svchost.exe
[2009-07-14 02:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2012-01-13 14:53:20 | 000,182,856 | —- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2009-07-14 02:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\ERDNT\cache64\svchost.exe
[2009-07-14 02:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\SysNative\svchost.exe
[2009-07-14 02:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: USERINIT.EXE >
[2010-11-20 13:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\ERDNT\cache86\userinit.exe
[2010-11-20 13:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\SysWOW64\userinit.exe
[2010-11-20 13:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009-07-14 02:14:43 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009-07-14 02:39:48 | 000,030,208 | —- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010-11-20 14:25:24 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\ERDNT\cache64\userinit.exe
[2010-11-20 14:25:24 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\SysNative\userinit.exe
[2010-11-20 14:25:24 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010-11-20 14:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\ERDNT\cache64\winlogon.exe
[2010-11-20 14:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\SysNative\winlogon.exe
[2010-11-20 14:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009-07-14 02:39:52 | 000,389,120 | —- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012-01-13 14:53:20 | 000,182,856 | —- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009-10-28 08:01:57 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009-10-28 07:24:40 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

< %systemroot%\*. /rp /s >

========== Files - Unicode (All) ==========
[2011-11-21 14:44:41 | 000,001,296 | —- | M] ()(C:\Users\Public\Desktop\????.lnk) – C:\Users\Public\Desktop\百度影音.lnk
[2011-11-21 14:44:41 | 000,001,296 | —- | C] ()(C:\Users\Public\Desktop\????.lnk) – C:\Users\Public\Desktop\百度影音.lnk
[2010-08-20 15:41:43 | 000,001,919 | —- | M] ()(C:\Users\Public\Desktop\UUSee ????.lnk) – C:\Users\Public\Desktop\UUSee 网络电视.lnk
[2010-08-20 15:41:43 | 000,001,919 | —- | C] ()(C:\Users\Public\Desktop\UUSee ????.lnk) – C:\Users\Public\Desktop\UUSee 网络电视.lnk
[2010-08-20 15:41:43 | 000,001,051 | —- | M] ()(C:\Users\Pappa\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee ????.lnk) – C:\Users\Pappa\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee 网络电视.lnk
[2010-08-20 15:41:43 | 000,001,051 | —- | C] ()(C:\Users\Pappa\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee ????.lnk) – C:\Users\Pappa\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee 网络电视.lnk
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UUSee ????) – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UUSee 网络电视
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\????) – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\百度影音

< End of report >



OTL Extras logfile created on: 2012-02-18 18:55:14 - Run 1
OTL by OldTimer - Version 3.2.32.0 Folder = C:\Users\Pappa\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 0000041D | Country: Sweden | Language: SVE | Date Format: yyyy-MM-dd

3,75 Gb Total Physical Memory | 2,32 Gb Available Physical Memory | 61,87% Memory free
7,49 Gb Paging File | 5,95 Gb Available in Paging File | 79,36% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 319,50 Gb Free Space | 68,61% Space Free | Partition Type: NTFS

Computer Name: PAPPA-PC | User Name: Pappa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-2084622461-223115633-1812412026-1000\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\uusee\UUSeePlayer.exe" = C:\Program Files (x86)\uusee\UUSeePlayer.exe:*:Enabled:UUPlayer – ()
"C:\Program Files (x86)\uusee\UUSeePlayer.exe" = C:\Program Files (x86)\uusee\UUSeePlayer.exe:*:Enabled:UUPlayer – ()


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{23170F69-40C1-2702-0919-000001000000}" = 7-Zip 9.19 (x64 edition)
"{2A3636F8-1207-DFA3-E4E2-A78CCD798795}" = ATI Catalyst Install Manager
"{42738DB0-FC3E-4672-A99B-9372F5696E30}" = Microsoft Security Client
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FDB89E21-0C9C-743A-15B3-A4E5C3144E4A}" = ccc-utility64
"CCleaner" = CCleaner
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.55
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02DE1B7C-0CDB-7E4B-8201-092EEA910DA3}" = CCC Help Italian
"{03E22EBD-9729-2734-94CF-4372394E5DBD}" = CCC Help Dutch
"{06986B82-43FC-CB3C-BD29-ABD9A3EB2AF1}" = Catalyst Control Center InstallProxy
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{2201A1DA-6755-ACE4-37A6-D35816CCB9F1}" = CCC Help Polish
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{310AFA06-1206-7D46-8AE6-370D47836130}" = CCC Help Finnish
"{34D1ACDA-B4ED-9628-98F3-22E04EF0374B}" = Catalyst Control Center Graphics Previews Vista
"{425B1239-C81A-8CE1-3037-36FC046205DD}" = CCC Help Korean
"{454B00AA-EC7D-363E-B2CA-78F21D65E168}" = CCC Help Chinese Traditional
"{4C9FFDD0-B533-4726-42A8-EEEF0D4F61C2}" = Catalyst Control Center Localization All
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5B16C262-B90C-D241-8FC3-0C638253868E}" = CCC Help Thai
"{5E76C154-1205-B588-D419-8C1FF51231AA}" = CCC Help Greek
"{66BE0C97-071E-7EFB-93ED-BE8999B8F88E}" = Catalyst Control Center Graphics Full New
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{7B7C90A2-F3F3-CAF6-ED3C-F5A67207EEA2}" = CCC Help French
"{7E85D37B-3981-8986-C806-E806A9EF80BB}" = CCC Help Turkish
"{7EA28DC8-133A-9B3C-915D-DCD626E27E82}" = CCC Help German
"{81E1D495-835E-6BAE-1DDD-2EEEB2C208ED}" = CCC Help Swedish
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8136 8168 8169 Ethernet Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E8728CB-E879-FAD7-EA0B-D5CA63E33DB5}" = CCC Help Russian
"{8F66047B-1AF3-40D9-80D7-106E2EDC2C2A}" = EPU-4 Engine
"{9260CA0A-FB90-D727-B063-1E96C91F471F}" = Catalyst Control Center Graphics Light
"{93372FC7-4F1E-0C8D-D648-CEE90629C5D3}" = CCC Help Norwegian
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AB67580-257C-45FF-B8F4-C8C30682091A}_is1" = SIW version 2010.07.14
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.2)
"{BDA77C36-E477-BF77-9F77-29B1BE4103F4}" = CCC Help Japanese
"{BE001325-AE69-AB6B-E0ED-87A9DB012F99}" = ccc-core-static
"{C8B867BE-5851-E0AF-96EB-9A0EA034F36E}" = Catalyst Control Center Core Implementation
"{CC801442-57CF-B2A8-4F5A-B4DF882B5B64}" = CCC Help Czech
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D1B34C45-531E-E8A3-B30E-BE5AFC33BAE5}" = CCC Help Portuguese
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D64EEC36-DA76-B5D6-42C5-AA3AB18461D6}" = CCC Help Hungarian
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E217EF6A-A283-C6EA-C602-83D4934D61CE}" = CCC Help Danish
"{E2AA7922-8EC9-8F2A-1475-6263F0B0975D}" = CCC Help English
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EA2A7A51-5FB8-28AE-1FF3-82699DEDE407}" = Catalyst Control Center Graphics Full Existing
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F335D312-365F-3BED-0B22-A0C7AA9B4421}" = CCC Help Spanish
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FFF117E6-6F27-0AB6-C862-BB3A76C43BFD}" = CCC Help Chinese Standard
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"BaiduPlayer" = BaiduPlayer1.0.23.108
"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2011-11-11
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.60.1.1000
"Mozilla Firefox 10.0.2 (x86 en-US)" = Mozilla Firefox 10.0.2 (x86 en-US)
"OCCT_is1" = OCCT Perestroika 3.1.0
"SpeedFan" = SpeedFan (remove only)
"Tibia_is1" = Tibia
"WinLiveSuite" = Windows Live Essentials

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2084622461-223115633-1812412026-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2012-02-07 20:51:32 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-08 19:30:11 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-09 19:30:12 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-10 20:24:15 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-11 19:30:11 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-13 19:30:12 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-14 19:30:11 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-16 18:00:08 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-17 12:52:10 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-17 20:01:48 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

[ System Events ]
Error - 2012-02-17 13:42:25 | Computer Name = Pappa-PC | Source = Microsoft Antimalware | ID = 3002
Description = %%860 Real-Time Protection feature has encountered an error and failed.

Feature:
%%835 Error Code: 0x80004005 Error description: Unspecified error Reason: %%842

Error - 2012-02-17 13:43:04 | Computer Name = Pappa-PC | Source = DCOM | ID = 10016
Description =

Error - 2012-02-17 15:19:40 | Computer Name = Pappa-PC | Source = DCOM | ID = 10016
Description =

Error - 2012-02-17 16:15:36 | Computer Name = Pappa-PC | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 2012-02-17 16:16:43 | Computer Name = Pappa-PC | Source = Application Popup | ID = 1060
Description = \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility
with this system. Please contact your software vendor for a compatible version
of the driver.

Error - 2012-02-17 16:17:06 | Computer Name = Pappa-PC | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 2012-02-17 16:19:17 | Computer Name = Pappa-PC | Source = Service Control Manager | ID = 7023
Description = The Windows Defender service terminated with the following error:
%%126

Error - 2012-02-17 16:20:20 | Computer Name = Pappa-PC | Source = DCOM | ID = 10016
Description =

Error - 2012-02-17 16:26:08 | Computer Name = Pappa-PC | Source = DCOM | ID = 10016
Description =

Error - 2012-02-18 13:52:54 | Computer Name = Pappa-PC | Source = DCOM | ID = 10016
Description =


< End of report >


2. aswMBR logs


aswMBR version 0.9.9.1618 Copyright© 2011 AVAST Software
Run date: 2012-02-18 19:02:11
—————————–
19:02:11.398 OS Version: Windows x64 6.1.7601 Service Pack 1
19:02:11.398 Number of processors: 2 586 0x403
19:02:11.399 ComputerName: PAPPA-PC UserName: Pappa
19:02:12.360 Initialize success
19:02:55.040 AVAST engine defs: 12021800
19:03:09.527 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-4
19:03:09.528 Disk 0 Vendor: WDC_WD5000AAKS-60Z1A0 06.01D06 Size: 476940MB BusType: 3
19:03:09.538 Disk 0 MBR read successfully
19:03:09.540 Disk 0 MBR scan
19:03:09.543 Disk 0 Windows 7 default MBR code
19:03:09.545 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
19:03:09.572 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 476838 MB offset 206848
19:03:09.592 Service scanning
19:03:27.081 Modules scanning
19:03:27.085 Disk 0 trace - called modules:
19:03:27.096 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
19:03:27.098 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800460b060]
19:03:27.100 3 CLASSPNP.SYS[fffff8800165143f] -> nt!IofCallDriver -> [0xfffffa80037a2e40]
19:03:27.104 5 ACPI.sys[fffff88000f907a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T1L0-4[0xfffffa8004594060]
19:03:28.394 AVAST engine scan C:\Windows
19:03:30.864 AVAST engine scan C:\Windows\system32
19:06:24.256 AVAST engine scan C:\Windows\system32\drivers
19:06:34.189 AVAST engine scan C:\Users\Pappa
19:07:54.970 AVAST engine scan C:\ProgramData
19:08:38.914 Scan finished successfully
19:08:48.941 Disk 0 MBR has been saved successfully to "C:\Users\Pappa\Desktop\MBR.dat"
19:08:48.944 The log file has been saved successfully to "C:\Users\Pappa\Desktop\aswMBR.txt"

Attachments:

Post #5
Hi nocluechrist,

From my understanding you have already run ComboFix. Its log should be located at C:\ComboFix.txt. Please post that log in your next reply.

  • P2P

    You have P2P/file sharing programs installed on your computer. P2P applications are the largest source of malware we see.

    A reference for the risk of these programs can be found here: http://www.internetworldstats.com/articles/art053.htm

    Please do not use them until your computer is cleaned.

  • OTL

    Run OTL.exe.

    • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.

      :OTL
[2012-02-17 15:44:18 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{FE11B924-1E4A-4DA4-AD1D-2C719B04DF25}
[2012-02-17 15:44:06 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{3C1E465B-A7AF-4DA7-95FA-40B2441972F5}
[2012-02-16 14:57:53 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{84FB9C9F-B478-4847-99A4-ABBDB9D135EF}
[2012-02-16 14:57:40 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{3163D581-DF5B-4054-BD35-3FCA0F3F90CD}
[2012-02-15 15:20:13 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{AE40E37F-87F3-4709-BFE2-94575B016E9E}
[2012-02-15 15:19:57 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{F3633E5E-3D73-40A8-8DDB-A0141C1C292F}
[2012-02-14 14:56:51 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{7E5929E6-3F17-4C77-83B8-DDECBF9BA39C}
[2012-02-14 14:56:37 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{F57E6715-EBFF-4F8C-8597-5BCA7EBF9845}
[2012-02-13 23:37:16 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{C3DF87FD-4860-41FB-B2F0-B542940898E1}
[2012-02-13 23:37:03 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{9435BB16-982C-4190-9173-36EEF5CFDE57}
[2012-02-12 22:34:11 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{630FC4AB-6D4E-4EEA-8142-F4F1B118772A}
[2012-02-12 22:33:57 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{F684C54A-FF66-4649-AE8A-A552A2ED50C0}
[2012-02-11 23:05:27 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{AAF2B698-F476-460C-AE5D-30615C16AFEB}
[2012-02-11 23:05:14 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{8F0DED42-67BE-4C42-92DD-6AF9940F0B28}
[2012-02-10 15:18:56 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{39EBAD5A-2C49-4B45-9D44-259FB34C1A49}
[2012-02-10 15:18:40 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{FD614828-47BE-4B30-A9FB-0B6438B2E348}
[2012-02-09 15:23:01 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{0701841A-BB0E-4D5F-A104-58C1A3E9D73D}
[2012-02-09 15:22:45 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{55C1606A-CDC3-40B0-B0EB-1111B39C9D26}
[2012-02-08 15:15:28 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{D5EE07BE-42E6-4909-A412-9A59B5FC9F34}
[2012-02-08 15:15:12 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{B5F50A79-4A3C-4F81-AC60-90380E4721A4}
[2012-02-07 15:30:20 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{AB77D752-5559-464D-A7AC-1B50CDA0CFC8}
[2012-02-07 15:30:06 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{F2E15229-F8ED-41F0-A005-3DE7192C2C58}
[2012-02-06 13:33:32 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{553798DA-9EC6-45F8-97DF-72E8CADA6576}
[2012-02-06 13:33:20 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{25D8C61E-D939-4293-A156-26674CBE0C9E}
[2012-02-05 22:16:35 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{152AD721-66A6-412C-A722-753E81075426}
[2012-02-05 22:16:20 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{F8C10A31-FE76-458F-9734-F737AEEDD685}
[2012-02-04 22:20:10 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{836850C0-F7AD-49FD-90D4-22745D192D0B}
[2012-02-04 22:19:55 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{73627C39-909C-432B-936B-4CAC7789B912}
[2012-02-03 15:13:26 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{AE81AB42-E2DD-4799-B18C-F70C2B7BBD37}
[2012-02-03 15:13:11 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{093D2195-056F-4ACF-9D67-21A9C5B8D64F}
[2012-02-02 15:27:10 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{DF9959CC-FB39-44EA-BB2E-96C2B34B22C9}
[2012-02-02 15:26:57 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{44E9BE5F-246C-42A5-843B-EE18AC965554}
[2012-02-01 16:09:41 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{E7D5F6E8-42CD-44F4-B42C-C9C41A6787EA}
[2012-02-01 16:09:26 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{E247D724-5762-4E1F-86F0-2F950616FD94}
[2012-01-31 15:10:43 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{08F42313-898E-4EE5-A728-1B4B2DC2FA9B}
[2012-01-31 15:10:29 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{86248B80-48EB-4360-9818-3F488FEA59C4}
[2012-01-30 13:43:43 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{CF077561-CC80-4B4B-AD60-6D6364EDE0C5}
[2012-01-30 13:43:29 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{93A6CD1E-D549-4FCD-A3E8-693686F2F45B}
[2012-01-29 22:21:54 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{C627ACAC-2382-4C73-9874-844AA966F9A8}
[2012-01-29 22:21:38 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{EEE9C91B-B948-4E02-8677-6938C3CEF108}
[2012-01-28 22:56:11 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{6D3A16A2-2FD0-419B-BEE0-A1FCD45A5F9C}
[2012-01-28 22:55:57 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{FC3DC148-8358-4EED-8E1A-E54744E68470}
[2012-01-27 23:33:31 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{D07E9E53-A1F2-4F11-8359-802557352030}
[2012-01-27 23:33:14 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{9651BC9D-62F6-4B18-8007-73EABBEE2999}
[2012-01-26 22:33:40 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{486546E3-1F31-49E9-A7D1-9EC2328A7A60}
[2012-01-26 22:33:27 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{BD1FC657-2938-4983-8FA2-C3AF9D7DF868}
[2012-01-25 22:29:01 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{E79DE498-35CD-4F7D-9A66-274E33CDCCC1}
[2012-01-25 22:28:46 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{109287D3-0D0A-4EA1-9E98-B95508B0D722}
[2012-01-24 14:55:48 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{5343C601-E4AF-46E5-BCD0-10EDE8FBF077}
[2012-01-24 14:55:36 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{B29373F4-4DEF-4183-8DA8-066F6D7ED0F3}
[2012-01-23 23:49:05 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{B2A5D989-0DD5-4DAF-8378-B3B4964C41C8}
[2012-01-23 23:48:54 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{017F6FE8-9FAB-481C-BD2D-251502E0DEBB}
[2012-01-23 11:48:25 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{D57DBDDD-FE34-42B5-9CDD-7475618F1AF1}
[2012-01-23 11:48:09 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{1FACE632-1FBB-40D2-9E0B-19F0B40F850E}
[2012-01-22 22:33:43 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{BF3B0F0D-1357-46F1-A25A-FE83C16C8D1E}
[2012-01-22 22:33:28 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{033AC495-8A20-4B20-AF9A-E3A1500CD6B3}
[2012-01-21 22:36:07 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{C25D8386-7CC3-40B3-88AB-74B949E183B9}
[2012-01-21 22:35:50 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{7F39917D-ED73-4CDE-AFDC-6B79CD80C8A9}
[2012-01-21 02:53:15 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{6C177480-4C6C-42D0-A6DD-C6051C5CC258}
[2012-01-21 02:53:03 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{0CD3131D-C131-4992-96F8-C753E4F80025}
[2012-01-20 14:52:31 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{07CBE7B9-29E3-40D0-9587-276F1E5E37C4}
[2012-01-20 14:52:15 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Local\{6DE0EC3C-E7F1-40C3-9ADE-FFC7244CF686}

:Commands
[createrestorepoint]
[purity]
[resethosts]
[emptytemp]
    • Click the Run Fix button.
    • OTL will now process the instructions.
    • When finished a box will open asking you to open the fix log, click OK.
    • The fix log will open.
    • Copy/Paste the log in your next reply please.

    Note: If necessary, OTL may reboot your computer, or request that you do so. If it does, please go ahead and reboot your machine. After rebooting, open up Windows Explorer (Windows Key +E) and navigate to C:\_OTL\MovedFiles. Within, you should find a .log file with the format mmddyyyy_hhmmss, which represents the date and time the fix was run. Please copy and paste the contents of that file, making sure Word Wrap is off beforehand, if necessary.

  • GMER

    [external image: Posted Image]
    Download GMER Rootkit Scanner from here or here.
    • Extract the contents of the zipped file to desktop.
    • Launch GMER.exe. If asked to allow gmer.sys driver to load, please consent.
    • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

      [external image: Posted Image]
      Click the image to enlarge it
    • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • All drives/partitions except C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #6
It's my parents computer so I'm not familiar with all the software in it. I've asked and they say they have never downloaded any files however they do use some video streaming software that shows asian/chinese content. I'm not familiar with this at all but are they a possible source of malware? Could you specify what software was deemed risky? They primarily use the computer for this so I hope at least one of the streaming software are okay too use.

Combofix log somehow used the native language in it. Hope it's still useable?


ComboFix 12-02-17.02 - Pappa 2012-02-17 21:14:16.1.2 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.46.1033.18.3838.2145 [GMT 1:00]
Körs från: c:\users\Pappa\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Andra raderingar ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Mozilla Firefox\plugins\npuuseep.dll
c:\windows\struct~.ini
c:\windows\SysWow64\nsis_loader.dll
.
.
(((((((((((((((((((((((( Filer skapade från 2012-01-17 till 2012-02-17 ))))))))))))))))))))))))))))))
.
.
2012-02-17 20:16 . 2012-02-17 20:16 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-02-17 18:48 . 2012-01-06 05:15 8602168 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7D63297B-40C1-48E1-9CB7-D98A3DDCC32C}\mpengine.dll
2012-02-14 22:03 . 2012-01-04 10:44 509952 —-a-w- c:\windows\system32\ntshrui.dll
2012-02-14 22:03 . 2012-01-04 08:58 442880 —-a-w- c:\windows\SysWow64\ntshrui.dll
2012-02-14 22:03 . 2011-12-30 06:26 515584 —-a-w- c:\windows\system32\timedate.cpl
2012-02-14 22:03 . 2011-12-30 05:27 478720 —-a-w- c:\windows\SysWow64\timedate.cpl
2012-02-14 22:03 . 2012-01-14 04:06 3145728 —-a-w- c:\windows\system32\win32k.sys
2012-02-14 22:03 . 2011-12-28 03:59 498688 —-a-w- c:\windows\system32\drivers\afd.sys
2012-02-14 22:03 . 2011-12-16 08:46 634880 —-a-w- c:\windows\system32\msvcrt.dll
2012-02-14 22:03 . 2011-12-16 07:52 690688 —-a-w- c:\windows\SysWow64\msvcrt.dll
2012-02-10 21:43 . 2012-02-10 21:43 927800 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{64280117-3611-412A-8A39-6D723FA9AE26}\gapaengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-31 12:44 . 2010-08-19 22:08 279656 ——w- c:\windows\system32\MpSigStub.exe
2012-01-06 05:15 . 2010-08-21 22:16 8602168 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-12-20 13:55 . 2011-07-05 16:51 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-12-10 14:24 . 2010-08-19 22:54 23152 —-a-w- c:\windows\system32\drivers\mbam.sys
.
.
(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Not* tomma poster & legitima standardposter visas inte.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BAIDUMEDIA"="c:\program files (x86)\Baidu\BaiduPlayer\1.0.23.108\BaiduPlayer.exe" [2011-11-16 2057160]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2009-08-28 2252800]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-18 98304]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"UUSeeMediaCenter"="c:\progra~2\COMMON~1\uusee\UUSeeMediaCenter.exe" [2011-11-03 521592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
R3 netr28ux;D-Link dnetr28u USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\Dnetr28ux.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [x]
.
.
— Övriga tjänster/drivrutiner i minnet —
.
*NewlyCreated* - WS2IFSL
.
Innehåll i mappen 'Schemalagda aktiviteter':
.
2012-02-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2084622461-223115633-1812412026-1000Core.job
- c:\users\Pappa\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-19 22:59]
.
2012-02-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2084622461-223115633-1812412026-1000UA.job
- c:\users\Pappa\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-19 22:59]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
——- Extra genomsökning ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.se/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: ??UUSee?? - c:\program files (x86)\uusee\geturltodown.htm
IE: ??UUSee???? - c:\program files (x86)\uusee\geturltoplay.htm
IE: {{998A88A0-A355-809B-831C-B83A80000991} - http://www.ugege.com/
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Pappa\AppData\Roaming\Mozilla\Firefox\Profiles\vayipwjv.default\
.
.
——————— LÅSTA REGISTERNYCKLAR ———————
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
———————— Andra processer som körs ————————
.
c:\program files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
.
**************************************************************************
.
Sluttid: 2012-02-17 21:22:31 - datorn startades om.
ComboFix-quarantined-files.txt 2012-02-17 20:22
.
Före genomsökningen: 344 099 561 472 bytes free
Efter genomsökningen: 343 709 163 520 bytes free
.
- - End Of File - - 184459ECDCCCE1D850F2B7B52E672BF7


OTL log:


All processes killed
========== OTL ==========
C:\Users\Pappa\AppData\Local\{FE11B924-1E4A-4DA4-AD1D-2C719B04DF25} folder moved successfully.
C:\Users\Pappa\AppData\Local\{3C1E465B-A7AF-4DA7-95FA-40B2441972F5} folder moved successfully.
C:\Users\Pappa\AppData\Local\{84FB9C9F-B478-4847-99A4-ABBDB9D135EF} folder moved successfully.
C:\Users\Pappa\AppData\Local\{3163D581-DF5B-4054-BD35-3FCA0F3F90CD} folder moved successfully.
C:\Users\Pappa\AppData\Local\{AE40E37F-87F3-4709-BFE2-94575B016E9E} folder moved successfully.
C:\Users\Pappa\AppData\Local\{F3633E5E-3D73-40A8-8DDB-A0141C1C292F} folder moved successfully.
C:\Users\Pappa\AppData\Local\{7E5929E6-3F17-4C77-83B8-DDECBF9BA39C} folder moved successfully.
C:\Users\Pappa\AppData\Local\{F57E6715-EBFF-4F8C-8597-5BCA7EBF9845} folder moved successfully.
C:\Users\Pappa\AppData\Local\{C3DF87FD-4860-41FB-B2F0-B542940898E1} folder moved successfully.
C:\Users\Pappa\AppData\Local\{9435BB16-982C-4190-9173-36EEF5CFDE57} folder moved successfully.
C:\Users\Pappa\AppData\Local\{630FC4AB-6D4E-4EEA-8142-F4F1B118772A} folder moved successfully.
C:\Users\Pappa\AppData\Local\{F684C54A-FF66-4649-AE8A-A552A2ED50C0} folder moved successfully.
C:\Users\Pappa\AppData\Local\{AAF2B698-F476-460C-AE5D-30615C16AFEB} folder moved successfully.
C:\Users\Pappa\AppData\Local\{8F0DED42-67BE-4C42-92DD-6AF9940F0B28} folder moved successfully.
C:\Users\Pappa\AppData\Local\{39EBAD5A-2C49-4B45-9D44-259FB34C1A49} folder moved successfully.
C:\Users\Pappa\AppData\Local\{FD614828-47BE-4B30-A9FB-0B6438B2E348} folder moved successfully.
C:\Users\Pappa\AppData\Local\{0701841A-BB0E-4D5F-A104-58C1A3E9D73D} folder moved successfully.
C:\Users\Pappa\AppData\Local\{55C1606A-CDC3-40B0-B0EB-1111B39C9D26} folder moved successfully.
C:\Users\Pappa\AppData\Local\{D5EE07BE-42E6-4909-A412-9A59B5FC9F34} folder moved successfully.
C:\Users\Pappa\AppData\Local\{B5F50A79-4A3C-4F81-AC60-90380E4721A4} folder moved successfully.
C:\Users\Pappa\AppData\Local\{AB77D752-5559-464D-A7AC-1B50CDA0CFC8} folder moved successfully.
C:\Users\Pappa\AppData\Local\{F2E15229-F8ED-41F0-A005-3DE7192C2C58} folder moved successfully.
C:\Users\Pappa\AppData\Local\{553798DA-9EC6-45F8-97DF-72E8CADA6576} folder moved successfully.
C:\Users\Pappa\AppData\Local\{25D8C61E-D939-4293-A156-26674CBE0C9E} folder moved successfully.
C:\Users\Pappa\AppData\Local\{152AD721-66A6-412C-A722-753E81075426} folder moved successfully.
C:\Users\Pappa\AppData\Local\{F8C10A31-FE76-458F-9734-F737AEEDD685} folder moved successfully.
C:\Users\Pappa\AppData\Local\{836850C0-F7AD-49FD-90D4-22745D192D0B} folder moved successfully.
C:\Users\Pappa\AppData\Local\{73627C39-909C-432B-936B-4CAC7789B912} folder moved successfully.
C:\Users\Pappa\AppData\Local\{AE81AB42-E2DD-4799-B18C-F70C2B7BBD37} folder moved successfully.
C:\Users\Pappa\AppData\Local\{093D2195-056F-4ACF-9D67-21A9C5B8D64F} folder moved successfully.
C:\Users\Pappa\AppData\Local\{DF9959CC-FB39-44EA-BB2E-96C2B34B22C9} folder moved successfully.
C:\Users\Pappa\AppData\Local\{44E9BE5F-246C-42A5-843B-EE18AC965554} folder moved successfully.
C:\Users\Pappa\AppData\Local\{E7D5F6E8-42CD-44F4-B42C-C9C41A6787EA} folder moved successfully.
C:\Users\Pappa\AppData\Local\{E247D724-5762-4E1F-86F0-2F950616FD94} folder moved successfully.
C:\Users\Pappa\AppData\Local\{08F42313-898E-4EE5-A728-1B4B2DC2FA9B} folder moved successfully.
C:\Users\Pappa\AppData\Local\{86248B80-48EB-4360-9818-3F488FEA59C4} folder moved successfully.
C:\Users\Pappa\AppData\Local\{CF077561-CC80-4B4B-AD60-6D6364EDE0C5} folder moved successfully.
C:\Users\Pappa\AppData\Local\{93A6CD1E-D549-4FCD-A3E8-693686F2F45B} folder moved successfully.
C:\Users\Pappa\AppData\Local\{C627ACAC-2382-4C73-9874-844AA966F9A8} folder moved successfully.
C:\Users\Pappa\AppData\Local\{EEE9C91B-B948-4E02-8677-6938C3CEF108} folder moved successfully.
C:\Users\Pappa\AppData\Local\{6D3A16A2-2FD0-419B-BEE0-A1FCD45A5F9C} folder moved successfully.
C:\Users\Pappa\AppData\Local\{FC3DC148-8358-4EED-8E1A-E54744E68470} folder moved successfully.
C:\Users\Pappa\AppData\Local\{D07E9E53-A1F2-4F11-8359-802557352030} folder moved successfully.
C:\Users\Pappa\AppData\Local\{9651BC9D-62F6-4B18-8007-73EABBEE2999} folder moved successfully.
C:\Users\Pappa\AppData\Local\{486546E3-1F31-49E9-A7D1-9EC2328A7A60} folder moved successfully.
C:\Users\Pappa\AppData\Local\{BD1FC657-2938-4983-8FA2-C3AF9D7DF868} folder moved successfully.
C:\Users\Pappa\AppData\Local\{E79DE498-35CD-4F7D-9A66-274E33CDCCC1} folder moved successfully.
C:\Users\Pappa\AppData\Local\{109287D3-0D0A-4EA1-9E98-B95508B0D722} folder moved successfully.
C:\Users\Pappa\AppData\Local\{5343C601-E4AF-46E5-BCD0-10EDE8FBF077} folder moved successfully.
C:\Users\Pappa\AppData\Local\{B29373F4-4DEF-4183-8DA8-066F6D7ED0F3} folder moved successfully.
C:\Users\Pappa\AppData\Local\{B2A5D989-0DD5-4DAF-8378-B3B4964C41C8} folder moved successfully.
C:\Users\Pappa\AppData\Local\{017F6FE8-9FAB-481C-BD2D-251502E0DEBB} folder moved successfully.
C:\Users\Pappa\AppData\Local\{D57DBDDD-FE34-42B5-9CDD-7475618F1AF1} folder moved successfully.
C:\Users\Pappa\AppData\Local\{1FACE632-1FBB-40D2-9E0B-19F0B40F850E} folder moved successfully.
C:\Users\Pappa\AppData\Local\{BF3B0F0D-1357-46F1-A25A-FE83C16C8D1E} folder moved successfully.
C:\Users\Pappa\AppData\Local\{033AC495-8A20-4B20-AF9A-E3A1500CD6B3} folder moved successfully.
C:\Users\Pappa\AppData\Local\{C25D8386-7CC3-40B3-88AB-74B949E183B9} folder moved successfully.
C:\Users\Pappa\AppData\Local\{7F39917D-ED73-4CDE-AFDC-6B79CD80C8A9} folder moved successfully.
C:\Users\Pappa\AppData\Local\{6C177480-4C6C-42D0-A6DD-C6051C5CC258} folder moved successfully.
C:\Users\Pappa\AppData\Local\{0CD3131D-C131-4992-96F8-C753E4F80025} folder moved successfully.
C:\Users\Pappa\AppData\Local\{07CBE7B9-29E3-40D0-9587-276F1E5E37C4} folder moved successfully.
C:\Users\Pappa\AppData\Local\{6DE0EC3C-E7F1-40C3-9ADE-FFC7244CF686} folder moved successfully.
========== COMMANDS ==========
Restore point Set: OTL Restore Point
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Pappa
->Temp folder emptied: 55403386 bytes
->Temporary Internet Files folder emptied: 56632425 bytes
->FireFox cache emptied: 82480445 bytes
->Google Chrome cache emptied: 29379840 bytes
->Flash cache emptied: 11357 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3826 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50333 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 214,00 mb


OTL by OldTimer - Version 3.2.32.0 log created on 02182012_235219

Files\Folders moved on Reboot…
C:\Users\Pappa\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot…


Regarding GMER I could not press on any of the boxes as they were greyed out. The only boxes checked were services, registry, files (C:\) and ADS.


GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-02-19 00:11:12
Windows 6.1.7601 Service Pack 1
Running: gmer.exe


—- Files - GMER 1.0.15 —-

File C:\ProgramData\Microsoft\RAC\Temp\sqlC0EE.tmp 20480 bytes
File C:\ProgramData\Microsoft\RAC\Temp\sqlC10E.tmp 20480 bytes
File C:\Users\Pappa\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\381A.tmp 150798 bytes
File C:\Users\Pappa\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\381B.tmp 150798 bytes
File C:\Users\Pappa\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\382B.tmp 150798 bytes
File C:\Users\Pappa\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\382C.tmp 150798 bytes
File C:\Users\Pappa\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\21E7.tmp 150798 bytes
File C:\Users\Pappa\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\21E8.tmp 150798 bytes
File C:\Users\Pappa\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\21E9.tmp 150798 bytes
File C:\Users\Pappa\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\21FA.tmp 150798 bytes

—- EOF - GMER 1.0.15 —-
Post #7
You have two executables on your machine, UUSeeMediaCenter.exe and BaiduP2PService.exe, that tipped me off. From my sources, the former has been tagged by Malwarebytes as adware. Here is some more information about it. I'm not too familiar with the latter, but I thought I should warn you since it has "P2P" in its name, which indicates a peer-to-peer file sharing component. With P2P you are connecting to unknown sources and the files you download may or may not be modified.

  • TDSSKiller

    Please download TDSSKiller.zip

    • Extract it to your desktop
    • Double click TDSSKiller.exe
    • when the window opens, click on Change Parameters
    • under ”Additional options”, put a check mark in the box next to “Detect TDLFS File System”
    • click OK
    • Press Start Scan
      • As we are only looking for a log of what is on the machine right now > choose to skip whatever is found
      • Then click Continue > Reboot now
    • Copy and paste the log in your next reply
      • A copy of the log will be saved automatically to the root of the drive (typically C:\)
  • CKScanner

    Download CKScanner by askey127 from Here & save it to your Desktop.

    • Double-click CKScanner.exe then click Search For Files
    • When the cursor hourglass disappears, click Save List To File
    • A message box will verify the file saved
    • Double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply
Post #8
1. TDSSKiller log 03:33:37.0167 4956 TDSS rootkit removing tool [removed] Feb 15 2012 19:33:14 03:33:37.0315 4956 ============================================================ 03:33:37.0315 4956 Current date / time: 2012/02/19 03:33:37.0315 03:33:37.0315 4956 SystemInfo: 03:33:37.0315 4956 03:33:37.0315 4956 OS Version: 6.1.7601 ServicePack: 1.0 03:33:37.0315 4956 Product type: Workstation 03:33:37.0315 4956 ComputerName: PAPPA-PC 03:33:37.0315 4956 UserName: Pappa 03:33:37.0315 4956 Windows directory: C:\Windows 03:33:37.0315 4956 System windows directory: C:\Windows 03:33:37.0315 4956 Running under WOW64 03:33:37.0315 4956 Processor architecture: Intel x64 03:33:37.0315 4956 Number of processors: 2 03:33:37.0315 4956 Page size: 0x1000 03:33:37.0315 4956 Boot type: Normal boot 03:33:37.0315 4956 ============================================================ 03:33:38.0097 4956 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 03:33:38.0099 4956 \Device\Harddisk0\DR0: 03:33:38.0099 4956 MBR used 03:33:38.0099 4956 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000 03:33:38.0099 4956 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x3A353000 03:33:38.0117 4956 Initialize success 03:33:38.0117 4956 ============================================================ 03:33:56.0956 4612 ============================================================ 03:33:56.0956 4612 Scan started 03:33:56.0956 4612 Mode: Manual; TDLFS; 03:33:56.0956 4612 ============================================================ 03:33:57.0482 4612 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys 03:33:57.0484 4612 1394ohci - ok 03:33:57.0510 4612 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys 03:33:57.0513 4612 ACPI - ok 03:33:57.0542 4612 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys 03:33:57.0543 4612 AcpiPmi - ok 03:33:57.0589 4612 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys 03:33:57.0594 4612 adp94xx - ok 03:33:57.0615 4612 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys 03:33:57.0619 4612 adpahci - ok 03:33:57.0635 4612 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys 03:33:57.0637 4612 adpu320 - ok 03:33:57.0688 4612 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys 03:33:57.0693 4612 AFD - ok 03:33:57.0710 4612 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys 03:33:57.0711 4612 agp440 - ok 03:33:57.0729 4612 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys 03:33:57.0730 4612 aliide - ok 03:33:57.0751 4612 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys 03:33:57.0752 4612 amdide - ok 03:33:57.0768 4612 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys 03:33:57.0769 4612 AmdK8 - ok 03:33:57.0788 4612 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 03:33:57.0795 4612 AmdPPM - ok 03:33:57.0827 4612 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys 03:33:57.0829 4612 amdsata - ok 03:33:57.0847 4612 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys 03:33:57.0850 4612 amdsbs - ok 03:33:57.0869 4612 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys 03:33:57.0869 4612 amdxata - ok 03:33:57.0900 4612 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys 03:33:57.0901 4612 AppID - ok 03:33:57.0932 4612 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys 03:33:57.0934 4612 arc - ok 03:33:57.0948 4612 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys 03:33:57.0950 4612 arcsas - ok 03:33:57.0962 4612 AsIO - ok 03:33:57.0984 4612 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 03:33:57.0985 4612 AsyncMac - ok 03:33:57.0996 4612 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys 03:33:57.0996 4612 atapi - ok 03:33:58.0098 4612 atikmdag (79ceb8d4f25cabe69f3762c90f5b06b8) C:\Windows\system32\DRIVERS\atikmdag.sys 03:33:58.0184 4612 atikmdag - ok 03:33:58.0215 4612 AtiPcie (7c5d273e29dcc5505469b299c6f29163) C:\Windows\system32\DRIVERS\AtiPcie.sys 03:33:58.0215 4612 AtiPcie - ok 03:33:58.0283 4612 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys 03:33:58.0288 4612 b06bdrv - ok 03:33:58.0299 4612 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 03:33:58.0302 4612 b57nd60a - ok 03:33:58.0332 4612 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 03:33:58.0332 4612 Beep - ok 03:33:58.0366 4612 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 03:33:58.0367 4612 blbdrive - ok 03:33:58.0393 4612 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys 03:33:58.0394 4612 bowser - ok 03:33:58.0400 4612 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys 03:33:58.0402 4612 BrFiltLo - ok 03:33:58.0416 4612 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys 03:33:58.0416 4612 BrFiltUp - ok 03:33:58.0424 4612 BridgeMP (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys 03:33:58.0425 4612 BridgeMP - ok 03:33:58.0435 4612 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 03:33:58.0438 4612 Brserid - ok 03:33:58.0445 4612 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 03:33:58.0446 4612 BrSerWdm - ok 03:33:58.0454 4612 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 03:33:58.0455 4612 BrUsbMdm - ok 03:33:58.0461 4612 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 03:33:58.0462 4612 BrUsbSer - ok 03:33:58.0470 4612 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys 03:33:58.0471 4612 BTHMODEM - ok 03:33:58.0489 4612 catchme - ok 03:33:58.0507 4612 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 03:33:58.0509 4612 cdfs - ok 03:33:58.0553 4612 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys 03:33:58.0555 4612 cdrom - ok 03:33:58.0563 4612 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys 03:33:58.0564 4612 circlass - ok 03:33:58.0588 4612 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 03:33:58.0591 4612 CLFS - ok 03:33:58.0616 4612 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 03:33:58.0616 4612 CmBatt - ok 03:33:58.0635 4612 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys 03:33:58.0635 4612 cmdide - ok 03:33:58.0663 4612 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys 03:33:58.0667 4612 CNG - ok 03:33:58.0685 4612 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 03:33:58.0686 4612 Compbatt - ok 03:33:58.0715 4612 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys 03:33:58.0716 4612 CompositeBus - ok 03:33:58.0729 4612 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys 03:33:58.0729 4612 crcdisk - ok 03:33:58.0780 4612 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys 03:33:58.0792 4612 CSC - ok 03:33:58.0833 4612 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys 03:33:58.0834 4612 DfsC - ok 03:33:58.0847 4612 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 03:33:58.0848 4612 discache - ok 03:33:58.0861 4612 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys 03:33:58.0862 4612 Disk - ok 03:33:58.0903 4612 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 03:33:58.0904 4612 drmkaud - ok 03:33:58.0939 4612 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys 03:33:58.0943 4612 DXGKrnl - ok 03:33:59.0000 4612 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys 03:33:59.0044 4612 ebdrv - ok 03:33:59.0082 4612 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys 03:33:59.0087 4612 elxstor - ok 03:33:59.0117 4612 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys 03:33:59.0118 4612 ErrDev - ok 03:33:59.0141 4612 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 03:33:59.0143 4612 exfat - ok 03:33:59.0162 4612 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 03:33:59.0164 4612 fastfat - ok 03:33:59.0177 4612 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys 03:33:59.0178 4612 fdc - ok 03:33:59.0196 4612 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 03:33:59.0196 4612 FileInfo - ok 03:33:59.0216 4612 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 03:33:59.0217 4612 Filetrace - ok 03:33:59.0223 4612 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys 03:33:59.0224 4612 flpydisk - ok 03:33:59.0254 4612 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys 03:33:59.0256 4612 FltMgr - ok 03:33:59.0293 4612 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 03:33:59.0294 4612 FsDepends - ok 03:33:59.0310 4612 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys 03:33:59.0311 4612 Fs_Rec - ok 03:33:59.0362 4612 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys 03:33:59.0364 4612 fvevol - ok 03:33:59.0392 4612 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys 03:33:59.0393 4612 gagp30kx - ok 03:33:59.0409 4612 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 03:33:59.0410 4612 hcw85cir - ok 03:33:59.0452 4612 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys 03:33:59.0456 4612 HdAudAddService - ok 03:33:59.0471 4612 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys 03:33:59.0472 4612 HDAudBus - ok 03:33:59.0479 4612 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys 03:33:59.0480 4612 HidBatt - ok 03:33:59.0487 4612 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys 03:33:59.0488 4612 HidBth - ok 03:33:59.0495 4612 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys 03:33:59.0496 4612 HidIr - ok 03:33:59.0514 4612 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys 03:33:59.0515 4612 HidUsb - ok 03:33:59.0534 4612 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys 03:33:59.0536 4612 HpSAMD - ok 03:33:59.0580 4612 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys 03:33:59.0588 4612 HTTP - ok 03:33:59.0620 4612 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys 03:33:59.0620 4612 hwpolicy - ok 03:33:59.0636 4612 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys 03:33:59.0638 4612 i8042prt - ok 03:33:59.0668 4612 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys 03:33:59.0672 4612 iaStorV - ok 03:33:59.0700 4612 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys 03:33:59.0701 4612 iirsp - ok 03:33:59.0716 4612 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys 03:33:59.0717 4612 intelide - ok 03:33:59.0729 4612 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys 03:33:59.0730 4612 intelppm - ok 03:33:59.0762 4612 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys 03:33:59.0763 4612 IpFilterDriver - ok 03:33:59.0781 4612 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys 03:33:59.0794 4612 IPMIDRV - ok 03:33:59.0809 4612 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 03:33:59.0810 4612 IPNAT - ok 03:33:59.0822 4612 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 03:33:59.0823 4612 IRENUM - ok 03:33:59.0838 4612 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys 03:33:59.0839 4612 isapnp - ok 03:33:59.0857 4612 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys 03:33:59.0860 4612 iScsiPrt - ok 03:33:59.0880 4612 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys 03:33:59.0881 4612 kbdclass - ok 03:33:59.0903 4612 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys 03:33:59.0904 4612 kbdhid - ok 03:33:59.0934 4612 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys 03:33:59.0935 4612 KSecDD - ok 03:33:59.0952 4612 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys 03:33:59.0953 4612 KSecPkg - ok 03:33:59.0965 4612 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 03:33:59.0966 4612 ksthunk - ok 03:34:00.0002 4612 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 03:34:00.0003 4612 lltdio - ok 03:34:00.0021 4612 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys 03:34:00.0022 4612 LSI_FC - ok 03:34:00.0041 4612 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys 03:34:00.0042 4612 LSI_SAS - ok 03:34:00.0056 4612 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys 03:34:00.0057 4612 LSI_SAS2 - ok 03:34:00.0073 4612 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys 03:34:00.0074 4612 LSI_SCSI - ok 03:34:00.0089 4612 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 03:34:00.0090 4612 luafv - ok 03:34:00.0109 4612 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys 03:34:00.0110 4612 megasas - ok 03:34:00.0126 4612 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys 03:34:00.0129 4612 MegaSR - ok 03:34:00.0141 4612 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 03:34:00.0142 4612 Modem - ok 03:34:00.0165 4612 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 03:34:00.0165 4612 monitor - ok 03:34:00.0189 4612 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys 03:34:00.0189 4612 mouclass - ok 03:34:00.0206 4612 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 03:34:00.0206 4612 mouhid - ok 03:34:00.0230 4612 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys 03:34:00.0231 4612 mountmgr - ok 03:34:00.0283 4612 MpFilter (c177a7ebf5e8a0b596f618870516cab8) C:\Windows\system32\DRIVERS\MpFilter.sys 03:34:00.0284 4612 MpFilter - ok 03:34:00.0318 4612 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys 03:34:00.0320 4612 mpio - ok 03:34:00.0342 4612 MpNWMon (8fbf6b31fe8af1833d93c5913d5b4d55) C:\Windows\system32\DRIVERS\MpNWMon.sys 03:34:00.0343 4612 MpNWMon - ok 03:34:00.0358 4612 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 03:34:00.0360 4612 mpsdrv - ok 03:34:00.0389 4612 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys 03:34:00.0391 4612 MRxDAV - ok 03:34:00.0421 4612 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys 03:34:00.0423 4612 mrxsmb - ok 03:34:00.0453 4612 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys 03:34:00.0456 4612 mrxsmb10 - ok 03:34:00.0475 4612 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys 03:34:00.0477 4612 mrxsmb20 - ok 03:34:00.0496 4612 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys 03:34:00.0497 4612 msahci - ok 03:34:00.0510 4612 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys 03:34:00.0512 4612 msdsm - ok 03:34:00.0528 4612 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 03:34:00.0529 4612 Msfs - ok 03:34:00.0550 4612 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 03:34:00.0551 4612 mshidkmdf - ok 03:34:00.0564 4612 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys 03:34:00.0565 4612 msisadrv - ok 03:34:00.0590 4612 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 03:34:00.0591 4612 MSKSSRV - ok 03:34:00.0613 4612 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 03:34:00.0614 4612 MSPCLOCK - ok 03:34:00.0630 4612 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 03:34:00.0631 4612 MSPQM - ok 03:34:00.0659 4612 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys 03:34:00.0663 4612 MsRPC - ok 03:34:00.0678 4612 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys 03:34:00.0679 4612 mssmbios - ok 03:34:00.0693 4612 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 03:34:00.0694 4612 MSTEE - ok 03:34:00.0708 4612 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys 03:34:00.0708 4612 MTConfig - ok 03:34:00.0742 4612 MTsensor (19b006b181e3875fd254f7b67acf1e7c) C:\Windows\system32\DRIVERS\ASACPI.sys 03:34:00.0742 4612 MTsensor - ok 03:34:00.0767 4612 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 03:34:00.0768 4612 Mup - ok 03:34:00.0818 4612 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 03:34:00.0821 4612 NativeWifiP - ok 03:34:00.0857 4612 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys 03:34:00.0866 4612 NDIS - ok 03:34:00.0881 4612 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 03:34:00.0882 4612 NdisCap - ok 03:34:00.0900 4612 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 03:34:00.0901 4612 NdisTapi - ok 03:34:00.0931 4612 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys 03:34:00.0932 4612 Ndisuio - ok 03:34:00.0960 4612 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys 03:34:00.0962 4612 NdisWan - ok 03:34:00.0993 4612 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys 03:34:00.0994 4612 NDProxy - ok 03:34:01.0008 4612 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 03:34:01.0009 4612 NetBIOS - ok 03:34:01.0042 4612 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys 03:34:01.0045 4612 NetBT - ok 03:34:01.0110 4612 netr28ux (26672f93749ac9fd28da1b0f94efa78d) C:\Windows\system32\DRIVERS\Dnetr28ux.sys 03:34:01.0119 4612 netr28ux - ok 03:34:01.0145 4612 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys 03:34:01.0146 4612 nfrd960 - ok 03:34:01.0187 4612 NisDrv (5f7d72cbcdd025af1f38fdeee5646968) C:\Windows\system32\DRIVERS\NisDrvWFP.sys 03:34:01.0187 4612 NisDrv - ok 03:34:01.0207 4612 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 03:34:01.0208 4612 Npfs - ok 03:34:01.0225 4612 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 03:34:01.0226 4612 nsiproxy - ok 03:34:01.0278 4612 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys 03:34:01.0300 4612 Ntfs - ok 03:34:01.0320 4612 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 03:34:01.0320 4612 Null - ok 03:34:01.0358 4612 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys 03:34:01.0360 4612 nvraid - ok 03:34:01.0395 4612 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys 03:34:01.0397 4612 nvstor - ok 03:34:01.0424 4612 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys 03:34:01.0426 4612 nv_agp - ok 03:34:01.0456 4612 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys 03:34:01.0458 4612 ohci1394 - ok 03:34:01.0474 4612 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys 03:34:01.0475 4612 Parport - ok 03:34:01.0497 4612 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys 03:34:01.0498 4612 partmgr - ok 03:34:01.0515 4612 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys 03:34:01.0517 4612 pci - ok 03:34:01.0531 4612 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys 03:34:01.0532 4612 pciide - ok 03:34:01.0550 4612 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys 03:34:01.0553 4612 pcmcia - ok 03:34:01.0565 4612 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 03:34:01.0566 4612 pcw - ok 03:34:01.0595 4612 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 03:34:01.0601 4612 PEAUTH - ok 03:34:01.0649 4612 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys 03:34:01.0651 4612 PptpMiniport - ok 03:34:01.0658 4612 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys 03:34:01.0659 4612 Processor - ok 03:34:01.0706 4612 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys 03:34:01.0708 4612 Psched - ok 03:34:01.0741 4612 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys 03:34:01.0763 4612 ql2300 - ok 03:34:01.0779 4612 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys 03:34:01.0781 4612 ql40xx - ok 03:34:01.0806 4612 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 03:34:01.0807 4612 QWAVEdrv - ok 03:34:01.0823 4612 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 03:34:01.0824 4612 RasAcd - ok 03:34:01.0841 4612 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 03:34:01.0842 4612 RasAgileVpn - ok 03:34:01.0868 4612 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys 03:34:01.0870 4612 Rasl2tp - ok 03:34:01.0882 4612 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 03:34:01.0883 4612 RasPppoe - ok 03:34:01.0892 4612 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 03:34:01.0893 4612 RasSstp - ok 03:34:01.0912 4612 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys 03:34:01.0915 4612 rdbss - ok 03:34:01.0930 4612 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys 03:34:01.0930 4612 rdpbus - ok 03:34:01.0945 4612 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 03:34:01.0945 4612 RDPCDD - ok 03:34:01.0982 4612 RDPDR (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys 03:34:01.0984 4612 RDPDR - ok 03:34:01.0999 4612 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 03:34:01.0999 4612 RDPENCDD - ok 03:34:02.0007 4612 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 03:34:02.0008 4612 RDPREFMP - ok 03:34:02.0033 4612 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys 03:34:02.0035 4612 RDPWD - ok 03:34:02.0061 4612 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys 03:34:02.0063 4612 rdyboost - ok 03:34:02.0099 4612 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 03:34:02.0100 4612 rspndr - ok 03:34:02.0153 4612 RTHDMIAzAudService (7421a35c45484b95e83b5e9e107cefc2) C:\Windows\system32\drivers\RtHDMIVX.sys 03:34:02.0154 4612 RTHDMIAzAudService - ok 03:34:02.0203 4612 RTL8167 (ee082e06a82ff630351d1e0ebbd3d8d0) C:\Windows\system32\DRIVERS\Rt64win7.sys 03:34:02.0206 4612 RTL8167 - ok 03:34:02.0234 4612 s3cap (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys 03:34:02.0235 4612 s3cap - ok 03:34:02.0269 4612 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys 03:34:02.0270 4612 sbp2port - ok 03:34:02.0296 4612 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys 03:34:02.0297 4612 scfilter - ok 03:34:02.0315 4612 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 03:34:02.0316 4612 secdrv - ok 03:34:02.0338 4612 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys 03:34:02.0339 4612 Serenum - ok 03:34:02.0349 4612 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys 03:34:02.0351 4612 Serial - ok 03:34:02.0369 4612 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys 03:34:02.0370 4612 sermouse - ok 03:34:02.0407 4612 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys 03:34:02.0408 4612 sffdisk - ok 03:34:02.0421 4612 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys 03:34:02.0422 4612 sffp_mmc - ok 03:34:02.0435 4612 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys 03:34:02.0435 4612 sffp_sd - ok 03:34:02.0447 4612 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys 03:34:02.0448 4612 sfloppy - ok 03:34:02.0471 4612 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys 03:34:02.0472 4612 SiSRaid2 - ok 03:34:02.0487 4612 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys 03:34:02.0488 4612 SiSRaid4 - ok 03:34:02.0501 4612 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 03:34:02.0503 4612 Smb - ok 03:34:02.0510 4612 speedfan - ok 03:34:02.0531 4612 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 03:34:02.0532 4612 spldr - ok 03:34:02.0564 4612 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys 03:34:02.0569 4612 srv - ok 03:34:02.0584 4612 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys 03:34:02.0588 4612 srv2 - ok 03:34:02.0602 4612 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys 03:34:02.0604 4612 srvnet - ok 03:34:02.0638 4612 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys 03:34:02.0639 4612 stexstor - ok 03:34:02.0667 4612 storflt (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys 03:34:02.0668 4612 storflt - ok 03:34:02.0688 4612 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys 03:34:02.0689 4612 storvsc - ok 03:34:02.0700 4612 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys 03:34:02.0700 4612 swenum - ok 03:34:02.0756 4612 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys 03:34:02.0779 4612 Tcpip - ok 03:34:02.0820 4612 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys 03:34:02.0828 4612 TCPIP6 - ok 03:34:02.0854 4612 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys 03:34:02.0855 4612 tcpipreg - ok 03:34:02.0879 4612 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 03:34:02.0880 4612 TDPIPE - ok 03:34:02.0887 4612 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys 03:34:02.0887 4612 TDTCP - ok 03:34:02.0915 4612 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys 03:34:02.0917 4612 tdx - ok 03:34:02.0934 4612 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys 03:34:02.0934 4612 TermDD - ok 03:34:02.0970 4612 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys 03:34:02.0971 4612 tssecsrv - ok 03:34:03.0022 4612 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys 03:34:03.0023 4612 TsUsbFlt - ok 03:34:03.0070 4612 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys 03:34:03.0071 4612 tunnel - ok 03:34:03.0088 4612 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys 03:34:03.0089 4612 uagp35 - ok 03:34:03.0119 4612 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys 03:34:03.0123 4612 udfs - ok 03:34:03.0142 4612 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys 03:34:03.0143 4612 uliagpkx - ok 03:34:03.0168 4612 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys 03:34:03.0169 4612 umbus - ok 03:34:03.0185 4612 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys 03:34:03.0186 4612 UmPass - ok 03:34:03.0214 4612 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys 03:34:03.0216 4612 usbccgp - ok 03:34:03.0250 4612 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys 03:34:03.0251 4612 usbcir - ok 03:34:03.0271 4612 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys 03:34:03.0272 4612 usbehci - ok 03:34:03.0308 4612 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys 03:34:03.0311 4612 usbhub - ok 03:34:03.0343 4612 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys 03:34:03.0343 4612 usbohci - ok 03:34:03.0377 4612 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 03:34:03.0378 4612 usbprint - ok 03:34:03.0405 4612 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys 03:34:03.0406 4612 usbscan - ok 03:34:03.0426 4612 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS 03:34:03.0427 4612 USBSTOR - ok 03:34:03.0441 4612 usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\DRIVERS\usbuhci.sys 03:34:03.0442 4612 usbuhci - ok 03:34:03.0458 4612 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys 03:34:03.0459 4612 vdrvroot - ok 03:34:03.0473 4612 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 03:34:03.0474 4612 vga - ok 03:34:03.0486 4612 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 03:34:03.0487 4612 VgaSave - ok 03:34:03.0506 4612 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys 03:34:03.0508 4612 vhdmp - ok 03:34:03.0615 4612 VIAHdAudAddService (574b29f436c4c63d37020c6e570a7528) C:\Windows\system32\drivers\viahduaa.sys 03:34:03.0633 4612 VIAHdAudAddService - ok 03:34:03.0679 4612 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys 03:34:03.0680 4612 viaide - ok 03:34:03.0723 4612 vmbus (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys 03:34:03.0728 4612 vmbus - ok 03:34:03.0764 4612 VMBusHID (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys 03:34:03.0769 4612 VMBusHID - ok 03:34:03.0821 4612 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys 03:34:03.0822 4612 volmgr - ok 03:34:03.0867 4612 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys 03:34:03.0871 4612 volmgrx - ok 03:34:03.0908 4612 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys 03:34:03.0925 4612 volsnap - ok 03:34:04.0067 4612 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys 03:34:04.0069 4612 vsmraid - ok 03:34:04.0088 4612 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys 03:34:04.0100 4612 vwifibus - ok 03:34:04.0139 4612 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys 03:34:04.0144 4612 vwififlt - ok 03:34:04.0180 4612 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys 03:34:04.0198 4612 vwifimp - ok 03:34:04.0221 4612 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys 03:34:04.0222 4612 WacomPen - ok 03:34:04.0263 4612 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 03:34:04.0264 4612 WANARP - ok 03:34:04.0267 4612 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 03:34:04.0267 4612 Wanarpv6 - ok 03:34:04.0296 4612 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys 03:34:04.0296 4612 Wd - ok 03:34:04.0317 4612 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 03:34:04.0323 4612 Wdf01000 - ok 03:34:04.0341 4612 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 03:34:04.0342 4612 WfpLwf - ok 03:34:04.0361 4612 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 03:34:04.0362 4612 WIMMount - ok 03:34:04.0404 4612 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys 03:34:04.0405 4612 WmiAcpi - ok 03:34:04.0429 4612 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 03:34:04.0430 4612 ws2ifsl - ok 03:34:04.0459 4612 WSDPrintDevice (8d918b1db190a4d9b1753a66fa8c96e8) C:\Windows\system32\DRIVERS\WSDPrint.sys 03:34:04.0460 4612 WSDPrintDevice - ok 03:34:04.0487 4612 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys 03:34:04.0488 4612 WudfPf - ok 03:34:04.0523 4612 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys 03:34:04.0525 4612 WUDFRd - ok 03:34:04.0553 4612 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0 03:34:04.0703 4612 \Device\Harddisk0\DR0 - ok 03:34:04.0715 4612 Boot (0x1200) (6b8700147dd85ba4d1a093bb83693474) \Device\Harddisk0\DR0\Partition0 03:34:04.0721 4612 \Device\Harddisk0\DR0\Partition0 - ok 03:34:04.0728 4612 Boot (0x1200) (e2959b17750680971321957ed8021ffa) \Device\Harddisk0\DR0\Partition1 03:34:04.0729 4612 \Device\Harddisk0\DR0\Partition1 - ok 03:34:04.0729 4612 ============================================================ 03:34:04.0729 4612 Scan finished 03:34:04.0729 4612 ============================================================ 03:34:04.0736 3196 Detected object count: 0 03:34:04.0736 3196 Actual detected object count: 0 2. CKScanner log CKScanner - Additional Security Risks - These are not necessarily bad scanner sequence 3.RP.11.EINATL —– EOF —–
Post #9 last edited
I uninstalled baidu program but it seems UUSee was already uninstalled but it still seems to have some parts running.. weird. How do I remove it? EDIT: I thought I could include a log from malwarebytes. It says quarantined and removed succesfully but each time I scan it's back again. Malwarebytes Anti-Malware 1.60.1.1000 www.malwarebytes.org Database version: v2012.02.17.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Pappa :: PAPPA-PC [administrator] 2012-02-17 21:38:37 mbam-log-2012-02-17 (21-38-37).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 181180 Time elapsed: 2 minute(s), 3 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 10 C:\ProgramData\Baidu (Trojan.Cinmus) -> Quarantined and deleted successfully. C:\ProgramData\Baidu\AutoUpdate (Trojan.Cinmus) -> Quarantined and deleted successfully. C:\ProgramData\Baidu\BaiduPlayer (Trojan.Cinmus) -> Quarantined and deleted successfully. C:\ProgramData\Baidu\BaiduPlayer\AutoUpdate (Trojan.Cinmus) -> Quarantined and deleted successfully. C:\ProgramData\Baidu\BaiduPlayer\AutoUpdate\updatelog (Trojan.Cinmus) -> Quarantined and deleted successfully. C:\ProgramData\Baidu\BaiduPlayer\download (Trojan.Cinmus) -> Quarantined and deleted successfully. C:\Users\Pappa\AppData\Roaming\Baidu (Trojan.Cinmus) -> Quarantined and deleted successfully. C:\Users\Pappa\AppData\Roaming\Baidu\BaiduPlayer (Trojan.Cinmus) -> Quarantined and deleted successfully. C:\Users\Pappa\AppData\Roaming\Baidu\BaiduPlayer\ClientStat (Trojan.Cinmus) -> Quarantined and deleted successfully. C:\Users\Pappa\AppData\Roaming\Baidu\BaiduPlayer\ClientStat\MainPath (Trojan.Cinmus) -> Quarantined and deleted successfully. Files Detected: 5 C:\ProgramData\Baidu\BaiduPlayer\tasks.dat (Trojan.Cinmus) -> Quarantined and deleted successfully. C:\ProgramData\Baidu\BaiduPlayer\AutoUpdate\autoupdate.ini (Trojan.Cinmus) -> Quarantined and deleted successfully. C:\ProgramData\Baidu\BaiduPlayer\AutoUpdate\autoupdate.xml (Trojan.Cinmus) -> Quarantined and deleted successfully. C:\ProgramData\Baidu\BaiduPlayer\AutoUpdate\update_info.txt (Trojan.Cinmus) -> Quarantined and deleted successfully. C:\ProgramData\Baidu\BaiduPlayer\AutoUpdate\updatelog\autoupdate_20120217212518_2976.log (Trojan.Cinmus) -> Quarantined and deleted successfully. (end)
Post #10
  • Malwarebytes' Anti-Malware

    I see you already have MBAM on your computer. Please do the following:

    • Once the program has loaded, click the Update tab and Check for Updates.
    • Click the Scanner tab, select Perform quick scan, then click Scan.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Be sure that everything is checked, and click Remove Selected.
    • When completed, a log will open in Notepad. This log is saved by MBAM and can be viewed by clicking the Logs tab.
    • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. Please paste the results in your next reply.
    • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
  • ESET Online Scanner

    Please disable any real-time security programs such as your anti-virus before proceeding with this scan.

    • Open Internet Explorer.
    • Download ESET Online Scanner.
    • Put a checkmark in the checkbox next to YES, I accept the Terms of Use.
    • Click Start.
    • When prompted by your web browser, click Install.
    • Uncheck Remove found threats.
    • Check Scan archives.
    • Click Start and let the scanner finish downloading virus signatures. The scan will begin afterward.
    • When the scan completes, click List of found threats.
    • Click Export to text file… and save the file to your desktop.
    • Click Back.
    • Click Finish.
  • OTL

    • Launch OTL.exe.
    • Check the following.
    • Scan all users.
    • Standard Output.
    • Lop check.
    • Purity check.
  • Under Extra Registry section, select Use SafeList
  • Click the Run Scan button and wait for the scan to finish (usually about 10-15 minutes).
  • Post the log it creates.
Post #11
1. Malwarebytes quick scan log only found 7 objects as opposed to usually I find 15 objects with complete scan. Each time I find this trojan but it still gets found after a restart..


Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Database version: v2012.02.19.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Pappa :: PAPPA-PC [administrator]

2012-02-19 14:10:51
mbam-log-2012-02-19 (14-10-51).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 181323
Time elapsed: 2 minute(s), 28 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 6
C:\ProgramData\Baidu (Trojan.Cinmus) -> Quarantined and deleted successfully.
C:\ProgramData\Baidu\AutoUpdate (Trojan.Cinmus) -> Quarantined and deleted successfully.
C:\Users\Pappa\AppData\Roaming\Baidu (Trojan.Cinmus) -> Quarantined and deleted successfully.
C:\Users\Pappa\AppData\Roaming\Baidu\BaiduPlayer (Trojan.Cinmus) -> Quarantined and deleted successfully.
C:\Users\Pappa\AppData\Roaming\Baidu\BaiduPlayer\ClientStat (Trojan.Cinmus) -> Quarantined and deleted successfully.
C:\Users\Pappa\AppData\Roaming\Baidu\BaiduPlayer\ClientStat\MainPath (Trojan.Cinmus) -> Quarantined and deleted successfully.

Files Detected: 1
C:\Users\Pappa\AppData\Roaming\Baidu\BaiduPlayer\ClientStat\MainPath\statfailed.xml (Trojan.Cinmus) -> Quarantined and deleted successfully.

(end)

2. ESET online scanner found no threats so I could not export any log.

3. OTL Log + Extra log:

OTL logfile created on: 2012-02-19 15:19:06 - Run 2
OTL by OldTimer - Version 3.2.32.0 Folder = C:\Users\Pappa\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 0000041D | Country: Sweden | Language: SVE | Date Format: yyyy-MM-dd

3,75 Gb Total Physical Memory | 2,23 Gb Available Physical Memory | 59,55% Memory free
7,49 Gb Paging File | 5,74 Gb Available in Paging File | 76,58% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 319,34 Gb Free Space | 68,58% Space Free | Partition Type: NTFS

Computer Name: PAPPA-PC | User Name: Pappa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012-02-18 18:52:54 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Pappa\Desktop\OTL.exe
PRC - [2012-01-03 14:10:42 | 000,063,928 | —- | M] (Adobe Systems Incorporated) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011-11-03 12:08:24 | 000,521,592 | —- | M] (UUSEE) – C:\Program Files (x86)\Common Files\uusee\UUSeeMediaCenter.exe
PRC - [2010-02-03 15:17:18 | 005,756,544 | —- | M] (ASUSTeK Computer Inc.) – C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe


========== Modules (No Company Name) ==========

MOD - [2012-02-15 06:03:36 | 000,429,040 | —- | M] () – C:\Users\Pappa\AppData\Local\Google\Chrome\Application\17.0.963.56\ppgooglenaclpluginchrome.dll
MOD - [2012-02-15 06:03:34 | 003,772,912 | —- | M] () – C:\Users\Pappa\AppData\Local\Google\Chrome\Application\17.0.963.56\pdf.dll
MOD - [2012-02-15 06:02:10 | 000,122,880 | —- | M] () – C:\Users\Pappa\AppData\Local\Google\Chrome\Application\17.0.963.56\avutil-51.dll
MOD - [2012-02-15 06:02:08 | 000,220,672 | —- | M] () – C:\Users\Pappa\AppData\Local\Google\Chrome\Application\17.0.963.56\avformat-53.dll
MOD - [2012-02-15 06:02:07 | 001,747,456 | —- | M] () – C:\Users\Pappa\AppData\Local\Google\Chrome\Application\17.0.963.56\avcodec-53.dll
MOD - [2011-11-03 12:08:28 | 000,079,224 | —- | M] () – C:\Program Files (x86)\Common Files\uusee\UUUpgrade.dll
MOD - [2011-09-16 12:44:12 | 000,351,096 | —- | M] () – C:\Program Files (x86)\Common Files\uusee\Localserver.dll
MOD - [2010-06-04 03:00:38 | 000,091,512 | —- | M] () – C:\Program Files (x86)\Common Files\uusee\CoCode.dll
MOD - [2010-06-04 02:59:56 | 000,058,744 | —- | M] () – C:\Program Files (x86)\Common Files\uusee\download.dll
MOD - [2009-09-30 04:33:08 | 000,024,576 | R— | M] () – C:\Windows\SysWOW64\AsIO.dll
MOD - [2009-03-25 15:53:14 | 000,053,248 | —- | M] () – C:\Program Files (x86)\ASUS\EPU-4 Engine\AsSpindownTimeout.dll
MOD - [2009-03-19 21:35:52 | 000,208,896 | —- | M] () – C:\Program Files (x86)\ASUS\EPU-4 Engine\AiNap.dll
MOD - [2009-03-19 21:35:50 | 000,008,704 | —- | M] () – C:\Program Files (x86)\ASUS\EPU-4 Engine\vvc.dll
MOD - [2009-01-15 13:55:10 | 000,565,248 | —- | M] () – C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011-04-27 16:21:18 | 000,288,272 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe – (NisSrv)
SRV:64bit: - [2011-04-27 16:21:18 | 000,012,784 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe – (MsMpSvc)
SRV:64bit: - [2009-09-19 03:17:42 | 000,202,752 | —- | M] (AMD) [Auto | Running] – C:\Windows\SysNative\atiesrxx.exe – (AMD External Events Utility)
SRV:64bit: - [2009-07-14 02:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV:64bit: - [2009-07-14 02:40:01 | 000,193,536 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\appmgmts.dll – (AppMgmt)
SRV - [2012-01-03 14:10:42 | 000,063,928 | —- | M] (Adobe Systems Incorporated) [Auto | Running] – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe – (AdobeARMservice)
SRV - [2010-03-18 12:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009-06-10 22:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2011-06-10 05:34:52 | 000,539,240 | —- | M] (Realtek ) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Rt64win7.sys – (RTL8167)
DRV:64bit: - [2011-04-27 14:25:24 | 000,084,864 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\NisDrvWFP.sys – (NisDrv)
DRV:64bit: - [2011-03-11 07:41:12 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011-03-11 07:41:12 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2010-11-20 14:33:35 | 000,078,720 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2010-11-20 12:07:05 | 000,059,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV:64bit: - [2009-09-19 05:32:38 | 006,170,624 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmdag.sys – (atikmdag)
DRV:64bit: - [2009-08-17 12:20:46 | 001,235,968 | —- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\viahduaa.sys – (VIAHdAudAddService)
DRV:64bit: - [2009-08-06 03:59:00 | 000,987,648 | —- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\Dnetr28ux.sys – (netr28ux)
DRV:64bit: - [2009-07-16 04:38:40 | 000,015,416 | —- | M] () [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\ASACPI.sys – (MTsensor)
DRV:64bit: - [2009-07-14 02:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009-07-14 02:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009-07-14 02:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009-07-14 01:39:20 | 000,023,040 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\WSDPrint.sys – (WSDPrintDevice)
DRV:64bit: - [2009-06-24 11:23:24 | 000,205,472 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\RtHDMIVX.sys – (RTHDMIAzAudService)
DRV:64bit: - [2009-06-10 21:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009-06-10 21:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009-06-10 21:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009-06-10 21:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2009-05-05 05:30:28 | 000,016,440 | —- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\AtiPcie.sys – (AtiPcie) AMD PCI Express (3GIO)
DRV - [2009-07-14 02:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)
DRV - [2007-02-07 19:27:46 | 000,014,104 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | Boot | Running] – C:\Windows\SysWOW64\speedfan.sys – (speedfan)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2084622461-223115633-1812412026-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se/
IE - HKU\S-1-5-21-2084622461-223115633-1812412026-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-2084622461-223115633-1812412026-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F1 95 59 F0 EF 3F CB 01 [binary data]
IE - HKU\S-1-5-21-2084622461-223115633-1812412026-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Pappa\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Pappa\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012-02-17 16:53:13 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012-02-17 21:16:43 | 000,000,000 | —D | M]

[2010-08-19 23:57:10 | 000,000,000 | —D | M] (No name found) – C:\Users\Pappa\AppData\Roaming\Mozilla\Extensions
[2012-01-05 23:32:30 | 000,000,000 | —D | M] (No name found) – C:\Users\Pappa\AppData\Roaming\Mozilla\Firefox\Profiles\vayipwjv.default\extensions
[2011-09-29 19:21:34 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
() (No name found) – C:\USERS\PAPPA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\VAYIPWJV.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012-02-17 16:53:13 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012-02-02 23:15:11 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012-02-02 23:15:11 | 000,002,040 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Pappa\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Pappa\AppData\Local\Google\Chrome\Application\17.0.963.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Pappa\AppData\Local\Google\Chrome\Application\17.0.963.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Pappa\AppData\Local\Google\Chrome\Application\17.0.963.56\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Pappa\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: AdBlock = C:\Users\Pappa\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.19_0\

O1 HOSTS File: ([2012-02-18 23:52:31 | 000,000,098 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UUSeeMediaCenter] C:\Program Files (x86)\Common Files\uusee\UUSeeMediaCenter.exe (UUSEE)
O4 - HKU\S-1-5-21-2084622461-223115633-1812412026-1000..\Run: [BAIDUMEDIA] C:\Program Files (x86)\Baidu\BaiduPlayer\1.0.23.108\BaiduPlayer.exe minimize File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2084622461-223115633-1812412026-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2084622461-223115633-1812412026-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: 使用UUSee下载 - C:\Program Files (x86)\uusee\geturltodown.htm ()
O8:64bit: - Extra context menu item: 使用UUSee加速播放 - C:\Program Files (x86)\uusee\geturltoplay.htm ()
O8 - Extra context menu item: 使用UUSee下载 - C:\Program Files (x86)\uusee\geturltodown.htm ()
O8 - Extra context menu item: 使用UUSee加速播放 - C:\Program Files (x86)\uusee\geturltoplay.htm ()
O9 - Extra Button: 小游戏 - {998A88A0-A355-809B-831C-B83A80000991} - http://www.ugege.com/ File not found
O9 - Extra 'Tools' menuitem : 小游戏 - {998A88A0-A355-809B-831C-B83A80000991} - http://www.ugege.com/ File not found
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{05C5E550-361D-4C02-BCBD-D75EEFA63FB0}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{848BEF6C-D4B0-44C6-B38C-911E57507566}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012-02-19 14:15:08 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2012-02-18 23:52:19 | 000,000,000 | —D | C] – C:\_OTL
[2012-02-18 20:00:32 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Roaming\Media Player Classic
[2012-02-18 18:53:07 | 004,729,344 | —- | C] (AVAST Software) – C:\Users\Pappa\Desktop\aswMBR.exe
[2012-02-18 18:53:04 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\Pappa\Desktop\OTL.exe
[2012-02-17 21:22:33 | 000,000,000 | —D | C] – C:\Windows\temp
[2012-02-17 21:19:31 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012-02-17 21:13:39 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012-02-17 21:13:39 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012-02-17 21:13:39 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012-02-17 21:13:36 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2012-02-17 21:13:34 | 000,000,000 | —D | C] – C:\Qoobox
[2012-02-15 19:34:16 | 002,060,336 | —- | C] (Kaspersky Lab ZAO) – C:\Users\Pappa\Desktop\TDSSKiller.exe
[2012-02-15 01:49:19 | 000,096,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012-02-15 01:49:18 | 000,072,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012-02-15 01:49:17 | 002,308,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012-02-15 01:49:17 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012-02-15 01:49:17 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012-02-15 01:49:17 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012-02-15 01:49:16 | 000,818,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012-02-15 01:49:16 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012-02-15 01:49:16 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012-02-15 01:49:15 | 001,493,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012-02-15 01:49:15 | 001,427,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012-02-14 23:03:37 | 000,509,952 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntshrui.dll
[2012-02-14 23:03:36 | 000,515,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\timedate.cpl
[2012-02-14 23:03:36 | 000,478,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\timedate.cpl
[2012-02-14 23:03:31 | 000,634,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msvcrt.dll

========== Files - Modified Within 30 Days ==========

[2012-02-19 14:42:02 | 000,001,004 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2084622461-223115633-1812412026-1000UA.job
[2012-02-19 14:17:29 | 000,023,392 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012-02-19 14:17:29 | 000,023,392 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012-02-19 14:10:00 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012-02-19 14:09:57 | 3018,461,184 | -HS- | M] () – C:\hiberfil.sys
[2012-02-19 03:32:04 | 002,060,336 | —- | M] (Kaspersky Lab ZAO) – C:\Users\Pappa\Desktop\TDSSKiller.exe
[2012-02-19 03:31:38 | 000,458,240 | —- | M] () – C:\Users\Pappa\Desktop\CKScanner.exe
[2012-02-18 23:58:56 | 000,302,592 | —- | M] () – C:\Users\Pappa\Desktop\gmer.exe
[2012-02-18 23:52:31 | 000,000,098 | —- | M] () – C:\Windows\SysNative\drivers\etc\Hosts
[2012-02-18 21:42:00 | 000,000,952 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2084622461-223115633-1812412026-1000Core.job
[2012-02-18 19:09:43 | 000,000,559 | —- | M] () – C:\Users\Pappa\Desktop\MBR.zip
[2012-02-18 19:08:48 | 000,000,512 | —- | M] () – C:\Users\Pappa\Desktop\MBR.dat
[2012-02-18 18:53:43 | 004,729,344 | —- | M] (AVAST Software) – C:\Users\Pappa\Desktop\aswMBR.exe
[2012-02-18 18:52:54 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Pappa\Desktop\OTL.exe
[2012-02-17 21:17:56 | 000,004,004 | —- | M] () – C:\Users\Pappa\Documents\Document.rtf
[2012-02-17 17:21:54 | 000,001,109 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012-02-17 16:55:20 | 000,735,438 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012-02-17 16:55:20 | 000,618,132 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012-02-17 16:55:20 | 000,107,412 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012-02-16 22:42:51 | 000,002,359 | —- | M] () – C:\Users\Pappa\Desktop\Google Chrome.lnk
[2012-02-15 15:18:43 | 000,266,592 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012-02-02 23:15:14 | 000,002,044 | —- | M] () – C:\Users\Pappa\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk

========== Files Created - No Company Name ==========

[2012-02-19 03:31:46 | 000,458,240 | —- | C] () – C:\Users\Pappa\Desktop\CKScanner.exe
[2012-02-18 19:09:43 | 000,000,559 | —- | C] () – C:\Users\Pappa\Desktop\MBR.zip
[2012-02-18 19:08:48 | 000,000,512 | —- | C] () – C:\Users\Pappa\Desktop\MBR.dat
[2012-02-17 21:17:56 | 000,004,004 | —- | C] () – C:\Users\Pappa\Documents\Document.rtf
[2012-02-17 21:13:39 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012-02-17 21:13:39 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012-02-17 21:13:39 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012-02-17 21:13:39 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012-02-17 21:13:39 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012-02-17 17:21:54 | 000,001,109 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2011-11-21 14:52:48 | 000,000,891 | —- | C] () – C:\Windows\SysWow64\bdsecushr.dat
[2010-12-23 16:47:41 | 000,734,810 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2010-08-19 23:52:43 | 000,007,605 | —- | C] () – C:\Users\Pappa\AppData\Local\Resmon.ResmonCfg
[2010-08-19 22:11:09 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2010-08-19 21:57:03 | 000,024,576 | R— | C] () – C:\Windows\SysWow64\AsIO.dll
[2010-08-19 21:57:03 | 000,013,440 | R— | C] () – C:\Windows\SysWow64\drivers\AsIO.sys
[2010-08-19 21:57:01 | 000,011,832 | —- | C] () – C:\Windows\SysWow64\drivers\AsInsHelp64.sys
[2010-08-19 21:57:01 | 000,010,216 | —- | C] () – C:\Windows\SysWow64\drivers\AsInsHelp32.sys
[2010-08-19 21:54:11 | 000,047,013 | —- | C] () – C:\Windows\Ascd_log.ini
[2010-08-19 21:53:49 | 000,001,769 | —- | C] () – C:\Windows\Language_trs.ini
[2010-08-19 21:53:46 | 000,036,551 | —- | C] () – C:\Windows\Ascd_tmp.ini
[2009-07-14 06:38:36 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009-07-14 03:35:51 | 000,000,741 | —- | C] () – C:\Windows\SysWow64\NOISE.DAT
[2009-07-14 03:34:42 | 000,215,943 | —- | C] () – C:\Windows\SysWow64\dssec.dat
[2009-07-14 01:10:29 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009-07-14 00:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009-07-13 22:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009-06-10 22:26:10 | 000,673,088 | —- | C] () – C:\Windows\SysWow64\mlang.dat
[2009-04-02 13:30:14 | 000,010,296 | —- | C] () – C:\Windows\SysWow64\drivers\ASUSHWIO.SYS
[2009-02-21 12:35:10 | 000,049,152 | R— | C] () – C:\Windows\DAOD.exe
[2006-09-13 12:06:10 | 000,045,056 | —- | C] () – C:\Windows\SysWow64\gtapi.dll

========== LOP Check ==========

[2010-08-22 17:25:45 | 000,000,000 | —D | M] – C:\Users\Pappa\AppData\Roaming\Tibia
[2011-12-16 23:15:23 | 000,032,638 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Files - Unicode (All) ==========
[2011-11-21 14:44:41 | 000,001,296 | —- | M] ()(C:\Users\Public\Desktop\????.lnk) – C:\Users\Public\Desktop\百度影音.lnk
[2011-11-21 14:44:41 | 000,001,296 | —- | C] ()(C:\Users\Public\Desktop\????.lnk) – C:\Users\Public\Desktop\百度影音.lnk
[2010-08-20 15:41:43 | 000,001,919 | —- | M] ()(C:\Users\Public\Desktop\UUSee ????.lnk) – C:\Users\Public\Desktop\UUSee 网络电视.lnk
[2010-08-20 15:41:43 | 000,001,919 | —- | C] ()(C:\Users\Public\Desktop\UUSee ????.lnk) – C:\Users\Public\Desktop\UUSee 网络电视.lnk
[2010-08-20 15:41:43 | 000,001,051 | —- | M] ()(C:\Users\Pappa\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee ????.lnk) – C:\Users\Pappa\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee 网络电视.lnk
[2010-08-20 15:41:43 | 000,001,051 | —- | C] ()(C:\Users\Pappa\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee ????.lnk) – C:\Users\Pappa\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee 网络电视.lnk
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UUSee ????) – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UUSee 网络电视
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\????) – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\百度影音

< End of report >


OTL Extras logfile created on: 2012-02-19 15:19:06 - Run 2
OTL by OldTimer - Version 3.2.32.0 Folder = C:\Users\Pappa\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 0000041D | Country: Sweden | Language: SVE | Date Format: yyyy-MM-dd

3,75 Gb Total Physical Memory | 2,23 Gb Available Physical Memory | 59,55% Memory free
7,49 Gb Paging File | 5,74 Gb Available in Paging File | 76,58% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 319,34 Gb Free Space | 68,58% Space Free | Partition Type: NTFS

Computer Name: PAPPA-PC | User Name: Pappa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-2084622461-223115633-1812412026-1000\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\uusee\UUSeePlayer.exe" = C:\Program Files (x86)\uusee\UUSeePlayer.exe:*:Enabled:UUPlayer – ()
"C:\Program Files (x86)\uusee\UUSeePlayer.exe" = C:\Program Files (x86)\uusee\UUSeePlayer.exe:*:Enabled:UUPlayer – ()


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{23170F69-40C1-2702-0919-000001000000}" = 7-Zip 9.19 (x64 edition)
"{2A3636F8-1207-DFA3-E4E2-A78CCD798795}" = ATI Catalyst Install Manager
"{42738DB0-FC3E-4672-A99B-9372F5696E30}" = Microsoft Security Client
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FDB89E21-0C9C-743A-15B3-A4E5C3144E4A}" = ccc-utility64
"CCleaner" = CCleaner
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.55
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02DE1B7C-0CDB-7E4B-8201-092EEA910DA3}" = CCC Help Italian
"{03E22EBD-9729-2734-94CF-4372394E5DBD}" = CCC Help Dutch
"{06986B82-43FC-CB3C-BD29-ABD9A3EB2AF1}" = Catalyst Control Center InstallProxy
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{2201A1DA-6755-ACE4-37A6-D35816CCB9F1}" = CCC Help Polish
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{310AFA06-1206-7D46-8AE6-370D47836130}" = CCC Help Finnish
"{34D1ACDA-B4ED-9628-98F3-22E04EF0374B}" = Catalyst Control Center Graphics Previews Vista
"{425B1239-C81A-8CE1-3037-36FC046205DD}" = CCC Help Korean
"{454B00AA-EC7D-363E-B2CA-78F21D65E168}" = CCC Help Chinese Traditional
"{4C9FFDD0-B533-4726-42A8-EEEF0D4F61C2}" = Catalyst Control Center Localization All
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5B16C262-B90C-D241-8FC3-0C638253868E}" = CCC Help Thai
"{5E76C154-1205-B588-D419-8C1FF51231AA}" = CCC Help Greek
"{66BE0C97-071E-7EFB-93ED-BE8999B8F88E}" = Catalyst Control Center Graphics Full New
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{7B7C90A2-F3F3-CAF6-ED3C-F5A67207EEA2}" = CCC Help French
"{7E85D37B-3981-8986-C806-E806A9EF80BB}" = CCC Help Turkish
"{7EA28DC8-133A-9B3C-915D-DCD626E27E82}" = CCC Help German
"{81E1D495-835E-6BAE-1DDD-2EEEB2C208ED}" = CCC Help Swedish
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8136 8168 8169 Ethernet Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E8728CB-E879-FAD7-EA0B-D5CA63E33DB5}" = CCC Help Russian
"{8F66047B-1AF3-40D9-80D7-106E2EDC2C2A}" = EPU-4 Engine
"{9260CA0A-FB90-D727-B063-1E96C91F471F}" = Catalyst Control Center Graphics Light
"{93372FC7-4F1E-0C8D-D648-CEE90629C5D3}" = CCC Help Norwegian
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AB67580-257C-45FF-B8F4-C8C30682091A}_is1" = SIW version 2010.07.14
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.2)
"{BDA77C36-E477-BF77-9F77-29B1BE4103F4}" = CCC Help Japanese
"{BE001325-AE69-AB6B-E0ED-87A9DB012F99}" = ccc-core-static
"{C8B867BE-5851-E0AF-96EB-9A0EA034F36E}" = Catalyst Control Center Core Implementation
"{CC801442-57CF-B2A8-4F5A-B4DF882B5B64}" = CCC Help Czech
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D1B34C45-531E-E8A3-B30E-BE5AFC33BAE5}" = CCC Help Portuguese
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D64EEC36-DA76-B5D6-42C5-AA3AB18461D6}" = CCC Help Hungarian
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E217EF6A-A283-C6EA-C602-83D4934D61CE}" = CCC Help Danish
"{E2AA7922-8EC9-8F2A-1475-6263F0B0975D}" = CCC Help English
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EA2A7A51-5FB8-28AE-1FF3-82699DEDE407}" = Catalyst Control Center Graphics Full Existing
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F335D312-365F-3BED-0B22-A0C7AA9B4421}" = CCC Help Spanish
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FFF117E6-6F27-0AB6-C862-BB3A76C43BFD}" = CCC Help Chinese Standard
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"BaiduPlayer" = BaiduPlayer1.0.23.108
"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2011-11-11
"ESET Online Scanner" = ESET Online Scanner v3
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.60.1.1000
"Mozilla Firefox 10.0.2 (x86 en-US)" = Mozilla Firefox 10.0.2 (x86 en-US)
"OCCT_is1" = OCCT Perestroika 3.1.0
"SpeedFan" = SpeedFan (remove only)
"Tibia_is1" = Tibia
"WinLiveSuite" = Windows Live Essentials

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2084622461-223115633-1812412026-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2012-02-09 19:30:12 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-10 20:24:15 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-11 19:30:11 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-13 19:30:12 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-14 19:30:11 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-16 18:00:08 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-17 12:52:10 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-17 20:01:48 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-18 19:45:27 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-19 09:15:06 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Users\Pappa\Downloads\esetsmartinstaller_enu.exe".Error
in manifest or policy file "" on line . A component version required by the application
conflicts with another component version already active. Conflicting components
are:. Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

[ System Events ]
Error - 2012-02-17 16:19:17 | Computer Name = Pappa-PC | Source = Service Control Manager | ID = 7023
Description = The Windows Defender service terminated with the following error:
%%126

Error - 2012-02-17 16:20:20 | Computer Name = Pappa-PC | Source = DCOM | ID = 10016
Description =

Error - 2012-02-17 16:26:08 | Computer Name = Pappa-PC | Source = DCOM | ID = 10016
Description =

Error - 2012-02-18 13:52:54 | Computer Name = Pappa-PC | Source = DCOM | ID = 10016
Description =

Error - 2012-02-18 18:52:19 | Computer Name = Pappa-PC | Source = Service Control Manager | ID = 7034
Description = The Adobe Acrobat Update Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 2012-02-18 18:54:54 | Computer Name = Pappa-PC | Source = Microsoft Antimalware | ID = 3002
Description = %%860 Real-Time Protection feature has encountered an error and failed.

Feature:
%%835 Error Code: 0x80004005 Error description: Unspecified error Reason: %%842

Error - 2012-02-18 18:55:33 | Computer Name = Pappa-PC | Source = DCOM | ID = 10016
Description =

Error - 2012-02-18 22:31:37 | Computer Name = Pappa-PC | Source = DCOM | ID = 10016
Description =

Error - 2012-02-19 09:10:32 | Computer Name = Pappa-PC | Source = Microsoft Antimalware | ID = 3002
Description = %%860 Real-Time Protection feature has encountered an error and failed.

Feature:
%%835 Error Code: 0x80004005 Error description: Unspecified error Reason: %%842

Error - 2012-02-19 09:11:11 | Computer Name = Pappa-PC | Source = DCOM | ID = 10016
Description =


< End of report >
Post #12
  • OTL

    Run OTL.exe.

    • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.

      :OTL
[2010-08-20 15:41:43 | 000,001,919 | —- | M] ()(C:\Users\Public\Desktop\UUSee ????.lnk) – C:\Users\Public\Desktop\UUSee 网络电视.lnk
[2010-08-20 15:41:43 | 000,001,919 | —- | C] ()(C:\Users\Public\Desktop\UUSee ????.lnk) – C:\Users\Public\Desktop\UUSee 网络电视.lnk
[2010-08-20 15:41:43 | 000,001,051 | —- | M] ()(C:\Users\Pappa\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee ????.lnk) – C:\Users\Pappa\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee 网络电视.lnk
[2010-08-20 15:41:43 | 000,001,051 | —- | C] ()(C:\Users\Pappa\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee ????.lnk) – C:\Users\Pappa\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee 网络电视.lnk
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UUSee ????) – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UUSee 网络电视
O8:64bit: - Extra context menu item: 使用UUSee下载 - C:\Program Files (x86)\uusee\geturltodown.htm ()
O8:64bit: - Extra context menu item: 使用UUSee加速播放 - C:\Program Files (x86)\uusee\geturltoplay.htm ()
O8 - Extra context menu item: 使用UUSee下载 - C:\Program Files (x86)\uusee\geturltodown.htm ()
O8 - Extra context menu item: 使用UUSee加速播放 - C:\Program Files (x86)\uusee\geturltoplay.htm ()
O4 - HKLM..\Run: [UUSeeMediaCenter] C:\Program Files (x86)\Common Files\uusee\UUSeeMediaCenter.exe (UUSEE)
MOD - [2011-11-03 12:08:28 | 000,079,224 | —- | M] () – C:\Program Files (x86)\Common Files\uusee\UUUpgrade.dll
MOD - [2011-09-16 12:44:12 | 000,351,096 | —- | M] () – C:\Program Files (x86)\Common Files\uusee\Localserver.dll
MOD - [2010-06-04 03:00:38 | 000,091,512 | —- | M] () – C:\Program Files (x86)\Common Files\uusee\CoCode.dll
MOD - [2010-06-04 02:59:56 | 000,058,744 | —- | M] () – C:\Program Files (x86)\Common Files\uusee\download.dll
PRC - [2011-11-03 12:08:24 | 000,521,592 | —- | M] (UUSEE) – C:\Program Files (x86)\Common Files\uusee\UUSeeMediaCenter.exe
O4 - HKU\S-1-5-21-2084622461-223115633-1812412026-1000..\Run: [BAIDUMEDIA] C:\Program Files (x86)\Baidu\BaiduPlayer\1.0.23.108\BaiduPlayer.exe minimize File not found

:Files
C:\Program Files (x86)\uusee
C:\Program Files (x86)\Common Files\uusee
C:\Program Files (x86)\Baidu

:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\uusee\UUSeePlayer.exe"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BaiduPlayer]

:Commands
[createrestorepoint]
[purity]
[emptytemp]
    • Click the Run Fix button.
    • OTL will now process the instructions.
    • When finished a box will open asking you to open the fix log, click OK.
    • The fix log will open.
    • Copy/Paste the log in your next reply please.

    Note: If necessary, OTL may reboot your computer, or request that you do so. If it does, please go ahead and reboot your machine. After rebooting, open up Windows Explorer (Windows Key +E) and navigate to C:\_OTL\MovedFiles. Within, you should find a .log file with the format mmddyyyy_hhmmss, which represents the date and time the fix was run. Please copy and paste the contents of that file, making sure Word Wrap is off beforehand, if necessary.

  • Malwarebytes' Anti-Malware

    Update, quick scan, reboot if you need to, and post that log please.

  • OTL

    • Launch OTL.exe.
    • Check the following.
    • Scan all users.
    • Standard Output.
    • Lop check.
    • Purity check.
  • Under Extra Registry section, select Use SafeList
  • Click the Run Scan button and wait for the scan to finish (usually about 10-15 minutes).
  • When finished it will produce a log. Please post it.
Post #13
1. OTL Fix log


All processes killed
========== OTL ==========
C:\Users\Public\Desktop\UUSee 网络电视.lnk moved successfully.
File C:\Users\Public\Desktop\UUSee 网络电视.lnk not found.
C:\Users\Pappa\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee 网络电视.lnk moved successfully.
File C:\Users\Pappa\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee 网络电视.lnk not found.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\使用UUSee下载\ deleted successfully.
C:\Program Files (x86)\uusee\geturltodown.htm moved successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\使用UUSee加速播放\ deleted successfully.
C:\Program Files (x86)\uusee\geturltoplay.htm moved successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\使用UUSee下载\ not found.
File C:\Program Files (x86)\uusee\geturltodown.htm not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\使用UUSee加速播放\ not found.
File C:\Program Files (x86)\uusee\geturltoplay.htm not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\UUSeeMediaCenter deleted successfully.
C:\Program Files (x86)\Common Files\uusee\UUSeeMediaCenter.exe moved successfully.
No active process named UUSeeMediaCenter.exe was found!
Registry value HKEY_USERS\S-1-5-21-2084622461-223115633-1812412026-1000\Software\Microsoft\Windows\CurrentVersion\Run\\BAIDUMEDIA deleted successfully.
========== FILES ==========
C:\Program Files (x86)\uusee\xml folder moved successfully.
C:\Program Files (x86)\uusee\skins\UUPlayer folder moved successfully.
C:\Program Files (x86)\uusee\skins folder moved successfully.
C:\Program Files (x86)\uusee\icon folder moved successfully.
C:\Program Files (x86)\uusee\def\loadingflv folder moved successfully.
C:\Program Files (x86)\uusee\def\2\stop folder moved successfully.
C:\Program Files (x86)\uusee\def\2\800 folder moved successfully.
C:\Program Files (x86)\uusee\def\2\500 folder moved successfully.
C:\Program Files (x86)\uusee\def\2\20 folder moved successfully.
C:\Program Files (x86)\uusee\def\2\1018 folder moved successfully.
C:\Program Files (x86)\uusee\def\2\1012 folder moved successfully.
C:\Program Files (x86)\uusee\def\2\1011 folder moved successfully.
C:\Program Files (x86)\uusee\def\2\1009 folder moved successfully.
C:\Program Files (x86)\uusee\def\2\1008 folder moved successfully.
C:\Program Files (x86)\uusee\def\2\1007 folder moved successfully.
C:\Program Files (x86)\uusee\def\2\1006 folder moved successfully.
C:\Program Files (x86)\uusee\def\2\1005 folder moved successfully.
C:\Program Files (x86)\uusee\def\2\1004 folder moved successfully.
C:\Program Files (x86)\uusee\def\2\1003 folder moved successfully.
C:\Program Files (x86)\uusee\def\2\1002 folder moved successfully.
C:\Program Files (x86)\uusee\def\2\1001 folder moved successfully.
C:\Program Files (x86)\uusee\def\2\0 folder moved successfully.
C:\Program Files (x86)\uusee\def\2 folder moved successfully.
C:\Program Files (x86)\uusee\def\1\loadingflv folder moved successfully.
C:\Program Files (x86)\uusee\def\1\lb folder moved successfully.
C:\Program Files (x86)\uusee\def\1\km folder moved successfully.
C:\Program Files (x86)\uusee\def\1\dm folder moved successfully.
C:\Program Files (x86)\uusee\def\1\3Dloading folder moved successfully.
C:\Program Files (x86)\uusee\def\1\100 folder moved successfully.
C:\Program Files (x86)\uusee\def\1\001 folder moved successfully.
C:\Program Files (x86)\uusee\def\1\000 folder moved successfully.
C:\Program Files (x86)\uusee\def\1 folder moved successfully.
C:\Program Files (x86)\uusee\def folder moved successfully.
C:\Program Files (x86)\uusee folder moved successfully.
C:\Program Files (x86)\Common Files\uusee\UUSEETemp\UUPlayer_2010_update folder moved successfully.
C:\Program Files (x86)\Common Files\uusee\UUSEETemp folder moved successfully.
C:\Program Files (x86)\Common Files\uusee\temp folder moved successfully.
C:\Program Files (x86)\Common Files\uusee\skins\UUPlayer folder moved successfully.
C:\Program Files (x86)\Common Files\uusee\skins folder moved successfully.
C:\Program Files (x86)\Common Files\uusee\review folder moved successfully.
C:\Program Files (x86)\Common Files\uusee\Codecs folder moved successfully.
C:\Program Files (x86)\Common Files\uusee folder moved successfully.
C:\Program Files (x86)\Baidu\BaiduPlayer folder moved successfully.
C:\Program Files (x86)\Baidu folder moved successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files (x86)\uusee\UUSeePlayer.exe deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BaiduPlayer\ deleted successfully.
========== COMMANDS ==========
Restore point Set: OTL Restore Point

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Pappa
->Temp folder emptied: 222273 bytes
->Temporary Internet Files folder emptied: 2728431 bytes
->FireFox cache emptied: 6012188 bytes
->Google Chrome cache emptied: 13234522 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 19510 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 21,00 mb


OTL by OldTimer - Version 3.2.32.0 log created on 02192012_180158

Files\Folders moved on Reboot…
C:\Users\Pappa\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot…


2. Malwarebytes log


Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Database version: v2012.02.19.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Pappa :: PAPPA-PC [administrator]

2012-02-19 18:05:25
mbam-log-2012-02-19 (18-05-25).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 181170
Time elapsed: 2 minute(s), 4 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


3. OTL scan log + extras


OTL logfile created on: 2012-02-19 18:08:18 - Run 3
OTL by OldTimer - Version 3.2.32.0 Folder = C:\Users\Pappa\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 0000041D | Country: Sweden | Language: SVE | Date Format: yyyy-MM-dd

3,75 Gb Total Physical Memory | 2,60 Gb Available Physical Memory | 69,35% Memory free
7,49 Gb Paging File | 6,22 Gb Available in Paging File | 83,02% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 319,24 Gb Free Space | 68,56% Space Free | Partition Type: NTFS

Computer Name: PAPPA-PC | User Name: Pappa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012-02-18 18:52:54 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Pappa\Desktop\OTL.exe
PRC - [2012-01-03 14:10:42 | 000,063,928 | —- | M] (Adobe Systems Incorporated) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2010-02-03 15:17:18 | 005,756,544 | —- | M] (ASUSTeK Computer Inc.) – C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe


========== Modules (No Company Name) ==========

MOD - [2012-02-15 06:03:36 | 000,429,040 | —- | M] () – C:\Users\Pappa\AppData\Local\Google\Chrome\Application\17.0.963.56\ppgooglenaclpluginchrome.dll
MOD - [2012-02-15 06:03:34 | 003,772,912 | —- | M] () – C:\Users\Pappa\AppData\Local\Google\Chrome\Application\17.0.963.56\pdf.dll
MOD - [2012-02-15 06:02:10 | 000,122,880 | —- | M] () – C:\Users\Pappa\AppData\Local\Google\Chrome\Application\17.0.963.56\avutil-51.dll
MOD - [2012-02-15 06:02:08 | 000,220,672 | —- | M] () – C:\Users\Pappa\AppData\Local\Google\Chrome\Application\17.0.963.56\avformat-53.dll
MOD - [2012-02-15 06:02:07 | 001,747,456 | —- | M] () – C:\Users\Pappa\AppData\Local\Google\Chrome\Application\17.0.963.56\avcodec-53.dll
MOD - [2009-09-30 04:33:08 | 000,024,576 | R— | M] () – C:\Windows\SysWOW64\AsIO.dll
MOD - [2009-03-19 21:35:52 | 000,208,896 | —- | M] () – C:\Program Files (x86)\ASUS\EPU-4 Engine\AiNap.dll
MOD - [2009-03-19 21:35:50 | 000,008,704 | —- | M] () – C:\Program Files (x86)\ASUS\EPU-4 Engine\vvc.dll
MOD - [2009-01-15 13:55:10 | 000,565,248 | —- | M] () – C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011-04-27 16:21:18 | 000,288,272 | —- | M] (Microsoft Corporation) [On_Demand | Running] – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe – (NisSrv)
SRV:64bit: - [2011-04-27 16:21:18 | 000,012,784 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe – (MsMpSvc)
SRV:64bit: - [2009-09-19 03:17:42 | 000,202,752 | —- | M] (AMD) [Auto | Running] – C:\Windows\SysNative\atiesrxx.exe – (AMD External Events Utility)
SRV:64bit: - [2009-07-14 02:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV:64bit: - [2009-07-14 02:40:01 | 000,193,536 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\appmgmts.dll – (AppMgmt)
SRV - [2012-01-03 14:10:42 | 000,063,928 | —- | M] (Adobe Systems Incorporated) [Auto | Running] – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe – (AdobeARMservice)
SRV - [2010-03-18 12:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009-06-10 22:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2011-06-10 05:34:52 | 000,539,240 | —- | M] (Realtek ) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Rt64win7.sys – (RTL8167)
DRV:64bit: - [2011-04-27 14:25:24 | 000,084,864 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\NisDrvWFP.sys – (NisDrv)
DRV:64bit: - [2011-03-11 07:41:12 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011-03-11 07:41:12 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2010-11-20 14:33:35 | 000,078,720 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2010-11-20 12:07:05 | 000,059,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV:64bit: - [2009-09-19 05:32:38 | 006,170,624 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmdag.sys – (atikmdag)
DRV:64bit: - [2009-08-17 12:20:46 | 001,235,968 | —- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\viahduaa.sys – (VIAHdAudAddService)
DRV:64bit: - [2009-08-06 03:59:00 | 000,987,648 | —- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\Dnetr28ux.sys – (netr28ux)
DRV:64bit: - [2009-07-16 04:38:40 | 000,015,416 | —- | M] () [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\ASACPI.sys – (MTsensor)
DRV:64bit: - [2009-07-14 02:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009-07-14 02:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009-07-14 02:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009-07-14 01:39:20 | 000,023,040 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\WSDPrint.sys – (WSDPrintDevice)
DRV:64bit: - [2009-06-24 11:23:24 | 000,205,472 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\RtHDMIVX.sys – (RTHDMIAzAudService)
DRV:64bit: - [2009-06-10 21:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009-06-10 21:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009-06-10 21:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009-06-10 21:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2009-05-05 05:30:28 | 000,016,440 | —- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\AtiPcie.sys – (AtiPcie) AMD PCI Express (3GIO)
DRV - [2009-07-14 02:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)
DRV - [2007-02-07 19:27:46 | 000,014,104 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | Boot | Running] – C:\Windows\SysWOW64\speedfan.sys – (speedfan)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2084622461-223115633-1812412026-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se/
IE - HKU\S-1-5-21-2084622461-223115633-1812412026-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-2084622461-223115633-1812412026-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F1 95 59 F0 EF 3F CB 01 [binary data]
IE - HKU\S-1-5-21-2084622461-223115633-1812412026-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Pappa\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Pappa\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012-02-17 16:53:13 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012-02-17 21:16:43 | 000,000,000 | —D | M]

[2010-08-19 23:57:10 | 000,000,000 | —D | M] (No name found) – C:\Users\Pappa\AppData\Roaming\Mozilla\Extensions
[2012-01-05 23:32:30 | 000,000,000 | —D | M] (No name found) – C:\Users\Pappa\AppData\Roaming\Mozilla\Firefox\Profiles\vayipwjv.default\extensions
[2011-09-29 19:21:34 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
() (No name found) – C:\USERS\PAPPA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\VAYIPWJV.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012-02-17 16:53:13 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012-02-02 23:15:11 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012-02-02 23:15:11 | 000,002,040 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Pappa\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Pappa\AppData\Local\Google\Chrome\Application\17.0.963.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Pappa\AppData\Local\Google\Chrome\Application\17.0.963.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Pappa\AppData\Local\Google\Chrome\Application\17.0.963.56\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Pappa\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: AdBlock = C:\Users\Pappa\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.19_0\

O1 HOSTS File: ([2012-02-18 23:52:31 | 000,000,098 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2084622461-223115633-1812412026-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2084622461-223115633-1812412026-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: 小游戏 - {998A88A0-A355-809B-831C-B83A80000991} - http://www.ugege.com/ File not found
O9 - Extra 'Tools' menuitem : 小游戏 - {998A88A0-A355-809B-831C-B83A80000991} - http://www.ugege.com/ File not found
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{05C5E550-361D-4C02-BCBD-D75EEFA63FB0}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{848BEF6C-D4B0-44C6-B38C-911E57507566}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012-02-19 14:15:08 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2012-02-18 23:52:19 | 000,000,000 | —D | C] – C:\_OTL
[2012-02-18 20:00:32 | 000,000,000 | —D | C] – C:\Users\Pappa\AppData\Roaming\Media Player Classic
[2012-02-18 18:53:07 | 004,729,344 | —- | C] (AVAST Software) – C:\Users\Pappa\Desktop\aswMBR.exe
[2012-02-18 18:53:04 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\Pappa\Desktop\OTL.exe
[2012-02-17 21:22:33 | 000,000,000 | —D | C] – C:\Windows\temp
[2012-02-17 21:19:31 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012-02-17 21:13:39 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012-02-17 21:13:39 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012-02-17 21:13:39 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012-02-17 21:13:36 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2012-02-17 21:13:34 | 000,000,000 | —D | C] – C:\Qoobox
[2012-02-15 19:34:16 | 002,060,336 | —- | C] (Kaspersky Lab ZAO) – C:\Users\Pappa\Desktop\TDSSKiller.exe
[2012-02-15 01:49:19 | 000,096,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012-02-15 01:49:18 | 000,072,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012-02-15 01:49:17 | 002,308,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012-02-15 01:49:17 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012-02-15 01:49:17 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012-02-15 01:49:17 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012-02-15 01:49:16 | 000,818,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012-02-15 01:49:16 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012-02-15 01:49:16 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012-02-15 01:49:15 | 001,493,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012-02-15 01:49:15 | 001,427,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012-02-14 23:03:37 | 000,509,952 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntshrui.dll
[2012-02-14 23:03:36 | 000,515,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\timedate.cpl
[2012-02-14 23:03:36 | 000,478,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\timedate.cpl
[2012-02-14 23:03:31 | 000,634,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msvcrt.dll

========== Files - Modified Within 30 Days ==========

[2012-02-19 18:03:12 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012-02-19 18:03:08 | 3018,461,184 | -HS- | M] () – C:\hiberfil.sys
[2012-02-19 17:42:00 | 000,001,004 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2084622461-223115633-1812412026-1000UA.job
[2012-02-19 14:17:29 | 000,023,392 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012-02-19 14:17:29 | 000,023,392 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012-02-19 03:32:04 | 002,060,336 | —- | M] (Kaspersky Lab ZAO) – C:\Users\Pappa\Desktop\TDSSKiller.exe
[2012-02-19 03:31:38 | 000,458,240 | —- | M] () – C:\Users\Pappa\Desktop\CKScanner.exe
[2012-02-18 23:58:56 | 000,302,592 | —- | M] () – C:\Users\Pappa\Desktop\gmer.exe
[2012-02-18 23:52:31 | 000,000,098 | —- | M] () – C:\Windows\SysNative\drivers\etc\Hosts
[2012-02-18 21:42:00 | 000,000,952 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2084622461-223115633-1812412026-1000Core.job
[2012-02-18 19:09:43 | 000,000,559 | —- | M] () – C:\Users\Pappa\Desktop\MBR.zip
[2012-02-18 19:08:48 | 000,000,512 | —- | M] () – C:\Users\Pappa\Desktop\MBR.dat
[2012-02-18 18:53:43 | 004,729,344 | —- | M] (AVAST Software) – C:\Users\Pappa\Desktop\aswMBR.exe
[2012-02-18 18:52:54 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Pappa\Desktop\OTL.exe
[2012-02-17 21:17:56 | 000,004,004 | —- | M] () – C:\Users\Pappa\Documents\Document.rtf
[2012-02-17 17:21:54 | 000,001,109 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012-02-17 16:55:20 | 000,735,438 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012-02-17 16:55:20 | 000,618,132 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012-02-17 16:55:20 | 000,107,412 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012-02-16 22:42:51 | 000,002,359 | —- | M] () – C:\Users\Pappa\Desktop\Google Chrome.lnk
[2012-02-15 15:18:43 | 000,266,592 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012-02-02 23:15:14 | 000,002,044 | —- | M] () – C:\Users\Pappa\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk

========== Files Created - No Company Name ==========

[2012-02-19 03:31:46 | 000,458,240 | —- | C] () – C:\Users\Pappa\Desktop\CKScanner.exe
[2012-02-18 19:09:43 | 000,000,559 | —- | C] () – C:\Users\Pappa\Desktop\MBR.zip
[2012-02-18 19:08:48 | 000,000,512 | —- | C] () – C:\Users\Pappa\Desktop\MBR.dat
[2012-02-17 21:17:56 | 000,004,004 | —- | C] () – C:\Users\Pappa\Documents\Document.rtf
[2012-02-17 21:13:39 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012-02-17 21:13:39 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012-02-17 21:13:39 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012-02-17 21:13:39 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012-02-17 21:13:39 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012-02-17 17:21:54 | 000,001,109 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2011-11-21 14:52:48 | 000,000,891 | —- | C] () – C:\Windows\SysWow64\bdsecushr.dat
[2010-12-23 16:47:41 | 000,734,810 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2010-08-19 23:52:43 | 000,007,605 | —- | C] () – C:\Users\Pappa\AppData\Local\Resmon.ResmonCfg
[2010-08-19 22:11:09 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2010-08-19 21:57:03 | 000,024,576 | R— | C] () – C:\Windows\SysWow64\AsIO.dll
[2010-08-19 21:57:03 | 000,013,440 | R— | C] () – C:\Windows\SysWow64\drivers\AsIO.sys
[2010-08-19 21:57:01 | 000,011,832 | —- | C] () – C:\Windows\SysWow64\drivers\AsInsHelp64.sys
[2010-08-19 21:57:01 | 000,010,216 | —- | C] () – C:\Windows\SysWow64\drivers\AsInsHelp32.sys
[2010-08-19 21:54:11 | 000,047,013 | —- | C] () – C:\Windows\Ascd_log.ini
[2010-08-19 21:53:49 | 000,001,769 | —- | C] () – C:\Windows\Language_trs.ini
[2010-08-19 21:53:46 | 000,036,551 | —- | C] () – C:\Windows\Ascd_tmp.ini
[2009-07-14 06:38:36 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009-07-14 03:35:51 | 000,000,741 | —- | C] () – C:\Windows\SysWow64\NOISE.DAT
[2009-07-14 03:34:42 | 000,215,943 | —- | C] () – C:\Windows\SysWow64\dssec.dat
[2009-07-14 01:10:29 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009-07-14 00:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009-07-13 22:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009-06-10 22:26:10 | 000,673,088 | —- | C] () – C:\Windows\SysWow64\mlang.dat
[2009-04-02 13:30:14 | 000,010,296 | —- | C] () – C:\Windows\SysWow64\drivers\ASUSHWIO.SYS
[2009-02-21 12:35:10 | 000,049,152 | R— | C] () – C:\Windows\DAOD.exe
[2006-09-13 12:06:10 | 000,045,056 | —- | C] () – C:\Windows\SysWow64\gtapi.dll

========== LOP Check ==========

[2010-08-22 17:25:45 | 000,000,000 | —D | M] – C:\Users\Pappa\AppData\Roaming\Tibia
[2011-12-16 23:15:23 | 000,032,638 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Files - Unicode (All) ==========
[2011-11-21 14:44:41 | 000,001,296 | —- | M] ()(C:\Users\Public\Desktop\????.lnk) – C:\Users\Public\Desktop\百度影音.lnk
[2011-11-21 14:44:41 | 000,001,296 | —- | C] ()(C:\Users\Public\Desktop\????.lnk) – C:\Users\Public\Desktop\百度影音.lnk
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UUSee ????) – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UUSee 网络电视
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\????) – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\百度影音

< End of report >




OTL Extras logfile created on: 2012-02-19 18:08:18 - Run 3
OTL by OldTimer - Version 3.2.32.0 Folder = C:\Users\Pappa\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 0000041D | Country: Sweden | Language: SVE | Date Format: yyyy-MM-dd

3,75 Gb Total Physical Memory | 2,60 Gb Available Physical Memory | 69,35% Memory free
7,49 Gb Paging File | 6,22 Gb Available in Paging File | 83,02% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 319,24 Gb Free Space | 68,56% Space Free | Partition Type: NTFS

Computer Name: PAPPA-PC | User Name: Pappa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-2084622461-223115633-1812412026-1000\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{23170F69-40C1-2702-0919-000001000000}" = 7-Zip 9.19 (x64 edition)
"{2A3636F8-1207-DFA3-E4E2-A78CCD798795}" = ATI Catalyst Install Manager
"{42738DB0-FC3E-4672-A99B-9372F5696E30}" = Microsoft Security Client
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FDB89E21-0C9C-743A-15B3-A4E5C3144E4A}" = ccc-utility64
"CCleaner" = CCleaner
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.55
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02DE1B7C-0CDB-7E4B-8201-092EEA910DA3}" = CCC Help Italian
"{03E22EBD-9729-2734-94CF-4372394E5DBD}" = CCC Help Dutch
"{06986B82-43FC-CB3C-BD29-ABD9A3EB2AF1}" = Catalyst Control Center InstallProxy
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{2201A1DA-6755-ACE4-37A6-D35816CCB9F1}" = CCC Help Polish
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{310AFA06-1206-7D46-8AE6-370D47836130}" = CCC Help Finnish
"{34D1ACDA-B4ED-9628-98F3-22E04EF0374B}" = Catalyst Control Center Graphics Previews Vista
"{425B1239-C81A-8CE1-3037-36FC046205DD}" = CCC Help Korean
"{454B00AA-EC7D-363E-B2CA-78F21D65E168}" = CCC Help Chinese Traditional
"{4C9FFDD0-B533-4726-42A8-EEEF0D4F61C2}" = Catalyst Control Center Localization All
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5B16C262-B90C-D241-8FC3-0C638253868E}" = CCC Help Thai
"{5E76C154-1205-B588-D419-8C1FF51231AA}" = CCC Help Greek
"{66BE0C97-071E-7EFB-93ED-BE8999B8F88E}" = Catalyst Control Center Graphics Full New
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{7B7C90A2-F3F3-CAF6-ED3C-F5A67207EEA2}" = CCC Help French
"{7E85D37B-3981-8986-C806-E806A9EF80BB}" = CCC Help Turkish
"{7EA28DC8-133A-9B3C-915D-DCD626E27E82}" = CCC Help German
"{81E1D495-835E-6BAE-1DDD-2EEEB2C208ED}" = CCC Help Swedish
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8136 8168 8169 Ethernet Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E8728CB-E879-FAD7-EA0B-D5CA63E33DB5}" = CCC Help Russian
"{8F66047B-1AF3-40D9-80D7-106E2EDC2C2A}" = EPU-4 Engine
"{9260CA0A-FB90-D727-B063-1E96C91F471F}" = Catalyst Control Center Graphics Light
"{93372FC7-4F1E-0C8D-D648-CEE90629C5D3}" = CCC Help Norwegian
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AB67580-257C-45FF-B8F4-C8C30682091A}_is1" = SIW version 2010.07.14
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.2)
"{BDA77C36-E477-BF77-9F77-29B1BE4103F4}" = CCC Help Japanese
"{BE001325-AE69-AB6B-E0ED-87A9DB012F99}" = ccc-core-static
"{C8B867BE-5851-E0AF-96EB-9A0EA034F36E}" = Catalyst Control Center Core Implementation
"{CC801442-57CF-B2A8-4F5A-B4DF882B5B64}" = CCC Help Czech
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D1B34C45-531E-E8A3-B30E-BE5AFC33BAE5}" = CCC Help Portuguese
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D64EEC36-DA76-B5D6-42C5-AA3AB18461D6}" = CCC Help Hungarian
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E217EF6A-A283-C6EA-C602-83D4934D61CE}" = CCC Help Danish
"{E2AA7922-8EC9-8F2A-1475-6263F0B0975D}" = CCC Help English
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EA2A7A51-5FB8-28AE-1FF3-82699DEDE407}" = Catalyst Control Center Graphics Full Existing
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F335D312-365F-3BED-0B22-A0C7AA9B4421}" = CCC Help Spanish
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FFF117E6-6F27-0AB6-C862-BB3A76C43BFD}" = CCC Help Chinese Standard
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2011-11-11
"ESET Online Scanner" = ESET Online Scanner v3
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.60.1.1000
"Mozilla Firefox 10.0.2 (x86 en-US)" = Mozilla Firefox 10.0.2 (x86 en-US)
"OCCT_is1" = OCCT Perestroika 3.1.0
"SpeedFan" = SpeedFan (remove only)
"Tibia_is1" = Tibia
"WinLiveSuite" = Windows Live Essentials

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2084622461-223115633-1812412026-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2012-02-09 19:30:12 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-10 20:24:15 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-11 19:30:11 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-13 19:30:12 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-14 19:30:11 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-16 18:00:08 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-17 12:52:10 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-17 20:01:48 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-18 19:45:27 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 2012-02-19 09:15:06 | Computer Name = Pappa-PC | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Users\Pappa\Downloads\esetsmartinstaller_enu.exe".Error
in manifest or policy file "" on line . A component version required by the application
conflicts with another component version already active. Conflicting components
are:. Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

[ System Events ]
Error - 2012-02-17 16:26:08 | Computer Name = Pappa-PC | Source = DCOM | ID = 10016
Description =

Error - 2012-02-18 13:52:54 | Computer Name = Pappa-PC | Source = DCOM | ID = 10016
Description =

Error - 2012-02-18 18:52:19 | Computer Name = Pappa-PC | Source = Service Control Manager | ID = 7034
Description = The Adobe Acrobat Update Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 2012-02-18 18:54:54 | Computer Name = Pappa-PC | Source = Microsoft Antimalware | ID = 3002
Description = %%860 Real-Time Protection feature has encountered an error and failed.

Feature:
%%835 Error Code: 0x80004005 Error description: Unspecified error Reason: %%842

Error - 2012-02-18 18:55:33 | Computer Name = Pappa-PC | Source = DCOM | ID = 10016
Description =

Error - 2012-02-18 22:31:37 | Computer Name = Pappa-PC | Source = DCOM | ID = 10016
Description =

Error - 2012-02-19 09:10:32 | Computer Name = Pappa-PC | Source = Microsoft Antimalware | ID = 3002
Description = %%860 Real-Time Protection feature has encountered an error and failed.

Feature:
%%835 Error Code: 0x80004005 Error description: Unspecified error Reason: %%842

Error - 2012-02-19 09:11:11 | Computer Name = Pappa-PC | Source = DCOM | ID = 10016
Description =

Error - 2012-02-19 13:01:59 | Computer Name = Pappa-PC | Source = Service Control Manager | ID = 7034
Description = The Adobe Acrobat Update Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 2012-02-19 13:04:21 | Computer Name = Pappa-PC | Source = DCOM | ID = 10016
Description =


< End of report >
Post #14
It looks like MBAM is satisfied now.

  • OTL

    Run OTL.exe.

  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.

    :Files
C:\Users\Public\Desktop\百度影音.lnk /u
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UUSee 网络电视 /u
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\百度影音 /u

:OTL
[2011-11-21 14:52:48 | 000,000,891 | —- | C] () – C:\Windows\SysWow64\bdsecushr.dat
[2011-11-21 14:44:41 | 000,001,296 | —- | M] ()(C:\Users\Public\Desktop\????.lnk) – C:\Users\Public\Desktop\百度影音.lnk
[2011-11-21 14:44:41 | 000,001,296 | —- | C] ()(C:\Users\Public\Desktop\????.lnk) – C:\Users\Public\Desktop\百度影音.lnk
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UUSee ????) – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UUSee 网络电视
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\????) – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\百度影音

:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{998A88A0-A355-809B-831C-B83A80000991}]

:Commands
[createrestorepoint]
[purity]
[emptytemp]

  • Click the Run Fix button.
  • OTL will now process the instructions.
  • When finished a box will open asking you to open the fix log, click OK.
  • The fix log will open.
  • Copy/Paste the log in your next reply please.

Note: If necessary, OTL may reboot your computer, or request that you do so. If it does, please go ahead and reboot your machine. After rebooting, open up Windows Explorer (Windows Key +E) and navigate to C:\_OTL\MovedFiles. Within, you should find a .log file with the format mmddyyyy_hhmmss, which represents the date and time the fix was run. Please copy and paste the contents of that file, making sure Word Wrap is off beforehand, if necessary.

Now please post a fresh OTL scan log (no Extras.txt this time) and advise how the computer is running.
Post #15
All processes killed ========== FILES ========== File\Folder C:\Users\Public\Desktop\百度影音.lnk not found. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UUSee 网络电视 folder moved successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\百度影音 folder moved successfully. ========== OTL ========== C:\Windows\SysWOW64\bdsecushr.dat moved successfully. File C:\Users\Public\Desktop\百度影音.lnk not found. File C:\Users\Public\Desktop\百度影音.lnk not found. ========== REGISTRY ========== Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{998A88A0-A355-809B-831C-B83A80000991}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{998A88A0-A355-809B-831C-B83A80000991}\ not found. ========== COMMANDS ========== Restore point Set: OTL Restore Point [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Pappa ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Google Chrome cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 0,00 mb OTL by OldTimer - Version 3.2.32.0 log created on 02192012_234317 Files\Folders moved on Reboot… Registry entries deleted on Reboot… Seems to run fine now. A full scan from malwarebytes and microsoft security essentials showed nothing. So the problem as I understand it was the Baiduplayer software itself? Or something downloaded from it?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI