Trojan JS/IframeREF Infection [Solved]

Hi Satchfan, Thank you for the reminder. Here are the three logs in the following order: DDS, Attach, and aswMBR . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26 Run by [removed] at 20:46:29 on 2012-04-18 Microsoft Windows XP Home Edition 5.1.2600.3.949.82.1033.18.1535.675 [GMT -4:00] . AV: BitDefender Professional Edition v7.2 *Disabled/Outdated* {6C4BB89C-B0ED-4F41-A29C-4373888923BB} AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095} FW: BitDefender Professional Edition v7.2 *Disabled* . ============== Running Processes =============== . C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup C:\WINDOWS\Explorer.EXE svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\windows\system\hpsysdrv.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\ALCWZRD.EXE C:\WINDOWS\ALCMTR.EXE C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe svchost.exe C:\Program Files\iTunes\iTunesHelper.exe C:\HP\KBD\KBD.EXE C:\Program Files\DAEMON Tools\daemon.exe C:\Updater.exe C:\WINDOWS\tsnpstd3.exe C:\WINDOWS\vsnpstd3.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\FsUsbExService.Exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\WINDOWS\system32\svchost.exe -k hpdevmgmt C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\WTClient.exe C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Steam\Steam.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\system32\PnkBstrA.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\WINDOWS\system32\PnkBstrB.exe C:\Program Files\Rogers\Update Manager\RogersUpdateManager.exe C:\Program Files\Compaq Connections\6750491\Program\Compaq Connections.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Rogers Online Protection\Rogers Servicepoint Agent\ServicepointService.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Documents and Settings\Compaq_Owner\Application Data\Dropbox\bin\Dropbox.exe C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE C:\WINDOWS\System32\Drivers\WTSRV.EXE C:\WINDOWS\system32\wscntfy.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe C:\WINDOWS\system32\WISPTIS.EXE C:\WINDOWS\system32\wuauclt.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe C:\Program Files\Common Files\Java\Java Update\jucheck.exe C:\WINDOWS\System32\mshta.exe C:\WINDOWS\System32\mshta.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\WINDOWS\system32\conime.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.ca/ uSearch Page = hxxp://www.google.com uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q404&bd=presario&pf=desktop uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=presario&pf=desktop uSearch Bar = hxxp://www.google.com/ie uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms} mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=presario&pf=desktop uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q404&bd=presario&pf=desktop uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll mWinlogon: Userinit=userinit.exe, BHO: {05417E8D-D8CB-433B-AB76-6BA4E5C062F7} - No File BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: {06FB63F7-3609-448B-8D8B-C0F0A075ACEC} - No File BHO: QuickStores-Toolbar: {10edb994-47f8-43f7-ae96-f2ea63e9f90f} - mscoree.dll BHO: {11E9248D-2034-4B3D-B58B-A9FF2ADE5171} - No File BHO: Shopping Assistant Plugin: {1631550f-191d-4826-b069-d9439253d926} - c:\program files\pricegong\2.5.0\PriceGongIE.dll BHO: {18BB8F7A-0289-473D-970E-55B6D3DC8FC0} - No File BHO: {257B5DFE-38EC-4596-AE20-1197BEC1E238} - No File BHO: {4C3F9648-ABBD-4F3A-8C4D-476EDD24CE51} - No File BHO: {4FEB3E56-3DED-4340-9597-45F8C7979212} - No File BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: {5455E891-8814-4D8F-835F-3D65F7A3D2A8} - No File BHO: {56AC91A5-21A0-4169-8A00-DA90D22CBB89} - No File BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\progra~1\yahoo!\common\yiesrvc.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: {5C57F173-E6A9-4F3E-A28D-719D2E207D5C} - No File BHO: {60D97CCB-B33F-4700-A459-84D7E5E8BC1D} - No File BHO: {613B0A32-10DD-43AB-8606-D40C7EA25225} - No File BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: {72a4e634-2b5f-4623-9c5a-1cdf911bc1c1} - No File BHO: {7373D144-6B71-4584-8429-ABB23858AB03} - No File BHO: {77fd6e4c-8167-4c1a-b126-ca77ea4d27ae} - No File BHO: {78297916-E517-47B4-B291-20FAFD328F63} - No File BHO: {7C10071D-D554-4A89-ADC8-F78AFCB24264} - No File BHO: {82EFC2F3-5604-455A-BE7B-A324F78EF9CB} - No File BHO: {855D2F4C-38CE-4637-A8C6-C12E6342947B} - No File BHO: {88B6B972-9436-4F14-84EF-C6C086E44F08} - No File BHO: {8d82bcf9-fff3-46d5-8698-41201224809c} - No File BHO: {8E313305-F619-49AD-AF87-150F1D7BEBA8} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: {917e1ea6-bb22-4072-8a2b-0f38235fb253} - No File BHO: {AE660DE3-3622-46D4-ACEF-471AB1370E0F} - No File BHO: {B0F91A66-6EB8-4247-91D1-3D6C336D031F} - No File BHO: {B6B41949-05D3-42E0-9EAE-98505549C5E6} - No File BHO: {CA8E46C4-CFFC-440F-B002-2F9F63C9D90B} - No File BHO: {CF11B797-70AB-4A7D-A9C8-B322EA19AF01} - No File BHO: {DB46DD90-2F0A-4ECA-9EDB-F129905D476B} - No File BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: {E9964733-3E3E-41A4-BC50-9500E34AFF1F} - No File BHO: SidebarAutoLaunch Class: {f2aa9440-6328-4933-b7c9-a6ccdf9cbf6d} - c:\program files\yahoo!\browser\YSidebarIEBHO.dll BHO: Yontoo Layers: {fd72061e-9fde-484d-a58a-0bab4151cad8} - c:\program files\yontoo layers runtime\YontooIEClient.dll TB: {E0E899AB-F487-11D5-8D29-0050BA6940E3} - No File TB: {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - No File TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll TB: QuickStores-Toolbar: {10edb994-47f8-43f7-ae96-f2ea63e9f90f} - mscoree.dll TB: {b278d9f8-0fa9-465e-9938-0c392605d8e3} - No File TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File TB: {463DF6D5-BEC1-4D67-B217-59DB692DFC53} - No File TB: {1CE4EE89-2D5C-4361-AF3B-D902AB545381} - No File TB: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [igndlm.exe] c:\program files\ign\download manager\DLM.exe /windowsstart /startifwork uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1 uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe uRun: [Steam] "c:\program files\steam\Steam.exe" -silent uRun: [BitTorrent] "c:\program files\bittorrent\bittorrent.exe" –force_start_minimized uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe" uRun: [AutoStartNPSAgent] c:\program files\samsung\samsung new pc studio\NPSAgent.exe uRun: [Google Update] "c:\documents and settings\compaq_owner\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized uRun: [cdloader] "c:\documents and settings\compaq_owner\application data\mjusbsp\cdloader2.exe" MAGICJACK mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [Reminder] "c:\windows\creator\Remind_XP.exe" mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [WinampAgent] c:\program files\winamp\winampa.exe mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [SoundMan] SOUNDMAN.EXE mRun: [AlcWzrd] ALCWZRD.EXE mRun: [Alcmtr] ALCMTR.EXE mRun: [SsAAD.exe] c:\progra~1\sony\sonics~1\SsAAD.exe mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [KBD] c:\hp\kbd\KBD.EXE mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u mRun: [DAEMON Tools] "c:\program files\daemon tools\daemon.exe" -lang 1033 mRun: [iRiver Updater] \Updater.exe mRun: [tsnpstd3] c:\windows\tsnpstd3.exe mRun: [snpstd3] c:\windows\vsnpstd3.exe mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [Computer Alarm Clock] c:\progra~1\comput~1\cac.exe mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [NPSStartup] mRun: [UnlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe" mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [WTClient] WTClient.exe mRun: [Nikon Transfer Monitor] c:\program files\common files\nikon\monitor\NkMonitor.exe mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey mRun: [VTTimer] VTTimer.exe dRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil9f.exe StartupFolder: c:\docume~1\compaq~1\startm~1\programs\startup\compaq~1.lnk - c:\program files\hewlett-packard\compaq organize\bin\displayAgent.exe StartupFolder: c:\docume~1\compaq~1\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\compaq_owner\application data\dropbox\bin\Dropbox.exe StartupFolder: c:\docume~1\compaq~1\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\compaq~1.lnk - c:\program files\compaq connections\6750491\program\Compaq Connections.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe mPolicies-system: EnableLUA = 0 (0x0) IE: Add To Compaq Organize… - c:\progra~1\hewlet~1\compaq~1\bin\core.hp.main\SendTo.html IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000 IE: Save YouTube Video - c:\program files\common files\dvdvideosoft\dll\IEContextMenuY.dll/scriptY2MP4.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mi1933~1\office12\ONBttnIE.dll IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\progra~1\yahoo!\common\yiesrvc.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll Trusted Zone: buddybuddy.co.kr DPF: {04E7BADF-F3B9-420D-B82D-8D8CADEFE4F9} - hxxp://cyimg7.cyworld.nate.com/ImageUpload/CyImageUpload2.cab DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader5.cab DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {1DE9BB01-B121-401D-8877-BCD5ED5B7EE5} - hxxp://www.crezio.com/test/leeyunho/AlwaysOn/AlwaysOn.CAB DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab DPF: {217CA616-08DD-4783-9DE3-9AE02F4EB2D0} - hxxp://dr-clean.co.kr/install/nochk/drclean.cab DPF: {243C3672-9526-40AA-BE22-988F92CFA591} - hxxp://nclean.co.kr/install/nclean.cab DPF: {24A04430-81DA-467A-BE87-774DFAECBBF6} - hxxp://cyimg7.cyworld.nate.com/storyRoom/CyImageResizeCtl.cab DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper20064142.dll DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.1.74.cab DPF: {4C833081-D026-4FF8-968F-7EAB660D2FBA} - hxxp://www.sc2.org/misc/tvants.cab DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab DPF: {5066F781-0BDF-4A28-A7B5-5EF4F7DC6F21} - hxxp://mptop.cyworld.nate.com/activex/CyworldMovieUpload.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1101675432713 DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://go.divx.com/plugin/DivXBrowserPlugin.cab DPF: {68253470-5D4F-4CDF-8D9C-353C14A2F013} - hxxp://221.139.0.179/pandora/SVPorsche.cab DPF: {695D7312-9B91-42E8-8893-75419A2873EC} - hxxp://ftp.entica.com/EnLaunch/SeM/ssunit.cab DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} - hxxp://www.acclaim.com/cabs/acclaim_v5.cab DPF: {6A2E758A-028B-46BB-A11D-0608AB5A4ED3} - hxxp://listen.daum.net/52st/bgmplayer/Daum52stBGMPlayer.cab DPF: {7E9FDB80-5316-11D4-B02C-00C04F0CD404} - hxxp://ebank.keb.co.kr/XecureObject/xw_install.cab DPF: {7FAB8081-EFAA-447B-B64D-8048C6D6914B} - hxxp://kr.traffic.yahoo.com/prop/map/Objects/Sundo_ZaolMapKTClient.1010.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {8DC067B8-911D-473A-90F1-1171B887CDE0} - hxxp://cyimg8.cyworld.com/ImageUpload/CyPictureU1233.cab?20081124 DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - hxxp://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} - hxxp://cafeimg.hanmail.net/cab9_1/dmcc2.cab?Version=1,0,0,10 DPF: {93F79C47-F414-4EEE-95C5-A0F0ACE59A0E} - hxxp://www.altools.co.kr/ALDX.cab DPF: {A00B2A53-60D9-4477-ADA3-60490770C5E0} - hxxp://mail.daum.net/hanmail-ax/hanmail.cab DPF: {A671DC03-71D0-4CF0-895C-7D4A248FC1F1} - hxxp://cyimg7.cyworld.nate.com/cymusic/package/skcbgmset.cab DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - hxxp://www.crucial.com/controls/cpcScanner.cab DPF: {AD906BA4-9679-4A50-94C6-D677526BB92A} - hxxp://cyimg2.cyworld.nate.com/ImageUpload/CyImageUpload.cab DPF: {B005D02C-E461-4851-8A79-C7FDC8563C07} - hxxp://www.buddybuddy.co.kr/cab/BBNPort.cab DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://messenger.zone.msn.com/binary/ZIntro.cab32846.cab DPF: {B976AEC6-BEB2-4B98-B21C-7AB1C2B4E8E9} - hxxp://goalibaba.com/setup/CAXAlibabaA.cab DPF: {B9B38E70-EEF6-4E3A-AE84-DDE59A053B7C} - hxxp://mail.daum.net/hanmail-ax/DaumActiveX/2_0_0_4/DaumActiveX.cab?ver=2,0,0,4 DPF: {BCA935CA-7E41-4F73-BA9C-FAB4393DBAC0} - hxxp://www.csafer.net/ActiveX/MAStreamCtrl.cab DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - hxxp://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab DPF: {D089883E-7AD7-471E-818D-6797966F9A2B} - hxxp://www.zeromovie.com/spy_dr/download/SpyDoctorRun.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {D4B8CB6E-3445-4553-B717-750CEFA98B3E} - hxxp://down.adscan.co.kr/adscan/activex/ADScanInstaller.cab DPF: {D572CD64-9310-4712-8FFC-A4F9DC9D4AC1} - hxxp://qbic.hanafos.com/component/QbicUpdate.CAB DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} - hxxp://update.nprotect.net/keycrypt/keb/npkcx.cab DPF: {D8798B2A-5EB1-424A-AB19-E38CFB69E295} - hxxp://mptop.cyworld.nate.com/activex/CyworldMovieUp.cab DPF: {D885750C-6002-460E-A162-713400FB1FD4} - hxxp://www.goalibaba.com/setup/CActiveXFileCtrl.cab DPF: {D95F5F60-5BB7-4655-BACE-FC5371EFC3E0} - hxxp://update.nprotect.net/nprotect/keb/npx2.cab DPF: {DC4207CE-C03E-4449-ACB1-032CA4137053} - hxxp://update.nprotect.net/nprotect2006/keb/npz.cab DPF: {DDE6FED7-88AB-405B-9D77-FD4CDA8B9EB5} - hxxp://qbic.hanafos.com/component/Qbic.CAB DPF: {E1CDC08F-F464-4682-AE6A-7689451387C0} - hxxp://cafeimg.hanmail.net/activex/dmcm.cab?Version=1,0,0,21 DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} - hxxps://www.vpay.co.kr/kvpfiles/KVPISPCTLD.cab DPF: {F36C3235-C4AF-409F-B6A1-4F96BB1B533E} - hxxp://fs1.us.cyworld.com/common/activex/CyGlobal.cab DPF: {F4A1D5E2-AF49-47A7-A945-23038106F3A4} - hxxp://imgcdn.pandora.tv/pan_img/launcher/codebase/Pandora_SetUpAX.cab DPF: {FCEAE646-DCF9-4D59-B994-6BD30A315139} - hxxp://www.mtv.com/overdrive/bin/MTVNAlerts1.0.exe TCP: DhcpNameServer = [removed] TCP: Interfaces\{5F38C9EC-0C90-4853-B648-502191622CD4} : DhcpNameServer = [removed] Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Handler: spotfire - {0937B384-6404-4E4A-B271-F2DC6B1199FE} - c:\program files\spotfire\packages\spotfire.package.clientruntime_19.1.1518\bin\SfPackageManager.dll Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll LSA: Authentication Packages = msv1_0 c:\windows\system32\cbXNHWqP LSA: Notification Packages = :\windows\system32\srrstr.dll mASetup: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\msnetmtg.inf,NetMtg.Remove.PerUser.NT . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\compaq_owner\application data\mozilla\firefox\profiles\t3dx7xat.default\ FF - prefs.js: browser.search.selectedEngine - Ask FF - prefs.js: browser.startup.homepage - www.google.ca FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13161&gct=&gc=1&q= FF - component: c:\documents and settings\compaq_owner\application data\mozilla\firefox\profiles\t3dx7xat.default\extensions\{8a9386b4-e958-4c4c-adf4-8f26db3e4829}\components\PriceGongFF.dll FF - component: c:\program files\common files\dvdvideosoft\dll\ffcontextmenuy\components\FFContextMenu.dll FF - plugin: c:\documents and settings\compaq_owner\local settings\application data\google\update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: c:\program files\foxit software\foxit reader\plugins\npFoxitReaderPlugin.dll FF - plugin: c:\program files\ign\download manager\npfpdlm.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\rogers online protection\rogers servicepoint agent\nprpspa.dll FF - Ext: QuickStores-Toolbar: [removed] - c:\program files\mozilla firefox\extensions\[removed] FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} FF - Ext: PlayBryte: [removed] - %profile%\extensions\[removed] FF - Ext: Yontoo Layers: [removed] - %profile%\extensions\[removed] FF - Ext: QuickStores-Toolbar: [removed] - %profile%\extensions\[removed] FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} FF - Ext: PriceGong: {8A9386B4-E958-4c4c-ADF4-8F26DB3E4829} - %profile%\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension FF - Ext: Java Quick Starter: [removed] - c:\program files\java\jre6\lib\deploy\jqs\ff . ============= SERVICES / DRIVERS =============== . R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2008-12-4 12872] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-12-4 67656] R2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-6-28 237984] R2 RogersUpdateManager;Rogers Update Manager;c:\program files\rogers\update manager\RogersUpdateManager.exe [2008-4-7 163840] R2 ServicepointService;ServicepointService;c:\program files\rogers online protection\rogers servicepoint agent\ServicepointService.exe [2011-1-30 689464] R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2010-6-28 36608] R3 PTSimBus;PenTablet Bus Enumerator;c:\windows\system32\drivers\PTSimBus.sys [2007-6-7 18944] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 PV8630;USB Scan 600 Device Driver;c:\windows\system32\drivers\PV8630.sys [2005-2-4 20232] S3 cdspacex;cdspacex;c:\windows\system32\drivers\cdspacex.sys –> c:\windows\system32\drivers\CDSPACEX.sys [?] S3 cpuz132;cpuz132;\??\c:\docume~1\compaq~1\locals~1\temp\cpuz132\cpuz132_x32.sys –> c:\docume~1\compaq~1\locals~1\temp\cpuz132\cpuz132_x32.sys [?] S3 PTSimHid;PenTablet Simulated HID MiniDriver;c:\windows\system32\drivers\PTSimHid.sys [2007-4-23 10752] S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2008-12-4 12872] S3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\drivers\sscebus.sys [2010-6-28 90240] S3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\drivers\sscemdfl.sys [2010-6-28 14976] S3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\drivers\sscemdm.sys [2010-6-28 121856] S3 TwoRabts;Two Rabbits Live Bus;c:\windows\system32\drivers\tworabts.sys –> c:\windows\system32\drivers\TwoRabts.sys [?] S3 vaxscsi;vaxscsi;c:\windows\system32\drivers\vaxscsi.sys [2006-3-18 223128] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] . =============== Created Last 30 ================ . 2012-04-19 00:15:41 6734704 —-a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{4fe603c0-39cf-4ee6-ad27-938fe981ac53}\mpengine.dll 2012-04-10 03:30:06 ——– d—–w- C:\sh4ldr 2012-04-10 03:30:06 ——– d—–w- c:\program files\Enigma Software Group 2012-04-10 03:28:55 ——– d—–w- c:\windows\4E0C6314A8B84026AC15084E8B63AFB5.TMP 2012-04-09 23:49:30 6582328 —-a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll 2012-04-08 23:04:34 237072 ——w- c:\windows\system32\MpSigStub.exe 2012-04-08 22:51:29 ——– d—–w- c:\program files\Microsoft Security Client 2012-03-28 03:49:16 ——– d—–w- c:\program files\HitmanPro 2012-03-28 03:49:16 ——– d—–w- c:\documents and settings\all users\application data\HitmanPro . ==================== Find3M ==================== . 2012-04-19 00:44:43 4143 —-a-w- c:\windows\viassary-hp.reg 2012-04-04 19:56:40 22344 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-03-01 11:01:32 916992 —-a-w- c:\windows\system32\wininet.dll 2012-03-01 11:01:32 43520 —-a-w- c:\windows\system32\licmgr10.dll 2012-03-01 11:01:32 1469440 ——w- c:\windows\system32\inetcpl.cpl 2012-02-29 14:10:16 177664 —-a-w- c:\windows\system32\wintrust.dll 2012-02-29 14:10:16 148480 —-a-w- c:\windows\system32\imagehlp.dll 2012-02-29 12:17:40 385024 —-a-w- c:\windows\system32\html.iec 2012-02-07 15:02:40 1070352 —-a-w- c:\windows\system32\MSCOMCTL.OCX 2012-02-03 09:22:18 1860096 —-a-w- c:\windows\system32\win32k.sys . ============= FINISH: 20:48:38.82 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows XP Home Edition Boot Device: \Device\HarddiskVolume2 Install Date: 2004-11-28 오후 3:54:02 System Uptime: 2012-04-18 오후 8:00:25 (0 hours ago) . Motherboard: ASUSTeK Computer INC. | | Grouper Processor: Intel® Pentium® 4 CPU 2.93GHz | CPU 1 | 2932/133mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 144 GiB total, 17.148 GiB free. D: is FIXED (FAT32) - 5 GiB total, 0.221 GiB free. E: is CDROM (UDF) F: is CDROM (CDFS) G: is CDROM () H: is Removable I: is Removable J: is Removable K: is Removable L: is Removable . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP1677: 2012-03-08 오후 10:00:47 - System Checkpoint RP1678: 2012-03-09 오후 11:29:17 - System Checkpoint RP1679: 2012-03-11 오전 3:51:11 - System Checkpoint RP1680: 2012-03-14 오전 4:23:33 - Software Distribution Service 3.0 RP1681: 2012-03-15 오후 10:15:30 - System Checkpoint RP1682: 2012-03-18 오후 12:39:13 - System Checkpoint RP1683: 2012-03-18 오후 10:31:57 - Removed Supreme Commander ™ RP1684: 2012-03-20 오전 1:05:26 - System Checkpoint RP1685: 2012-03-21 오후 11:00:54 - System Checkpoint RP1686: 2012-03-23 오전 11:56:36 - System Checkpoint RP1687: 2012-03-24 오후 12:12:36 - System Checkpoint RP1688: 2012-03-26 오후 1:47:54 - System Checkpoint RP1689: 2012-03-28 오전 4:29:46 - System Checkpoint RP1690: 2012-03-31 오후 6:09:57 - System Checkpoint RP1691: 2012-04-01 오후 6:53:18 - System Checkpoint RP1692: 2012-04-03 오전 4:47:34 - System Checkpoint RP1693: 2012-04-04 오전 11:52:56 - System Checkpoint RP1695: 2012-04-05 오후 11:39:33 - System Checkpoint RP1696: 2012-04-07 오전 11:18:07 - System Checkpoint RP1697: 2012-04-08 오후 4:47:26 - System Checkpoint RP1698: 2012-04-08 오후 7:04:34 - Software Distribution Service 3.0 RP1699: 2012-04-09 오후 7:48:53 - Software Distribution Service 3.0 RP1700: 2012-04-09 오후 11:30:05 - Installed SpyHunter RP1701: 2012-04-09 오후 11:35:39 - Removed SpyHunter RP1702: 2012-04-11 오전 9:57:21 - Software Distribution Service 3.0 RP1703: 2012-04-11 오후 11:31:04 - Software Distribution Service 3.0 RP1704: 2012-04-12 오후 5:21:28 - Software Distribution Service 3.0 RP1705: 2012-04-13 오후 8:47:01 - Software Distribution Service 3.0 RP1706: 2012-04-15 오전 8:44:26 - Software Distribution Service 3.0 RP1707: 2012-04-16 오전 9:11:06 - Software Distribution Service 3.0 RP1708: 2012-04-17 오후 8:08:58 - Software Distribution Service 3.0 RP1709: 2012-04-18 오후 8:14:50 - Software Distribution Service 3.0 . ==== Installed Programs ====================== . 32 Bit HP CIO Components Installer 7-Zip 4.65 AA2Deploy AA3Deploy Absolute Sound Recorder version 3.3.2 Absolute Video Splitter Joiner 1.5.2 Adobe Download Manager Adobe Download Manager 2.0 (Remove Only) Adobe Flash Player 10 Plugin Adobe Flash Player ActiveX Adobe Reader 7.0.5 Adobe Reader 7.0.5 Language Support Adobe Reader 7.0.8 Adobe® Photoshop® Album Starter Edition 3.0 AGEIA PhysX v7.05.17 Agere Systems PCI Soft Modem AiO_Scan AiOSoftware ALZip Apple Software Update Ask Toolbar AutoUpdate AV Voice Changer Software DIAMOND 4.0 Bink and Smacker BitTorrent 5.0.9 BufferChm Camera Support Core Library Camera Window DS Camera Window DVC Camera Window MC Canon Camera Support Core Library Canon Camera Window DS for ZoomBrowser EX Canon Camera Window DVC for ZoomBrowser EX Canon Camera Window for ZoomBrowser EX Canon MovieEdit Task for ZoomBrowser EX Canon PhotoRecord Canon RAW Image Task for ZoomBrowser EX Canon RemoteCapture Task for ZoomBrowser EX Canon Utilities PhotoStitch 3.1 Canon ZoomBrowser EX CCleaner ChemAxon Marvin Beans 5.8.0 Cluster 3.0 Collab Combined Community Codec Pack 2006-12-15 ComicRack v0.9.113 Compaq Connections Compaq Organize Computer Alarm Clock Copy CoreVorbis Audio Decoder (remove only) CreativeProjects CreativeProjectsTemplates Critical Update for Windows Media Player 11 (KB959772) CueTour CustomerResearchQFolder Cytoscape 2.8.1 Cytoscape 2.8.2 Daum ActiveX AAÆ®·N - ??? ????? Default Destination Component DeviceDiscovery DeviceManagementQFolder DivX Codec DivX Content Uploader DivX Converter DivX Player DivX Web Player DJ_AIO_ProductContext DJ_AIO_Software DJ_AIO_Software_min DJ_SF_03_D4300_ProductContext DJ_SF_03_D4300_Software DJ_SF_03_D4300_Software_Min DocProc DocumentViewer Download Manager 2.3.6 Driver Whiz Dropbox Easy Internet Sign-up EAX4 Unified Redist EndNote X4 Enhanced Multimedia Keyboard Solution EVEREST Home Edition v1.51 F4100 F4100_Help Fax FBX Plugin 2009.0 for Max 2009 File Uploader FL Studio 5 FolderPlus Browser 4.6 Foxit Reader 5.1 Free Natural Text to Speech Reader 2007 Free PDF to Word Doc Converter v1.1 Free YouTube Download 2.3 Free YouTube to Mp3 Converter version 3.1 FunVideoCards- Beautiful Sunsets Screensaver GameSpy Arcade GdiplusUpgrade GOM Player Google Chrome Google Video Player GPBaseService GTK+ 2.4.14 runtime environment HanmailUpload Help and Support Additions High Definition Audio Driver Package - KB835221 HitmanPro 3.6 Honey View2 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB2158563) Hotfix for Windows XP (KB2443685) Hotfix for Windows XP (KB2570791) Hotfix for Windows XP (KB2633952) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976098-v2) Hotfix for Windows XP (KB979306) Hotfix for Windows XP (KB981793) HP Customer Participation Program 8.0 HP Deskjet All-In-One Software 8.0 HP Deskjet D4300 Printer Driver Software 10.0 Rel .3 HP Image Zone 4.2 HP Imaging Device Functions 8.0 HP Photosmart Essential HP Print Diagnostic Utility HP PSC & OfficeJet 4.2 HP Solution Center 8.0 HP Unload DLL Patch HP Update HPODiscovery HPProductAssistant HpSdpAppCoreApp HPSSupply HPSystemDiagnostics IGN Download Manager 2.1.1 InstantShare Intel® Graphics Media Accelerator Driver IntelliMover Data Transfer Demo InterActual Player InterVideo WinDVD Player iriver Music Manager iRiver Updater iTunes Java 2 Runtime Environment, SE v1.4.2_03 Java Auto Updater Java™ 6 Update 26 JChem .NET API 5.8.0.430 Junk Mail filter update LaTeX Macros 1.09.2 Macromedia Shockwave Player Magic ISO Maker v5.5 (build 0281) magicJack Malwarebytes Anti-Malware version 1.61.0.1400 Managed DirectX (0901) Manga Studio Debut 4.0 MarketResearch MegaTrainer eXperience V1.0.5.7 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB2656353) Microsoft .NET Framework 1.1 Security Update (KB2656370) Microsoft .NET Framework 1.1 Security Update (KB979906) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft ActiveSync Microsoft Antimalware Microsoft Application Error Reporting Microsoft AppLocale Microsoft Choice Guard Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft National Language Support Downlevel APIs Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Web Components Microsoft Office Word MUI (English) 2007 Microsoft Plus! Digital Media Edition Installer Microsoft Plus! Photo Story 2 LE Microsoft Reader Microsoft Reader Text-to-Speech for English Microsoft Security Client Microsoft Security Essentials Microsoft Silverlight Microsoft Software Update for Web Folders (English) 12 Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 Microsoft Windows Application Compatibility Database Microsoft Works 7.0 Microsoft WSE 3.0 Runtime MINITAB 14 Student MovieEdit Task Mozilla Firefox (3.6.16) MSN MSN Music Assistant MSVCRT MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 4.0 SP2 Parser and SDK MSXML 6 Service Pack 2 (KB973686) MySQL Workbench 5.2 CE Nikon Message Center Nikon Transfer nProtect KeyCrypt nProtect Netizen Ver.3(remove only) nProtect Netizen(remove only) NVIDIA Display Control Panel NVIDIA Drivers NVIDIA nView Desktop Manager Ontologizer OpenMG Limited Patch 4.1-05-13-31-01 OpenMG Secure Module 4.1.00 Overland PC-Doctor for Windows PC Camera-168 PC Connectivity Solution PDFTOEXCEL PhotoGallery PhotoStitch Power Tab Editor 1.7 Power Video Converter 1.5.49 PriceGong 2.5.0 PrimoPDF PrimoPDF Redistribution Package PrintScreen Protege 4.2 alpha Proxy Changer PS2 PunkBuster Services Python 2.2 combined Win32 extensions Python 2.2.1 Q-Xpress Installer 1.1.9 QFolder QuickProjects QuickStores-Toolbar 1.1.0 QuickTime R for Windows 2.10.1 RAW Image Task Readme RealPlayer RemoteCapture Task 1.1 ResearchSoft Direct Export Helper Rogers Servicepoint Agent 3.7.44 Rogers Update Manager Rogers Yahoo! Applications RPS CRT SA31xx Device Manager & Media Converter SAMSUNG Mobile Composite Device Software Samsung Mobile Modem Device Software SAMSUNG Mobile Modem Driver Set SAMSUNG Mobile Modem V2 Software Samsung Mobile phone USB driver Software SAMSUNG Mobile USB Download Driver Software SAMSUNG Mobile USB Driver SAMSUNG Mobile USB Modem 1.0 Software Samsung Mobile USB Modem Device Software SAMSUNG Mobile USB Modem Software Samsung New PC Studio SAMSUNG SYMBIAN USB Download Driver SAMSUNG USB Mobile Device Software SamsungConnectivityCableDriver Scan Search Plugin Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition Security Update for Microsoft Windows (KB2564958) Security Update for Step By Step Interactive Training (KB898458) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 8 (KB2183461) Security Update for Windows Internet Explorer 8 (KB2360131) Security Update for Windows Internet Explorer 8 (KB2482017) Security Update for Windows Internet Explorer 8 (KB2497640) Security Update for Windows Internet Explorer 8 (KB2510531) Security Update for Windows Internet Explorer 8 (KB2530548) Security Update for Windows Internet Explorer 8 (KB2544521) Security Update for Windows Internet Explorer 8 (KB2559049) Security Update for Windows Internet Explorer 8 (KB2586448) Security Update for Windows Internet Explorer 8 (KB2618444) Security Update for Windows Internet Explorer 8 (KB2647516) Security Update for Windows Internet Explorer 8 (KB2675157) Security Update for Windows Internet Explorer 8 (KB971961) Security Update for Windows Internet Explorer 8 (KB981332) Security Update for Windows Internet Explorer 8 (KB982381) Security Update for Windows Media Player (KB2378111) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player (KB975558) Security Update for Windows Media Player (KB978695) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 10 (KB936782) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB2079403) Security Update for Windows XP (KB2121546) Security Update for Windows XP (KB2160329) Security Update for Windows XP (KB2183461) Security Update for Windows XP (KB2229593) Security Update for Windows XP (KB2259922) Security Update for Windows XP (KB2279986) Security Update for Windows XP (KB2286198) Security Update for Windows XP (KB2296011) Security Update for Windows XP (KB2347290) Security Update for Windows XP (KB2360937) Security Update for Windows XP (KB2387149) Security Update for Windows XP (KB2393802) Security Update for Windows XP (KB2412687) Security Update for Windows XP (KB2419632) Security Update for Windows XP (KB2423089) Security Update for Windows XP (KB2440591) Security Update for Windows XP (KB2443105) Security Update for Windows XP (KB2476490) Security Update for Windows XP (KB2476687) Security Update for Windows XP (KB2478960) Security Update for Windows XP (KB2478971) Security Update for Windows XP (KB2479628) Security Update for Windows XP (KB2479943) Security Update for Windows XP (KB2481109) Security Update for Windows XP (KB2483185) Security Update for Windows XP (KB2485376) Security Update for Windows XP (KB2485663) Security Update for Windows XP (KB2491683) Security Update for Windows XP (KB2503658) Security Update for Windows XP (KB2503665) Security Update for Windows XP (KB2506212) Security Update for Windows XP (KB2506223) Security Update for Windows XP (KB2507618) Security Update for Windows XP (KB2507938) Security Update for Windows XP (KB2508272) Security Update for Windows XP (KB2508429) Security Update for Windows XP (KB2509553) Security Update for Windows XP (KB2511455) Security Update for Windows XP (KB2524375) Security Update for Windows XP (KB2535512) Security Update for Windows XP (KB2536276-v2) Security Update for Windows XP (KB2536276) Security Update for Windows XP (KB2544893-v2) Security Update for Windows XP (KB2544893) Security Update for Windows XP (KB2555917) Security Update for Windows XP (KB2562937) Security Update for Windows XP (KB2566454) Security Update for Windows XP (KB2567053) Security Update for Windows XP (KB2567680) Security Update for Windows XP (KB2570222) Security Update for Windows XP (KB2570947) Security Update for Windows XP (KB2584146) Security Update for Windows XP (KB2585542) Security Update for Windows XP (KB2592799) Security Update for Windows XP (KB2598479) Security Update for Windows XP (KB2603381) Security Update for Windows XP (KB2618451) Security Update for Windows XP (KB2619339) Security Update for Windows XP (KB2620712) Security Update for Windows XP (KB2621440) Security Update for Windows XP (KB2624667) Security Update for Windows XP (KB2631813) Security Update for Windows XP (KB2633171) Security Update for Windows XP (KB2639417) Security Update for Windows XP (KB2641653) Security Update for Windows XP (KB2646524) Security Update for Windows XP (KB2647518) Security Update for Windows XP (KB2653956) Security Update for Windows XP (KB2660465) Security Update for Windows XP (KB2661637) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971468) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975561) Security Update for Windows XP (KB975562) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB977165) Security Update for Windows XP (KB977816) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978037) Security Update for Windows XP (KB978251) Security Update for Windows XP (KB978262) Security Update for Windows XP (KB978338) Security Update for Windows XP (KB978542) Security Update for Windows XP (KB978601) Security Update for Windows XP (KB978706) Security Update for Windows XP (KB979309) Security Update for Windows XP (KB979482) Security Update for Windows XP (KB979559) Security Update for Windows XP (KB979683) Security Update for Windows XP (KB979687) Security Update for Windows XP (KB980195) Security Update for Windows XP (KB980218) Security Update for Windows XP (KB980232) Security Update for Windows XP (KB980436) Security Update for Windows XP (KB981322) Security Update for Windows XP (KB981349) Security Update for Windows XP (KB981852) Security Update for Windows XP (KB981957) Security Update for Windows XP (KB981997) Security Update for Windows XP (KB982132) Security Update for Windows XP (KB982214) Security Update for Windows XP (KB982381) Security Update for Windows XP (KB982665) Security Update for Windows XP (KB982802) Segoe UI Shop for HP Supplies SkinsHP1 Skype?5.5 SmartFTP Client SolutionCenter Sonic RecordNow! SonicStage 3.0 Sound Effect Maker version 1.2 Spotfire DecisionSite Client Spybot - Search & Destroy Starcraft StarCraft II Beta Status Steam SUPERAntiSpyware Free Edition SWAT 4 Gold Swat Downloader System Requirements Lab TeamSpeak 2 RC2 TEFView 2.62 TextPad 5 The GIMP 2.2.1 Toolbox TrayApp TVAnts ActiveX Control 1.0 Uninstall 1.0.0.1 Unload UnloadSupport Unlocker 1.9.0 Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2598306) 32-Bit Edition Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition Update for Windows Internet Explorer 8 (KB976662) Update for Windows Internet Explorer 8 (KB982632) Update for Windows Internet Explorer 8 (KB982664) Update for Windows XP (KB2141007) Update for Windows XP (KB2345886) Update for Windows XP (KB2541763) Update for Windows XP (KB2607712) Update for Windows XP (KB2616676) Update for Windows XP (KB2641690) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB955839) Update for Windows XP (KB961503) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971029) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) Vampire: The Masquerade - Bloodlines Ventrilo Client VirtualCom driver VLC media player 0.9.8a VtMB - ClanQuest 2.1 WebFldrs XP WebReg Winamp (remove only) Windows Driver Package - MobileTop (sshpmdm) Modem (01/26/2008 2.6.0.0) Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0) Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage Validation Tool (KB892130) Windows Imaging Component Windows Internet Explorer 7 Windows Internet Explorer 8 Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Mail Windows Live Messenger Windows Live Sign-in Assistant Windows Live Upload Tool Windows Media Format 11 runtime Windows Media Player 11 Windows Vista Upgrade Advisor Windows XP Service Pack 3 WinRAR archiver WinX Free AVI to WMV Converter 4.0.9 WinZip XecureWeb Control Xfire (remove only) Yahoo! Toolbar Yontoo Layers Runtime 1.10.01 . ==== Event Viewer Messages From Past Week ======== . 2012-04-18 오후 8:03:30, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting. 2012-04-18 오후 8:02:03, error: Service Control Manager [7000] - The USB Scan 600 Device Driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 2012-04-18 오후 6:22:49, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting. 2012-04-18 오후 6:21:09, error: Service Control Manager [7000] - The USB Scan 600 Device Driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 2012-04-18 오전 8:33:19, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting. 2012-04-18 오전 8:31:41, error: Service Control Manager [7000] - The USB Scan 600 Device Driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 2012-04-17 오후 7:59:31, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting. 2012-04-17 오후 7:57:52, error: Service Control Manager [7000] - The USB Scan 600 Device Driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 2012-04-17 오전 8:27:57, error: Service Control Manager [7022] - The Rogers Update Manager service hung on starting. 2012-04-17 오전 8:27:57, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting. 2012-04-17 오전 8:26:15, error: Service Control Manager [7000] - The USB Scan 600 Device Driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 2012-04-16 오후 6:56:57, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting. 2012-04-16 오후 6:55:19, error: Service Control Manager [7000] - The USB Scan 600 Device Driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 2012-04-16 오전 9:03:14, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting. 2012-04-16 오전 9:01:34, error: Service Control Manager [7000] - The USB Scan 600 Device Driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 2012-04-15 오전 8:35:36, error: Service Control Manager [7022] - The Rogers Update Manager service hung on starting. 2012-04-15 오전 8:35:35, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting. 2012-04-15 오전 8:33:55, error: Service Control Manager [7000] - The USB Scan 600 Device Driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 2012-04-14 오전 9:23:03, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting. 2012-04-14 오전 9:21:22, error: Service Control Manager [7000] - The USB Scan 600 Device Driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 2012-04-13 오후 8:39:14, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting. 2012-04-13 오후 8:37:35, error: Service Control Manager [7000] - The USB Scan 600 Device Driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 2012-04-13 오전 8:48:00, error: Service Control Manager [7022] - The Rogers Update Manager service hung on starting. 2012-04-13 오전 8:48:00, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting. 2012-04-13 오전 8:46:15, error: Service Control Manager [7000] - The USB Scan 600 Device Driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 2012-04-12 오후 5:13:17, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting. 2012-04-12 오후 5:11:37, error: Service Control Manager [7000] - The USB Scan 600 Device Driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 2012-04-12 오전 6:13:07, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting. 2012-04-12 오전 6:11:21, error: Service Control Manager [7000] - The USB Scan 600 Device Driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 2012-04-11 오전 9:47:22, error: Service Control Manager [7022] - The Rogers Update Manager service hung on starting. 2012-04-11 오전 9:47:20, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting. 2012-04-11 오전 9:45:39, error: Service Control Manager [7000] - The USB Scan 600 Device Driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. . ==== End Of File =========================== aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-04-18 20:52:21 —————————– 20:52:21.015 OS Version: Windows 5.1.2600 Service Pack 3 20:52:21.015 Number of processors: 1 586 0x304 20:52:21.015 ComputerName: YOUR-7008FFA13B UserName: Compaq_Owner 20:52:21.656 Initialize success 20:53:47.859 AVAST engine defs: 12041802 20:53:56.515 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-17 20:53:56.515 Disk 0 Vendor: ST3160023AS 3.20 Size: 152627MB BusType: 3 20:53:56.546 Disk 0 MBR read successfully 20:53:56.546 Disk 0 MBR scan 20:53:56.593 Disk 0 unknown MBR code 20:53:56.609 Disk 0 Partition 1 00 0B FAT32 RECOVERY 4776 MB offset 63 20:53:56.625 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 147840 MB offset 9782640 20:53:56.640 Disk 0 scanning sectors +312560640 20:53:56.703 Disk 0 scanning C:\WINDOWS\system32\drivers 20:54:09.921 Service scanning 20:54:26.921 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32 20:54:28.281 Service Tablet2k C:\WINDOWS\"%SystemRoot%\System32\Drivers\Tablet2k.sys" **LOCKED** 123 20:54:32.468 Modules scanning 20:54:59.656 Disk 0 trace - called modules: 20:54:59.671 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys sptd.sys hal.dll >>UNKNOWN [0x8a9797ac]<< 20:54:59.687 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a8d2ab8] 20:54:59.687 3 CLASSPNP.SYS[f7637fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-17[0x8a878b00] 20:55:00.265 AVAST engine scan C:\WINDOWS 20:55:10.765 AVAST engine scan C:\WINDOWS\system32 21:00:40.796 AVAST engine scan C:\WINDOWS\system32\drivers 21:01:09.531 AVAST engine scan C:\Documents and Settings\Compaq_Owner 21:47:31.937 AVAST engine scan C:\Documents and Settings\All Users 22:02:25.578 Scan finished successfully 22:03:42.875 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Compaq_Owner\Desktop\Tech\First Scan\MBR.dat" 22:03:42.890 The log file has been saved successfully to "C:\Documents and Settings\Compaq_Owner\Desktop\Tech\First Scan\aswMBR.txt" Can I re-enable the antivirus programs that I deactivated for the scanning above? Thank you for your time, Foxx

Thanks for the logs.

P2P - I see you have P2P software, (BitTorrent), installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infection. If your computer is infected, it almost certainly contributed to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are more often than not, infected. The bad guys use P2P file-sharing as a major conduit to spread their wares.

Please see this topic for more information:

Perils of P2P File Sharing.

I would strongly recommend that you uninstall it now. You can do so via Start, Settings, Control Panel, Add or Remove Programs

======================================================

Ask Toolbar

Uninstall Ask Toolbar if it was not installed on purpose.

See here for more info.

If you choose to follow my recommendation then please uninstall the following programs if present:

Ask Toolbar or anything related to Ask

======================================================

Run Security Check

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

======================================================

Run TDSSKiller

Please download TDSSKiller.zip

• extract it to your desktop
• double click TDSSKiller.exe
• press Start Scan
  
  • only if Malicious objects are found then ensure Cure is selected. Do not change it to Delete or Quarantine as it may delete infected files that are required for Windows to operate properly.
  • then click Continue > Reboot now
• copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\) called TDSSKiller_*** (*** denotes version & date)

======================================================

Download and run ComboFix

Download ComboFix from the following location:

Link

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
• see this Link for programs that need to be disabled and instruction on how to disable them.
• remember to re-enable them when we're done.
• double click on ComboFix.exe & follow the prompts.
  
• as part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue its malware removal procedures.
  
  

  [external image: Posted Image]

  
  Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
  

  [external image: Posted Image]

  
  Click on Yes, to continue scanning for malware.

Note: Do not mouse-click combofix's window while it is running. That may cause it to stall.

When finished, it will produce a log. Please include the ComboFix.txt in your next reply. It can be found at C:\ComboFix.txt

Please also remember to include the TDSSKiller and checkup.txt logs

Thanks

Satchfan

Hi,

The Security Check and TDSSKiller went smoothly, but the ComboFix had some issues (I disabled all antivirus programs, except for SuperAntiSpyware because it's the free edition and does not have real-time protection to begin with).

It proceeded to scanning my computer automatically and reached the "Stage 50", then my computer shutdown and restarted automatically.
Upon restart, I got the following error message from Microsoft, prompting that "The system has recovered from a serious error":

Error Signature:
BCCode : 19 BCP1 : 00000020 BCP2 : 894F0888 BCP3 : 894F0CA0
BCP4 : 1A830001 OSVer : 5_1_2600 SP : 3_0 Product : 768_1

Error Report Contents:
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\WER0a50.dir00\Mini042012-01.dmp
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\WER0a50.dir00\sysdata.xml

I sent the error report, and it showed me the cause of this crash:

Stop (blue screen) error caused by a device or driver
You received this message because a hardware device, its driver, or related software has caused a stop error, also called a blue screen error. This type of error means the computer has shut down abruptly to protect itself from potential data corruption or loss. In this case, we were unable to detect the specific device or driver that caused the problem. The following troubleshooting steps might prevent the stop error from recurring. Try them in the order given. If one step does not solve the problem, then move on to the next one.

More information at: http://wer.microsoft.com/responses/Respons…a9-68d939a03cf7


Below are the logs from the former two:

Results of screen317's Security Check version 0.99.32
Windows XP Service Pack 3 x86 (UAC is disabled!)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Microsoft Security Essentials
```````````````````````````````
Anti-malware/Other Utilities Check:
Spybot - Search & Destroy
SUPERAntiSpyware Free Edition
CCleaner
Java™ 6 Update 26
Java 2 Runtime Environment, SE v1.4.2_03
Java version out of date!
Adobe Flash Player 10.1.53.64 Flash Player out of Date!
Mozilla Firefox (3.6.16) Firefox out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Microsoft Security Essentials msseces.exe
Microsoft Security Client Antimalware MsMpEng.exe
Rogers Online Protection Rogers Servicepoint Agent ServicepointService.exe
``````````End of Log````````````









21:46:14.0468 3428 TDSS rootkit removing tool 2.7.29.0 Apr 18 2012 16:44:20
21:46:16.0484 3428 ============================================================
21:46:16.0484 3428 Current date / time: 2012/04/19 21:46:16.0484
21:46:16.0484 3428 SystemInfo:
21:46:16.0484 3428
21:46:16.0484 3428 OS Version: 5.1.2600 ServicePack: 3.0
21:46:16.0484 3428 Product type: Workstation
21:46:16.0484 3428 ComputerName: YOUR-7008FFA13B
21:46:16.0484 3428 UserName: Compaq_Owner
21:46:16.0484 3428 Windows directory: C:\WINDOWS
21:46:16.0484 3428 System windows directory: C:\WINDOWS
21:46:16.0484 3428 Processor architecture: Intel x86
21:46:16.0484 3428 Number of processors: 1
21:46:16.0484 3428 Page size: 0x1000
21:46:16.0484 3428 Boot type: Normal boot
21:46:16.0484 3428 ============================================================
21:46:19.0312 3428 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x50C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000054
21:46:19.0531 3428 Drive \Device\Harddisk5\DR7 - Size: 0x1DE000000 (7.47 Gb), SectorSize: 0x200, Cylinders: 0x3CE, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
21:46:19.0531 3428 \Device\Harddisk0\DR0:
21:46:19.0531 3428 MBR partitions:
21:46:19.0531 3428 \Device\Harddisk0\DR0\Partition0: MBR, Type 0xB, StartLBA 0x3F, BlocksNum 0x954531
21:46:19.0531 3428 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x954570, BlocksNum 0x120C0690
21:46:19.0531 3428 \Device\Harddisk5\DR7:
21:46:19.0546 3428 MBR partitions:
21:46:19.0546 3428 \Device\Harddisk5\DR7\Partition0: MBR, Type 0xC, StartLBA 0x8C8, BlocksNum 0xEEF738
21:46:19.0578 3428 C: <-> \Device\Harddisk0\DR0\Partition1
21:46:19.0578 3428 D: <-> \Device\Harddisk0\DR0\Partition0
21:46:19.0578 3428 Initialize success
21:46:19.0578 3428 ============================================================
21:47:36.0984 1448 ============================================================
21:47:36.0984 1448 Scan started
21:47:36.0984 1448 Mode: Manual;
21:47:36.0984 1448 ============================================================
21:47:37.0234 1448 61883 (914a9709fc3bf419ad2f85547f2a4832) C:\WINDOWS\system32\DRIVERS\61883.sys
21:47:37.0234 1448 61883 - ok
21:47:37.0265 1448 Abiosdsk - ok
21:47:37.0296 1448 abp480n5 - ok
21:47:37.0343 1448 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
21:47:37.0343 1448 ACPI - ok
21:47:37.0390 1448 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
21:47:37.0390 1448 ACPIEC - ok
21:47:37.0421 1448 adpu160m - ok
21:47:37.0468 1448 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
21:47:37.0484 1448 aec - ok
21:47:37.0546 1448 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
21:47:37.0546 1448 AFD - ok
21:47:37.0640 1448 AgereSoftModem (029e01cb2938bec5af31bf47b6af0159) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
21:47:37.0671 1448 AgereSoftModem - ok
21:47:37.0703 1448 Aha154x - ok
21:47:37.0734 1448 aic78u2 - ok
21:47:37.0765 1448 aic78xx - ok
21:47:37.0812 1448 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll
21:47:37.0843 1448 Alerter - ok
21:47:37.0890 1448 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe
21:47:37.0890 1448 ALG - ok
21:47:37.0921 1448 AliIde - ok
21:47:37.0968 1448 AmdK7 (8fce268cdbdd83b23419d1f35f42c7b1) C:\WINDOWS\system32\DRIVERS\amdk7.sys
21:47:37.0968 1448 AmdK7 - ok
21:47:38.0000 1448 amsint - ok
21:47:38.0031 1448 AppMgmt - ok
21:47:38.0078 1448 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
21:47:38.0078 1448 Arp1394 - ok
21:47:38.0109 1448 asc - ok
21:47:38.0140 1448 asc3350p - ok
21:47:38.0171 1448 asc3550 - ok
21:47:38.0281 1448 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
21:47:38.0312 1448 aspnet_state - ok
21:47:38.0359 1448 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
21:47:38.0359 1448 AsyncMac - ok
21:47:38.0406 1448 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
21:47:38.0406 1448 atapi - ok
21:47:38.0437 1448 Atdisk - ok
21:47:38.0500 1448 atksgt (f0d933b42cd0594048e4d5200ae9e417) C:\WINDOWS\system32\DRIVERS\atksgt.sys
21:47:38.0500 1448 atksgt - ok
21:47:38.0546 1448 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
21:47:38.0562 1448 Atmarpc - ok
21:47:38.0609 1448 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll
21:47:38.0609 1448 AudioSrv - ok
21:47:38.0640 1448 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
21:47:38.0640 1448 audstub - ok
21:47:38.0687 1448 Avc (f8e6956a614f15a0860474c5e2a7de6b) C:\WINDOWS\system32\DRIVERS\avc.sys
21:47:38.0687 1448 Avc - ok
21:47:38.0734 1448 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
21:47:38.0734 1448 Beep - ok
21:47:38.0796 1448 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll
21:47:39.0000 1448 BITS - ok
21:47:39.0125 1448 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll
21:47:39.0125 1448 Browser - ok
21:47:39.0203 1448 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
21:47:39.0203 1448 cbidf2k - ok
21:47:39.0250 1448 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
21:47:39.0250 1448 CCDECODE - ok
21:47:39.0281 1448 cd20xrnt - ok
21:47:39.0328 1448 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
21:47:39.0328 1448 Cdaudio - ok
21:47:39.0359 1448 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
21:47:39.0359 1448 Cdfs - ok
21:47:39.0406 1448 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
21:47:39.0406 1448 Cdrom - ok
21:47:39.0437 1448 cdspacex - ok
21:47:39.0468 1448 Changer - ok
21:47:39.0515 1448 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe
21:47:39.0515 1448 CiSvc - ok
21:47:39.0562 1448 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe
21:47:39.0562 1448 ClipSrv - ok
21:47:39.0656 1448 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:47:39.0718 1448 clr_optimization_v2.0.50727_32 - ok
21:47:39.0812 1448 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:47:39.0812 1448 clr_optimization_v4.0.30319_32 - ok
21:47:39.0906 1448 CmdIde - ok
21:47:39.0953 1448 COMSysApp - ok
21:47:40.0000 1448 Cpqarray - ok
21:47:40.0109 1448 cpuz132 - ok
21:47:40.0171 1448 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll
21:47:40.0171 1448 CryptSvc - ok
21:47:40.0234 1448 dac2w2k - ok
21:47:40.0265 1448 dac960nt - ok
21:47:40.0328 1448 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll
21:47:40.0328 1448 DcomLaunch - ok
21:47:40.0390 1448 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll
21:47:40.0390 1448 Dhcp - ok
21:47:40.0421 1448 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
21:47:40.0437 1448 Disk - ok
21:47:40.0453 1448 dmadmin - ok
21:47:40.0515 1448 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
21:47:40.0546 1448 dmboot - ok
21:47:40.0593 1448 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
21:47:40.0593 1448 dmio - ok
21:47:40.0656 1448 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
21:47:40.0656 1448 dmload - ok
21:47:40.0703 1448 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll
21:47:40.0703 1448 dmserver - ok
21:47:40.0796 1448 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
21:47:40.0796 1448 DMusic - ok
21:47:40.0859 1448 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll
21:47:40.0859 1448 Dnscache - ok
21:47:40.0921 1448 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll
21:47:40.0921 1448 Dot3svc - ok
21:47:40.0968 1448 dpti2o - ok
21:47:41.0031 1448 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
21:47:41.0031 1448 drmkaud - ok
21:47:41.0062 1448 dtscsi - ok
21:47:41.0125 1448 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll
21:47:41.0125 1448 EapHost - ok
21:47:41.0171 1448 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll
21:47:41.0171 1448 ERSvc - ok
21:47:41.0234 1448 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe
21:47:41.0234 1448 Eventlog - ok
21:47:41.0296 1448 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll
21:47:41.0296 1448 EventSystem - ok
21:47:41.0390 1448 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
21:47:41.0390 1448 Fastfat - ok
21:47:41.0421 1448 fasttx2k (1e580770bdece924494b368ac980749e) C:\WINDOWS\system32\DRIVERS\fasttx2k.sys
21:47:41.0421 1448 fasttx2k - ok
21:47:41.0484 1448 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
21:47:41.0500 1448 FastUserSwitchingCompatibility - ok
21:47:41.0578 1448 Fax (e97d6a8684466df94ff3bc24fb787a07) C:\WINDOWS\system32\fxssvc.exe
21:47:41.0578 1448 Fax - ok
21:47:41.0671 1448 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
21:47:41.0671 1448 Fdc - ok
21:47:41.0703 1448 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
21:47:41.0718 1448 Fips - ok
21:47:41.0750 1448 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
21:47:41.0750 1448 Flpydisk - ok
21:47:41.0796 1448 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
21:47:41.0796 1448 FltMgr - ok
21:47:41.0875 1448 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
21:47:41.0875 1448 FontCache3.0.0.0 - ok
21:47:41.0968 1448 FsUsbExDisk (790a4ca68f44be35967b3df61f3e4675) C:\WINDOWS\system32\FsUsbExDisk.SYS
21:47:41.0968 1448 FsUsbExDisk - ok
21:47:42.0046 1448 FsUsbExService (f4a43c0161a163ab8453471ad7a44a5c) C:\WINDOWS\system32\FsUsbExService.Exe
21:47:42.0046 1448 FsUsbExService - ok
21:47:42.0156 1448 FsVga (455f778ee14368468560bd7cb8c854d0) C:\WINDOWS\system32\DRIVERS\fsvga.sys
21:47:42.0156 1448 FsVga - ok
21:47:42.0218 1448 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
21:47:42.0218 1448 Fs_Rec - ok
21:47:42.0265 1448 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
21:47:42.0265 1448 Ftdisk - ok
21:47:42.0312 1448 GEARAspiWDM (32a73a8952580b284a47290adb62032a) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
21:47:42.0312 1448 GEARAspiWDM - ok
21:47:42.0375 1448 getPlusHelper (0879dc7444a201df84e69c5dd5083d61) C:\Program Files\NOS\bin\getPlus_Helper.dll
21:47:42.0375 1448 getPlusHelper - ok
21:47:42.0421 1448 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
21:47:42.0437 1448 Gpc - ok
21:47:42.0500 1448 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
21:47:42.0500 1448 HDAudBus - ok
21:47:42.0578 1448 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
21:47:42.0578 1448 helpsvc - ok
21:47:42.0671 1448 HidServ (deb04da35cc871b6d309b77e1443c796) C:\WINDOWS\System32\hidserv.dll
21:47:42.0671 1448 HidServ - ok
21:47:42.0765 1448 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
21:47:42.0765 1448 HidUsb - ok
21:47:42.0828 1448 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll
21:47:42.0828 1448 hkmsvc - ok
21:47:42.0859 1448 hpn - ok
21:47:43.0015 1448 hpqcxs08 (e4e285a3766b4a57401feeaf66cb07b5) C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
21:47:43.0031 1448 hpqcxs08 - ok
21:47:43.0062 1448 hpqddsvc (ee4c7a4cf2316701ffde90f404520265) C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
21:47:43.0078 1448 hpqddsvc - ok
21:47:43.0218 1448 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
21:47:43.0218 1448 HPZid412 - ok
21:47:43.0265 1448 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
21:47:43.0265 1448 HPZipr12 - ok
21:47:43.0296 1448 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
21:47:43.0296 1448 HPZius12 - ok
21:47:43.0359 1448 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
21:47:43.0375 1448 HTTP - ok
21:47:43.0437 1448 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll
21:47:43.0453 1448 HTTPFilter - ok
21:47:43.0484 1448 i2omgmt - ok
21:47:43.0515 1448 i2omp - ok
21:47:43.0562 1448 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
21:47:43.0562 1448 i8042prt - ok
21:47:43.0656 1448 ialm (0294a30b302ca71a2c26e582dda93486) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
21:47:43.0687 1448 ialm - ok
21:47:43.0765 1448 IDriverT (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
21:47:43.0781 1448 IDriverT - ok
21:47:43.0921 1448 idsvc (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
21:47:43.0953 1448 idsvc - ok
21:47:44.0062 1448 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
21:47:44.0062 1448 Imapi - ok
21:47:44.0140 1448 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe
21:47:44.0140 1448 ImapiService - ok
21:47:44.0171 1448 ini910u - ok
21:47:44.0312 1448 IntcAzAudAddService (44792ccbc7b41b42ec068c6416d17de1) C:\WINDOWS\system32\drivers\RtkHDAud.sys
21:47:44.0390 1448 IntcAzAudAddService - ok
21:47:44.0421 1448 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
21:47:44.0421 1448 IntelIde - ok
21:47:44.0484 1448 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
21:47:44.0484 1448 intelppm - ok
21:47:44.0531 1448 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
21:47:44.0531 1448 Ip6Fw - ok
21:47:44.0578 1448 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
21:47:44.0578 1448 IpFilterDriver - ok
21:47:44.0625 1448 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
21:47:44.0625 1448 IpInIp - ok
21:47:44.0671 1448 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
21:47:44.0687 1448 IpNat - ok
21:47:44.0750 1448 iPodService (962bc769d1008d83f6a00b9de887eef4) C:\Program Files\iPod\bin\iPodService.exe
21:47:44.0765 1448 iPodService - ok
21:47:44.0812 1448 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
21:47:44.0812 1448 IPSec - ok
21:47:44.0843 1448 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
21:47:44.0843 1448 IRENUM - ok
21:47:44.0906 1448 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
21:47:44.0906 1448 isapnp - ok
21:47:45.0046 1448 JavaQuickStarterService (9dba73c2f1e76ec4cb837e67c5743596) C:\Program Files\Java\jre6\bin\jqs.exe
21:47:45.0046 1448 JavaQuickStarterService - ok
21:47:45.0203 1448 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
21:47:45.0203 1448 Kbdclass - ok
21:47:45.0234 1448 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
21:47:45.0250 1448 kmixer - ok
21:47:45.0296 1448 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
21:47:45.0312 1448 KSecDD - ok
21:47:45.0375 1448 lanmanserver (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll
21:47:45.0390 1448 lanmanserver - ok
21:47:45.0437 1448 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll
21:47:45.0437 1448 lanmanworkstation - ok
21:47:45.0500 1448 lbrtfdc - ok
21:47:45.0562 1448 lirsgt (f8a7212d0864ef5e9185fb95e6623f4d) C:\WINDOWS\system32\DRIVERS\lirsgt.sys
21:47:45.0562 1448 lirsgt - ok
21:47:45.0609 1448 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll
21:47:45.0609 1448 LmHosts - ok
21:47:45.0656 1448 mcdbus - ok
21:47:45.0781 1448 MDM (11f714f85530a2bd134074dc30e99fca) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
21:47:45.0796 1448 MDM - ok
21:47:45.0859 1448 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll
21:47:45.0875 1448 Messenger - ok
21:47:46.0015 1448 Microsoft Office Groove Audit Service (123271bd5237ab991dc5c21fdf8835eb) C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
21:47:46.0015 1448 Microsoft Office Groove Audit Service - ok
21:47:46.0156 1448 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
21:47:46.0156 1448 mnmdd - ok
21:47:46.0203 1448 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe
21:47:46.0203 1448 mnmsrvc - ok
21:47:46.0265 1448 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
21:47:46.0265 1448 Modem - ok
21:47:46.0296 1448 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
21:47:46.0296 1448 Mouclass - ok
21:47:46.0359 1448 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
21:47:46.0359 1448 mouhid - ok
21:47:46.0406 1448 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
21:47:46.0406 1448 MountMgr - ok
21:47:46.0468 1448 MpFilter (fee0baded54222e9f1dae9541212aab1) C:\WINDOWS\system32\DRIVERS\MpFilter.sys
21:47:46.0484 1448 MpFilter - ok
21:47:46.0500 1448 mraid35x - ok
21:47:46.0546 1448 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
21:47:46.0546 1448 MRxDAV - ok
21:47:46.0625 1448 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
21:47:46.0640 1448 MRxSmb - ok
21:47:46.0781 1448 MSCSPTISRV (7419d631c390c558a5a87484567babd5) C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
21:47:46.0781 1448 MSCSPTISRV - ok
21:47:46.0890 1448 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\system32\msdtc.exe
21:47:46.0890 1448 MSDTC - ok
21:47:46.0968 1448 MSDV (1477849772712bac69c144dcf2c9ce81) C:\WINDOWS\system32\DRIVERS\msdv.sys
21:47:46.0984 1448 MSDV - ok
21:47:47.0031 1448 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
21:47:47.0031 1448 Msfs - ok
21:47:47.0062 1448 MSIServer - ok
21:47:47.0093 1448 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
21:47:47.0093 1448 MSKSSRV - ok
21:47:47.0187 1448 MsMpSvc (cfce43b70ca0cc4dcc8adb62b792b173) c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
21:47:47.0187 1448 MsMpSvc - ok
21:47:47.0234 1448 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
21:47:47.0234 1448 MSPCLOCK - ok
21:47:47.0265 1448 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
21:47:47.0265 1448 MSPQM - ok
21:47:47.0312 1448 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
21:47:47.0312 1448 mssmbios - ok
21:47:47.0359 1448 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
21:47:47.0359 1448 MSTEE - ok
21:47:47.0406 1448 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
21:47:47.0406 1448 Mup - ok
21:47:47.0437 1448 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
21:47:47.0437 1448 NABTSFEC - ok
21:47:47.0500 1448 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll
21:47:47.0515 1448 napagent - ok
21:47:47.0578 1448 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
21:47:47.0578 1448 NDIS - ok
21:47:47.0625 1448 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
21:47:47.0625 1448 NdisIP - ok
21:47:47.0671 1448 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
21:47:47.0671 1448 NdisTapi - ok
21:47:47.0734 1448 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
21:47:47.0734 1448 Ndisuio - ok
21:47:47.0781 1448 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
21:47:47.0781 1448 NdisWan - ok
21:47:47.0843 1448 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
21:47:47.0843 1448 NDProxy - ok
21:47:47.0890 1448 Net Driver HPZ12 (2969d26eee289be7422aa46fc55f4e38) C:\WINDOWS\system32\HPZinw12.dll
21:47:47.0890 1448 Net Driver HPZ12 - ok
21:47:47.0953 1448 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
21:47:47.0953 1448 NetBIOS - ok
21:47:48.0000 1448 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
21:47:48.0000 1448 NetBT - ok
21:47:48.0062 1448 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe
21:47:48.0078 1448 NetDDE - ok
21:47:48.0093 1448 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe
21:47:48.0093 1448 NetDDEdsdm - ok
21:47:48.0125 1448 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
21:47:48.0125 1448 Netlogon - ok
21:47:48.0171 1448 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll
21:47:48.0171 1448 Netman - ok
21:47:48.0265 1448 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
21:47:48.0265 1448 NetTcpPortSharing - ok
21:47:48.0343 1448 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
21:47:48.0343 1448 NIC1394 - ok
21:47:48.0406 1448 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll
21:47:48.0406 1448 Nla - ok
21:47:48.0453 1448 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
21:47:48.0453 1448 Npfs - ok
21:47:48.0562 1448 npkcrypt (8bcb281a2540e7aff0cd00f9878fe21f) C:\WINDOWS\system32\npkcrypt.sys
21:47:48.0578 1448 npkcrypt - ok
21:47:48.0625 1448 npkcsvc (6a76395c4a725ec07e06ea42f0bf0835) C:\WINDOWS\system32\npkcsvc.exe
21:47:48.0625 1448 npkcsvc - ok
21:47:48.0750 1448 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
21:47:48.0765 1448 Ntfs - ok
21:47:48.0843 1448 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
21:47:48.0843 1448 NtLmSsp - ok
21:47:48.0921 1448 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll
21:47:48.0921 1448 NtmsSvc - ok
21:47:48.0984 1448 NuidFltr (cf7e041663119e09d2e118521ada9300) C:\WINDOWS\system32\DRIVERS\NuidFltr.sys
21:47:48.0984 1448 NuidFltr - ok
21:47:49.0015 1448 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
21:47:49.0015 1448 Null - ok
21:47:49.0375 1448 nv (ed9816dbaf6689542ea7d022631906a1) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
21:47:49.0671 1448 nv - ok
21:47:49.0718 1448 NVSvc (a2322c6207ebb0761a6c8cc9003ebacf) C:\WINDOWS\system32\nvsvc32.exe
21:47:49.0734 1448 NVSvc - ok
21:47:49.0765 1448 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
21:47:49.0765 1448 NwlnkFlt - ok
21:47:49.0812 1448 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
21:47:49.0812 1448 NwlnkFwd - ok
21:47:49.0984 1448 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
21:47:50.0000 1448 odserv - ok
21:47:50.0140 1448 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
21:47:50.0140 1448 ohci1394 - ok
21:47:50.0265 1448 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
21:47:50.0281 1448 ose - ok
21:47:50.0359 1448 PACSPTISVR (778c309121067d83b8a48cdb658b4c17) C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
21:47:50.0375 1448 PACSPTISVR - ok
21:47:50.0531 1448 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
21:47:50.0531 1448 Parport - ok
21:47:50.0609 1448 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
21:47:50.0609 1448 PartMgr - ok
21:47:50.0656 1448 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
21:47:50.0656 1448 ParVdm - ok
21:47:50.0718 1448 pccsmcfd (175cc28dcf819f78caa3fbd44ad9e52a) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
21:47:50.0718 1448 pccsmcfd - ok
21:47:50.0765 1448 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
21:47:50.0781 1448 PCI - ok
21:47:50.0812 1448 PCIDump - ok
21:47:50.0859 1448 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
21:47:50.0859 1448 PCIIde - ok
21:47:50.0921 1448 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
21:47:50.0921 1448 Pcmcia - ok
21:47:50.0953 1448 PDCOMP - ok
21:47:50.0984 1448 PDFRAME - ok
21:47:51.0015 1448 PDRELI - ok
21:47:51.0031 1448 PDRFRAME - ok
21:47:51.0062 1448 perc2 - ok
21:47:51.0093 1448 perc2hib - ok
21:47:51.0187 1448 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe
21:47:51.0187 1448 PlugPlay - ok
21:47:51.0250 1448 Pml Driver HPZ12 (bafc9706bdf425a02b66468ab2605c59) C:\WINDOWS\system32\HPZipm12.dll
21:47:51.0250 1448 Pml Driver HPZ12 - ok
21:47:51.0296 1448 PnkBstrA (a1dd33d16f277ce34124ee52ab2c0f14) C:\WINDOWS\system32\PnkBstrA.exe
21:47:51.0312 1448 PnkBstrA - ok
21:47:51.0359 1448 PnkBstrB (38cda1e493c6589910a3fbe81eccd354) C:\WINDOWS\system32\PnkBstrB.exe
21:47:51.0359 1448 PnkBstrB - ok
21:47:51.0437 1448 PnkBstrK (7eeebb10a79d189541ebd435e7d834de) C:\WINDOWS\system32\drivers\PnkBstrK.sys
21:47:51.0437 1448 PnkBstrK - ok
21:47:51.0500 1448 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
21:47:51.0500 1448 PolicyAgent - ok
21:47:51.0546 1448 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
21:47:51.0562 1448 PptpMiniport - ok
21:47:51.0593 1448 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
21:47:51.0593 1448 Processor - ok
21:47:51.0625 1448 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
21:47:51.0625 1448 ProtectedStorage - ok
21:47:51.0687 1448 Ps2 (390c204ced3785609ab24e9c52054a84) C:\WINDOWS\system32\DRIVERS\PS2.sys
21:47:51.0687 1448 Ps2 - ok
21:47:51.0750 1448 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
21:47:51.0750 1448 PSched - ok
21:47:51.0796 1448 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
21:47:51.0796 1448 Ptilink - ok
21:47:51.0828 1448 PTSimBus (688983e03c0d82b2efa1db89792c4c6c) C:\WINDOWS\system32\DRIVERS\PTSimBus.sys
21:47:51.0828 1448 PTSimBus - ok
21:47:51.0875 1448 PTSimHid (fdc1a2e536b5cbce1c2245cd5ad910eb) C:\WINDOWS\system32\DRIVERS\PTSimHid.sys
21:47:51.0890 1448 PTSimHid - ok
21:47:51.0937 1448 PV8630 (8470725dcdd89f5c4af09edf7fe683db) C:\WINDOWS\system32\DRIVERS\PV8630.sys
21:47:51.0937 1448 PV8630 - ok
21:47:52.0000 1448 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
21:47:52.0000 1448 PxHelp20 - ok
21:47:52.0031 1448 ql1080 - ok
21:47:52.0062 1448 Ql10wnt - ok
21:47:52.0093 1448 ql12160 - ok
21:47:52.0125 1448 ql1240 - ok
21:47:52.0156 1448 ql1280 - ok
21:47:52.0203 1448 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
21:47:52.0203 1448 RasAcd - ok
21:47:52.0265 1448 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll
21:47:52.0265 1448 RasAuto - ok
21:47:52.0312 1448 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
21:47:52.0312 1448 Rasl2tp - ok
21:47:52.0375 1448 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll
21:47:52.0390 1448 RasMan - ok
21:47:52.0468 1448 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
21:47:52.0468 1448 RasPppoe - ok
21:47:52.0578 1448 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
21:47:52.0578 1448 Raspti - ok
21:47:52.0625 1448 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
21:47:52.0640 1448 Rdbss - ok
21:47:52.0687 1448 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
21:47:52.0687 1448 RDPCDD - ok
21:47:52.0750 1448 RDPWD (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
21:47:52.0765 1448 RDPWD - ok
21:47:52.0796 1448 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe
21:47:52.0812 1448 RDSessMgr - ok
21:47:52.0859 1448 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
21:47:52.0875 1448 redbook - ok
21:47:52.0921 1448 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll
21:47:52.0921 1448 RemoteAccess - ok
21:47:53.0031 1448 RogersUpdateManager (a934f92a27770d1ec50e8adb93762a21) C:\Program Files\Rogers\Update Manager\RogersUpdateManager.exe
21:47:53.0031 1448 RogersUpdateManager - ok
21:47:53.0171 1448 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe
21:47:53.0171 1448 RpcLocator - ok
21:47:53.0234 1448 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll
21:47:53.0250 1448 RpcSs - ok
21:47:53.0296 1448 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe
21:47:53.0312 1448 RSVP - ok
21:47:53.0359 1448 rtl8139 (2ef9c0dc26b30b2318b1fc3faa1f0ae7) C:\WINDOWS\system32\DRIVERS\R8139n51.SYS
21:47:53.0375 1448 rtl8139 - ok
21:47:53.0406 1448 SABProcEnum - ok
21:47:53.0468 1448 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
21:47:53.0468 1448 SamSs - ok
21:47:53.0546 1448 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
21:47:53.0546 1448 SASDIFSV - ok
21:47:53.0593 1448 SASENUM (7ce61c25c159f50f9eaf6d77fc83fa35) C:\Program Files\SUPERAntiSpyware\SASENUM.SYS
21:47:53.0593 1448 SASENUM - ok
21:47:53.0687 1448 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
21:47:53.0687 1448 SASKUTIL - ok
21:47:53.0781 1448 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe
21:47:53.0796 1448 SCardSvr - ok
21:47:53.0843 1448 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll
21:47:53.0859 1448 Schedule - ok
21:47:53.0937 1448 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
21:47:53.0937 1448 Secdrv - ok
21:47:53.0968 1448 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll
21:47:53.0968 1448 seclogon - ok
21:47:54.0000 1448 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll
21:47:54.0015 1448 SENS - ok
21:47:54.0062 1448 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
21:47:54.0062 1448 Serial - ok
21:47:54.0156 1448 ServiceLayer (9d38320bb32230349379df5ddbbf7fce) C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
21:47:54.0171 1448 ServiceLayer - ok
21:47:54.0281 1448 ServicepointService (47c274b918dfa3de8e25e902568cbea6) C:\Program Files\Rogers Online Protection\Rogers Servicepoint Agent\ServicepointService.exe
21:47:54.0312 1448 ServicepointService - ok
21:47:54.0468 1448 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
21:47:54.0468 1448 Sfloppy - ok
21:47:54.0562 1448 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll
21:47:54.0562 1448 SharedAccess - ok
21:47:54.0625 1448 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
21:47:54.0640 1448 ShellHWDetection - ok
21:47:54.0671 1448 Simbad - ok
21:47:54.0734 1448 SiS315 (7467e510c81b19a6b590a3868f499b23) C:\WINDOWS\system32\DRIVERS\sisgrp.sys
21:47:54.0734 1448 SiS315 - ok
21:47:54.0781 1448 SISAGP (61ca562def09a782d26b3e7edec5369a) C:\WINDOWS\system32\DRIVERS\SISAGPX.sys
21:47:54.0781 1448 SISAGP - ok
21:47:54.0828 1448 SiSkp (14ed728e44b0e7a169217127d8510ca9) C:\WINDOWS\system32\DRIVERS\srvkp.sys
21:47:54.0828 1448 SiSkp - ok
21:47:54.0890 1448 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
21:47:54.0890 1448 SLIP - ok
21:47:55.0250 1448 SNPSTD3 (11bb0e11d42cc3a43d741d9b30839be1) C:\WINDOWS\system32\DRIVERS\snpstd3.sys
21:47:55.0515 1448 SNPSTD3 - ok
21:47:55.0546 1448 Sparrow - ok
21:47:55.0593 1448 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
21:47:55.0593 1448 splitter - ok
21:47:55.0656 1448 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
21:47:55.0656 1448 Spooler - ok
21:47:55.0750 1448 sptd (4e3c4ffcb2c95c2ec1fa04a6f4531533) C:\WINDOWS\system32\drivers\sptd.sys
21:47:55.0750 1448 Suspicious file (NoAccess): C:\WINDOWS\system32\drivers\sptd.sys. md5: 4e3c4ffcb2c95c2ec1fa04a6f4531533
21:47:55.0765 1448 sptd ( LockedFile.Multi.Generic ) - warning
21:47:55.0765 1448 sptd - detected LockedFile.Multi.Generic (1)
21:47:55.0890 1448 SPTISRV (9cab0a38deebd30f3c8fe9d9826f43b1) C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
21:47:55.0890 1448 SPTISRV - ok
21:47:56.0046 1448 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
21:47:56.0046 1448 sr - ok
21:47:56.0109 1448 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll
21:47:56.0109 1448 srservice - ok
21:47:56.0203 1448 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
21:47:56.0203 1448 Srv - ok
21:47:56.0281 1448 sscebus (29ae754f4e9dcc08dcfd4aef07375d52) C:\WINDOWS\system32\DRIVERS\sscebus.sys
21:47:56.0281 1448 sscebus - ok
21:47:56.0343 1448 sscemdfl (48de57f9c5a7f39ec3ea5cfbf163b811) C:\WINDOWS\system32\DRIVERS\sscemdfl.sys
21:47:56.0343 1448 sscemdfl - ok
21:47:56.0421 1448 sscemdm (600d634c721e57e4b89d3dfdd381cdb7) C:\WINDOWS\system32\DRIVERS\sscemdm.sys
21:47:56.0421 1448 sscemdm - ok
21:47:56.0500 1448 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll
21:47:56.0515 1448 SSDPSRV - ok
21:47:56.0640 1448 SSScsiSV (45b83808bf5c9968c3259a48898c7dd5) C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
21:47:56.0656 1448 SSScsiSV - ok
21:47:56.0781 1448 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll
21:47:56.0796 1448 stisvc - ok
21:47:56.0875 1448 StMp3Rec (833ac40f6e7be17951d6d9a956829547) C:\WINDOWS\system32\Drivers\StMp3Rec.sys
21:47:56.0890 1448 StMp3Rec - ok
21:47:56.0937 1448 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
21:47:56.0937 1448 streamip - ok
21:47:56.0984 1448 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
21:47:56.0984 1448 swenum - ok
21:47:57.0031 1448 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
21:47:57.0046 1448 swmidi - ok
21:47:57.0062 1448 SwPrv - ok
21:47:57.0109 1448 symc810 - ok
21:47:57.0125 1448 symc8xx - ok
21:47:57.0156 1448 sym_hi - ok
21:47:57.0187 1448 sym_u3 - ok
21:47:57.0234 1448 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
21:47:57.0234 1448 sysaudio - ok
21:47:57.0281 1448 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe
21:47:57.0296 1448 SysmonLog - ok
21:47:57.0343 1448 Tablet2k (b12610e383e83017631990f2009335b2) C:\WINDOWS\System32\Drivers\Tablet2k.sys
21:47:57.0343 1448 Tablet2k - ok
21:47:57.0390 1448 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll
21:47:57.0406 1448 TapiSrv - ok
21:47:57.0453 1448 TClass2k (1b3c28d36e669deeb39331255a3feeeb) C:\WINDOWS\system32\DRIVERS\TClass2k.sys
21:47:57.0453 1448 TClass2k - ok
21:47:57.0515 1448 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
21:47:57.0515 1448 Tcpip - ok
21:47:57.0578 1448 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
21:47:57.0578 1448 TDPIPE - ok
21:47:57.0625 1448 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
21:47:57.0625 1448 TDTCP - ok
21:47:57.0671 1448 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
21:47:57.0671 1448 TermDD - ok
21:47:57.0750 1448 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll
21:47:57.0750 1448 TermService - ok
21:47:57.0812 1448 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
21:47:57.0812 1448 Themes - ok
21:47:57.0875 1448 tmcomm (df8444a8fa8fd38d8848bdd40a8403b3) C:\WINDOWS\system32\drivers\tmcomm.sys
21:47:57.0875 1448 tmcomm - ok
21:47:57.0906 1448 TosIde - ok
21:47:57.0937 1448 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll
21:47:57.0953 1448 TrkWks - ok
21:47:57.0984 1448 TwoRabts - ok
21:47:58.0046 1448 UCTblHid (adfa2e999bd2ddf89187dcbf0e3dd404) C:\WINDOWS\system32\DRIVERS\UCTblHid.sys
21:47:58.0046 1448 UCTblHid - ok
21:47:58.0109 1448 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
21:47:58.0109 1448 Udfs - ok
21:47:58.0140 1448 ultra - ok
21:47:58.0234 1448 UnlockerDriver5 (bb879dcfd22926efbeb3298129898cbb) C:\Program Files\Unlocker\UnlockerDriver5.sys
21:47:58.0250 1448 UnlockerDriver5 - ok
21:47:58.0312 1448 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
21:47:58.0312 1448 Update - ok
21:47:58.0375 1448 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll
21:47:58.0375 1448 upnphost - ok
21:47:58.0421 1448 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe
21:47:58.0421 1448 UPS - ok
21:47:58.0515 1448 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
21:47:58.0515 1448 usbaudio - ok
21:47:58.0562 1448 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
21:47:58.0562 1448 usbccgp - ok
21:47:58.0625 1448 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
21:47:58.0625 1448 usbehci - ok
21:47:58.0671 1448 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
21:47:58.0671 1448 usbhub - ok
21:47:58.0734 1448 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
21:47:58.0734 1448 usbohci - ok
21:47:58.0765 1448 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
21:47:58.0765 1448 usbprint - ok
21:47:58.0796 1448 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
21:47:58.0796 1448 usbscan - ok
21:47:58.0843 1448 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
21:47:58.0843 1448 USBSTOR - ok
21:47:58.0906 1448 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
21:47:58.0921 1448 usbuhci - ok
21:47:59.0000 1448 vaxscsi (92cebc2bc7be2c8d49391b365569f306) C:\WINDOWS\System32\Drivers\vaxscsi.sys
21:47:59.0000 1448 vaxscsi - ok
21:47:59.0062 1448 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
21:47:59.0062 1448 VgaSave - ok
21:47:59.0109 1448 viaagp1 (4b039bbd037b01f5db5a144c837f283a) C:\WINDOWS\system32\DRIVERS\viaagp1.sys
21:47:59.0109 1448 viaagp1 - ok
21:47:59.0156 1448 viagfx (19bba101cb87d18ff04e7f24e1792ab0) C:\WINDOWS\system32\DRIVERS\vtmini.sys
21:47:59.0171 1448 viagfx - ok
21:47:59.0203 1448 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
21:47:59.0203 1448 ViaIde - ok
21:47:59.0250 1448 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
21:47:59.0250 1448 VolSnap - ok
21:47:59.0312 1448 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe
21:47:59.0328 1448 VSS - ok
21:47:59.0375 1448 W32Time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll
21:47:59.0390 1448 W32Time - ok
21:47:59.0468 1448 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
21:47:59.0468 1448 Wanarp - ok
21:47:59.0562 1448 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
21:47:59.0593 1448 Wdf01000 - ok
21:47:59.0625 1448 WDICA - ok
21:47:59.0671 1448 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
21:47:59.0671 1448 wdmaud - ok
21:47:59.0718 1448 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll
21:47:59.0718 1448 WebClient - ok
21:47:59.0796 1448 WinDriver6 (6cb18d5c6f952ffefca4c3d904956fe1) C:\WINDOWS\system32\drivers\windrvr6.sys
21:47:59.0796 1448 WinDriver6 - ok
21:47:59.0875 1448 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll
21:47:59.0890 1448 winmgmt - ok
21:47:59.0953 1448 WinTabService (2a42c1cff2507407de81adb16748e0ef) C:\WINDOWS\System32\Drivers\WTSRV.EXE
21:47:59.0953 1448 WinTabService - ok
21:48:00.0015 1448 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\mspmsnsv.dll
21:48:00.0015 1448 WmdmPmSN - ok
21:48:00.0125 1448 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe
21:48:00.0125 1448 WmiApSrv - ok
21:48:00.0234 1448 WMPNetworkSvc (f74e3d9a7fa9556c3bbb14d4e5e63d3b) C:\Program Files\Windows Media Player\WMPNetwk.exe
21:48:00.0250 1448 WMPNetworkSvc - ok
21:48:00.0390 1448 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\Drivers\wpdusb.sys
21:48:00.0390 1448 WpdUsb - ok
21:48:00.0562 1448 WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
21:48:00.0609 1448 WPFFontCache_v0400 - ok
21:48:00.0718 1448 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
21:48:00.0718 1448 WS2IFSL - ok
21:48:00.0781 1448 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll
21:48:00.0781 1448 wscsvc - ok
21:48:00.0828 1448 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
21:48:00.0828 1448 WSTCODEC - ok
21:48:00.0875 1448 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll
21:48:00.0921 1448 wuauserv - ok
21:48:00.0968 1448 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
21:48:00.0968 1448 WudfPf - ok
21:48:01.0015 1448 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
21:48:01.0031 1448 WudfRd - ok
21:48:01.0078 1448 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
21:48:01.0093 1448 WudfSvc - ok
21:48:01.0156 1448 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll
21:48:01.0187 1448 WZCSVC - ok
21:48:01.0234 1448 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll
21:48:01.0390 1448 xmlprov - ok
21:48:01.0437 1448 MBR (0x1B8) (bad0263fbe81b49f5f07b32dc9d198b3) \Device\Harddisk0\DR0
21:48:01.0468 1448 \Device\Harddisk0\DR0 - ok
21:48:01.0484 1448 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk5\DR7
21:48:04.0906 1448 \Device\Harddisk5\DR7 - ok
21:48:04.0921 1448 Boot (0x1200) (d9ecf27c50144d20f3bd5359ea466a49) \Device\Harddisk0\DR0\Partition0
21:48:04.0921 1448 \Device\Harddisk0\DR0\Partition0 - ok
21:48:04.0953 1448 Boot (0x1200) (56448e625c049ee89e0394ae97b11d6d) \Device\Harddisk0\DR0\Partition1
21:48:04.0953 1448 \Device\Harddisk0\DR0\Partition1 - ok
21:48:04.0968 1448 Boot (0x1200) (0a98b7581f3bbe6e349ae3fa59d9b698) \Device\Harddisk5\DR7\Partition0
21:48:04.0968 1448 \Device\Harddisk5\DR7\Partition0 - ok
21:48:04.0968 1448 ============================================================
21:48:04.0968 1448 Scan finished
21:48:04.0968 1448 ============================================================
21:48:05.0000 3500 Detected object count: 1
21:48:05.0000 3500 Actual detected object count: 1
21:48:48.0453 3500 sptd ( LockedFile.Multi.Generic ) - skipped by user
21:48:48.0453 3500 sptd ( LockedFile.Multi.Generic ) - User select action: Skip


Regards,
Foxx

It worked! Here it is.

Foxx


ComboFix 12-04-19.02 - Administrator 1/2012 Sat 9:53.3.1 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.949.82.1033.18.1535.1180 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: BitDefender Professional Edition v7.2 *Disabled/Outdated* {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
FW: BitDefender Professional Edition v7.2 *Disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
.
Error: Cfiles.dat
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\WINDOWS
c:\documents and settings\All Users\Application Data\shs_setup_4056-345359.exe
c:\documents and settings\All Users\Application Data\shs_setup_4059-354328.exe
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\Compaq_Owner\Application Data\PriceGong
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\1.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\2256.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\a.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\b.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\c.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\d.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\e.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\f.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\g.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\h.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\i.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\j.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\k.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\l.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\m.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\n.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\o.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\p.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\q.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\r.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\s.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\t.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\u.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\v.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\w.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\wlu.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\x.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\y.txt
c:\documents and settings\Compaq_Owner\Application Data\PriceGong\Data\z.txt
c:\documents and settings\Compaq_Owner\System
c:\documents and settings\Compaq_Owner\System\win_qs7.jqx
c:\documents and settings\Compaq_Owner\WINDOWS
c:\documents and settings\Default User\WINDOWS
c:\program files\facemoods.com
c:\program files\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll
c:\windows\apppatch\apploc.exe
c:\windows\IsUn0411.exe
c:\windows\IsUn0412.exe
c:\windows\SET4FD.tmp
c:\windows\SET6F19.tmp
c:\windows\SET718.tmp
c:\windows\system32\_004359_.tmp.dll
c:\windows\system32\_004360_.tmp.dll
c:\windows\system32\_004361_.tmp.dll
c:\windows\system32\_004362_.tmp.dll
c:\windows\system32\_004369_.tmp.dll
c:\windows\system32\_004370_.tmp.dll
c:\windows\system32\_004371_.tmp.dll
c:\windows\system32\_004372_.tmp.dll
c:\windows\system32\_004374_.tmp.dll
c:\windows\system32\_004375_.tmp.dll
c:\windows\system32\_004378_.tmp.dll
c:\windows\system32\_004379_.tmp.dll
c:\windows\system32\_004381_.tmp.dll
c:\windows\system32\_004382_.tmp.dll
c:\windows\system32\_004383_.tmp.dll
c:\windows\system32\_004385_.tmp.dll
c:\windows\system32\_004387_.tmp.dll
c:\windows\system32\_004388_.tmp.dll
c:\windows\system32\_004389_.tmp.dll
c:\windows\system32\_004393_.tmp.dll
c:\windows\system32\_004394_.tmp.dll
c:\windows\system32\_004396_.tmp.dll
c:\windows\system32\_004399_.tmp.dll
c:\windows\system32\_004401_.tmp.dll
c:\windows\system32\_004402_.tmp.dll
c:\windows\system32\_004403_.tmp.dll
c:\windows\system32\_004404_.tmp.dll
c:\windows\system32\_004405_.tmp.dll
c:\windows\system32\_004408_.tmp.dll
c:\windows\system32\_004409_.tmp.dll
c:\windows\system32\_004410_.tmp.dll
c:\windows\system32\_004411_.tmp.dll
c:\windows\system32\_004412_.tmp.dll
c:\windows\system32\_004417_.tmp.dll
c:\windows\system32\_004419_.tmp.dll
c:\windows\system32\_004860_.tmp.dll
c:\windows\system32\_004861_.tmp.dll
c:\windows\system32\_004862_.tmp.dll
c:\windows\system32\_004863_.tmp.dll
c:\windows\system32\_004870_.tmp.dll
c:\windows\system32\_004871_.tmp.dll
c:\windows\system32\_004872_.tmp.dll
c:\windows\system32\_004874_.tmp.dll
c:\windows\system32\_004875_.tmp.dll
c:\windows\system32\_004878_.tmp.dll
c:\windows\system32\_004879_.tmp.dll
c:\windows\system32\_004881_.tmp.dll
c:\windows\system32\_004882_.tmp.dll
c:\windows\system32\_004883_.tmp.dll
c:\windows\system32\_004885_.tmp.dll
c:\windows\system32\_004887_.tmp.dll
c:\windows\system32\_004888_.tmp.dll
c:\windows\system32\_004889_.tmp.dll
c:\windows\system32\_004893_.tmp.dll
c:\windows\system32\_004894_.tmp.dll
c:\windows\system32\_004896_.tmp.dll
c:\windows\system32\_004899_.tmp.dll
c:\windows\system32\_004901_.tmp.dll
c:\windows\system32\_004902_.tmp.dll
c:\windows\system32\_004903_.tmp.dll
c:\windows\system32\_004904_.tmp.dll
c:\windows\system32\_004907_.tmp.dll
c:\windows\system32\_004908_.tmp.dll
c:\windows\system32\_004909_.tmp.dll
c:\windows\system32\_004910_.tmp.dll
c:\windows\system32\_004911_.tmp.dll
c:\windows\system32\_004916_.tmp.dll
c:\windows\system32\_004918_.tmp.dll
c:\windows\system32\_004919_.tmp.dll
c:\windows\system32\_004947_.tmp.dll
c:\windows\system32\_004948_.tmp.dll
c:\windows\system32\_004949_.tmp.dll
c:\windows\system32\_004950_.tmp.dll
c:\windows\system32\_004957_.tmp.dll
c:\windows\system32\_004958_.tmp.dll
c:\windows\system32\_004959_.tmp.dll
c:\windows\system32\_004961_.tmp.dll
c:\windows\system32\_004962_.tmp.dll
c:\windows\system32\_004965_.tmp.dll
c:\windows\system32\_004966_.tmp.dll
c:\windows\system32\_004968_.tmp.dll
c:\windows\system32\_004969_.tmp.dll
c:\windows\system32\_004970_.tmp.dll
c:\windows\system32\_004972_.tmp.dll
c:\windows\system32\_004974_.tmp.dll
c:\windows\system32\_004975_.tmp.dll
c:\windows\system32\_004976_.tmp.dll
c:\windows\system32\_004980_.tmp.dll
c:\windows\system32\_004981_.tmp.dll
c:\windows\system32\_004983_.tmp.dll
c:\windows\system32\_004986_.tmp.dll
c:\windows\system32\_004988_.tmp.dll
c:\windows\system32\_004989_.tmp.dll
c:\windows\system32\_004990_.tmp.dll
c:\windows\system32\_004991_.tmp.dll
c:\windows\system32\_004994_.tmp.dll
c:\windows\system32\_004995_.tmp.dll
c:\windows\system32\_004996_.tmp.dll
c:\windows\system32\_004997_.tmp.dll
c:\windows\system32\_004998_.tmp.dll
c:\windows\system32\_005003_.tmp.dll
c:\windows\system32\_005005_.tmp.dll
c:\windows\system32\_005006_.tmp.dll
c:\windows\system32\config\systemprofile\Application Data\PriceGong
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\1.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\a.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\b.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\c.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\d.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\e.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\f.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\g.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\h.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\i.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\j.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\k.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\l.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\m.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\mru.xml
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\n.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\o.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\p.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\q.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\r.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\s.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\t.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\u.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\v.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\w.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\wlu.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\x.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\y.txt
c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\z.txt
c:\windows\system32\config\systemprofile\WINDOWS
c:\windows\system32\npZ.ocx
c:\windows\system32\ps2.bat
c:\windows\system32\SET10C8.tmp
c:\windows\system32\SET10CB.tmp
c:\windows\system32\SET10D0.tmp
c:\windows\system32\SET10FF.tmp
c:\windows\system32\SET1101.tmp
c:\windows\system32\SET12E0.tmp
c:\windows\system32\SET12E3.tmp
c:\windows\system32\SET12E8.tmp
c:\windows\system32\SET1317.tmp
c:\windows\system32\SET1319.tmp
c:\windows\system32\SET166.tmp
c:\windows\system32\SET167.tmp
c:\windows\system32\SET169.tmp
c:\windows\system32\SET16B.tmp
c:\windows\system32\SET16D.tmp
c:\windows\system32\SET170.tmp
c:\windows\system32\SET174.tmp
c:\windows\system32\SET175.tmp
c:\windows\system32\SET178.tmp
c:\windows\system32\SET17D.tmp
c:\windows\system32\SET17E.tmp
c:\windows\system32\SET17F.tmp
c:\windows\system32\SET182.tmp
c:\windows\system32\SET183.tmp
c:\windows\system32\SET184.tmp
c:\windows\system32\SET186.tmp
c:\windows\system32\SET187.tmp
c:\windows\system32\SET18A.tmp
c:\windows\system32\SET18B.tmp
c:\windows\system32\SET18C.tmp
c:\windows\system32\SET18D.tmp
c:\windows\system32\SET193.tmp
c:\windows\system32\SET19A.tmp
c:\windows\system32\SET19B.tmp
c:\windows\system32\SET19C.tmp
c:\windows\system32\SET19D.tmp
c:\windows\system32\SET1A0.tmp
c:\windows\system32\SET1A2.tmp
c:\windows\system32\SET1A4.tmp
c:\windows\system32\SET1A8.tmp
c:\windows\system32\SET1AB.tmp
c:\windows\system32\SET1AD.tmp
c:\windows\system32\SET1AE.tmp
c:\windows\system32\SET1AF.tmp
c:\windows\system32\SET1B1.tmp
c:\windows\system32\SET1B2.tmp
c:\windows\system32\SET1B3.tmp
c:\windows\system32\SET1B8.tmp
c:\windows\system32\SET1B9.tmp
c:\windows\system32\SET1BA.tmp
c:\windows\system32\SET1BB.tmp
c:\windows\system32\SET1BE.tmp
c:\windows\system32\SET1C4.tmp
c:\windows\system32\SET1CC.tmp
c:\windows\system32\SET1CD.tmp
c:\windows\system32\SET1D1.tmp
c:\windows\system32\SET1D4.tmp
c:\windows\system32\SET1D5.tmp
c:\windows\system32\SET1DC.tmp
c:\windows\system32\SET1DD.tmp
c:\windows\system32\SET1DF.tmp
c:\windows\system32\SET1E2.tmp
c:\windows\system32\SET1E3.tmp
c:\windows\system32\SET1EC.tmp
c:\windows\system32\SET1ED.tmp
c:\windows\system32\SET1F0.tmp
c:\windows\system32\SET1F2.tmp
c:\windows\system32\SET1F3.tmp
c:\windows\system32\SET1F4.tmp
c:\windows\system32\SET1F5.tmp
c:\windows\system32\SET1F6.tmp
c:\windows\system32\SET1F7.tmp
c:\windows\system32\SET1FB.tmp
c:\windows\system32\SET207.tmp
c:\windows\system32\SET20C.tmp
c:\windows\system32\SET20E.tmp
c:\windows\system32\SET210.tmp
c:\windows\system32\SET211.tmp
c:\windows\system32\SET212.tmp
c:\windows\system32\SET213.tmp
c:\windows\system32\SET215.tmp
c:\windows\system32\SET216.tmp
c:\windows\system32\SET21A.tmp
c:\windows\system32\SET21B.tmp
c:\windows\system32\SET21F.tmp
c:\windows\system32\SET220.tmp
c:\windows\system32\SET226.tmp
c:\windows\system32\SET227.tmp
c:\windows\system32\SET228.tmp
c:\windows\system32\SET22F.tmp
c:\windows\system32\SET230.tmp
c:\windows\system32\SET236.tmp
c:\windows\system32\SET237.tmp
c:\windows\system32\SET238.tmp
c:\windows\system32\SET23A.tmp
c:\windows\system32\SET23C.tmp
c:\windows\system32\SET242.tmp
c:\windows\system32\SET24E.tmp
c:\windows\system32\SET250.tmp
c:\windows\system32\SET252.tmp
c:\windows\system32\SET253.tmp
c:\windows\system32\SET254.tmp
c:\windows\system32\SET260.tmp
c:\windows\system32\SET262.tmp
c:\windows\system32\SET263.tmp
c:\windows\system32\SET266.tmp
c:\windows\system32\SET268.tmp
c:\windows\system32\SET26C.tmp
c:\windows\system32\SET273.tmp
c:\windows\system32\SET276.tmp
c:\windows\system32\SET277.tmp
c:\windows\system32\SET27D.tmp
c:\windows\system32\SET27F.tmp
c:\windows\system32\SET280.tmp
c:\windows\system32\SET281.tmp
c:\windows\system32\SET288.tmp
c:\windows\system32\SET289.tmp
c:\windows\system32\SET28C.tmp
c:\windows\system32\SET28D.tmp
c:\windows\system32\SET28E.tmp
c:\windows\system32\SET28F.tmp
c:\windows\system32\SET290.tmp
c:\windows\system32\SET292.tmp
c:\windows\system32\SET293.tmp
c:\windows\system32\SET294.tmp
c:\windows\system32\SET296.tmp
c:\windows\system32\SET297.tmp
c:\windows\system32\SET298.tmp
c:\windows\system32\SET29B.tmp
c:\windows\system32\SET29E.tmp
c:\windows\system32\SET2A3.tmp
c:\windows\system32\SET2A4.tmp
c:\windows\system32\SET2A5.tmp
c:\windows\system32\SET2AA.tmp
c:\windows\system32\SET2AB.tmp
c:\windows\system32\SET2AC.tmp
c:\windows\system32\SET2AE.tmp
c:\windows\system32\SET2B1.tmp
c:\windows\system32\SET2B3.tmp
c:\windows\system32\SET2B4.tmp
c:\windows\system32\SET2B7.tmp
c:\windows\system32\SET2B8.tmp
c:\windows\system32\SET2BB.tmp
c:\windows\system32\SET2BE.tmp
c:\windows\system32\SET2BF.tmp
c:\windows\system32\SET2C1.tmp
c:\windows\system32\SET2C6.tmp
c:\windows\system32\SET2CA.tmp
c:\windows\system32\SET2CE.tmp
c:\windows\system32\SET2D0.tmp
c:\windows\system32\SET2D1.tmp
c:\windows\system32\SET2D2.tmp
c:\windows\system32\SET2D4.tmp
c:\windows\system32\SET2D5.tmp
c:\windows\system32\SET2D8.tmp
c:\windows\system32\SET2DD.tmp
c:\windows\system32\SET2DE.tmp
c:\windows\system32\SET2E0.tmp
c:\windows\system32\SET2E1.tmp
c:\windows\system32\SET2E5.tmp
c:\windows\system32\SET2E7.tmp
c:\windows\system32\SET2E8.tmp
c:\windows\system32\SET2E9.tmp
c:\windows\system32\SET2EA.tmp
c:\windows\system32\SET2EB.tmp
c:\windows\system32\SET2EC.tmp
c:\windows\system32\SET2EE.tmp
c:\windows\system32\SET2F0.tmp
c:\windows\system32\SET2F2.tmp
c:\windows\system32\SET2F3.tmp
c:\windows\system32\SET2F4.tmp
c:\windows\system32\SET2F7.tmp
c:\windows\system32\SET301.tmp
c:\windows\system32\SET303.tmp
c:\windows\system32\SET304.tmp
c:\windows\system32\SET305.tmp
c:\windows\system32\SET307.tmp
c:\windows\system32\SET308.tmp
c:\windows\system32\SET30D.tmp
c:\windows\system32\SET30F.tmp
c:\windows\system32\SET310.tmp
c:\windows\system32\SET316.tmp
c:\windows\system32\SET321.tmp
c:\windows\system32\SET325.tmp
c:\windows\system32\SET326.tmp
c:\windows\system32\SET327.tmp
c:\windows\system32\SET32A.tmp
c:\windows\system32\SET332.tmp
c:\windows\system32\SET334.tmp
c:\windows\system32\SET339.tmp
c:\windows\system32\SET33B.tmp
c:\windows\system32\SET341.tmp
c:\windows\system32\SET344.tmp
c:\windows\system32\SET346.tmp
c:\windows\system32\SET350.tmp
c:\windows\system32\SET351.tmp
c:\windows\system32\SET361.tmp
c:\windows\system32\SET365.tmp
c:\windows\system32\SET367.tmp
c:\windows\system32\SET369.tmp
c:\windows\system32\SET370.tmp
c:\windows\system32\SET371.tmp
c:\windows\system32\SET375.tmp
c:\windows\system32\SET383.tmp
c:\windows\system32\SET38E.tmp
c:\windows\system32\SET394.tmp
c:\windows\system32\SET396.tmp
c:\windows\system32\SET397.tmp
c:\windows\system32\SET398.tmp
c:\windows\system32\SET39A.tmp
c:\windows\system32\SET39E.tmp
c:\windows\system32\SET3A2.tmp
c:\windows\system32\SET3A9.tmp
c:\windows\system32\SET3AC.tmp
c:\windows\system32\SET3AE.tmp
c:\windows\system32\SET3B4.tmp
c:\windows\system32\SET3BD.tmp
c:\windows\system32\SET3BE.tmp
c:\windows\system32\SET3C3.tmp
c:\windows\system32\SET3C5.tmp
c:\windows\system32\SET3C6.tmp
c:\windows\system32\SET3C7.tmp
c:\windows\system32\SET3C9.tmp
c:\windows\system32\SET3CA.tmp
c:\windows\system32\SET3D1.tmp
c:\windows\system32\SET3D5.tmp
c:\windows\system32\SET3DA.tmp
c:\windows\system32\SET3DB.tmp
c:\windows\system32\SET3DC.tmp
c:\windows\system32\SET3E0.tmp
c:\windows\system32\SET3F0.tmp
c:\windows\system32\SET3F1.tmp
c:\windows\system32\SET3F7.tmp
c:\windows\system32\SET3F8.tmp
c:\windows\system32\SET3FA.tmp
c:\windows\system32\SET3FC.tmp
c:\windows\system32\SET3FE.tmp
c:\windows\system32\SET405.tmp
c:\windows\system32\SET406.tmp
c:\windows\system32\SET409.tmp
c:\windows\system32\SET40E.tmp
c:\windows\system32\SET40F.tmp
c:\windows\system32\SET410.tmp
c:\windows\system32\SET413.tmp
c:\windows\system32\SET414.tmp
c:\windows\system32\SET415.tmp
c:\windows\system32\SET417.tmp
c:\windows\system32\SET418.tmp
c:\windows\system32\SET41B.tmp
c:\windows\system32\SET41C.tmp
c:\windows\system32\SET41D.tmp
c:\windows\system32\SET423.tmp
c:\windows\system32\SET426.tmp
c:\windows\system32\SET427.tmp
c:\windows\system32\SET42A.tmp
c:\windows\system32\SET42B.tmp
c:\windows\system32\SET42C.tmp
c:\windows\system32\SET42D.tmp
c:\windows\system32\SET42F.tmp
c:\windows\system32\SET431.tmp
c:\windows\system32\SET433.tmp
c:\windows\system32\SET438.tmp
c:\windows\system32\SET439.tmp
c:\windows\system32\SET43B.tmp
c:\windows\system32\SET43C.tmp
c:\windows\system32\SET43D.tmp
c:\windows\system32\SET43F.tmp
c:\windows\system32\SET444.tmp
c:\windows\system32\SET445.tmp
c:\windows\system32\SET446.tmp
c:\windows\system32\SET447.tmp
c:\windows\system32\SET448.tmp
c:\windows\system32\SET449.tmp
c:\windows\system32\SET44A.tmp
c:\windows\system32\SET44B.tmp
c:\windows\system32\SET44D.tmp
c:\windows\system32\SET44E.tmp
c:\windows\system32\SET44F.tmp
c:\windows\system32\SET450.tmp
c:\windows\system32\SET451.tmp
c:\windows\system32\SET453.tmp
c:\windows\system32\SET455.tmp
c:\windows\system32\SET456.tmp
c:\windows\system32\SET457.tmp
c:\windows\system32\SET458.tmp
c:\windows\system32\SET45A.tmp
c:\windows\system32\SET45B.tmp
c:\windows\system32\SET45D.tmp
c:\windows\system32\SET45E.tmp
c:\windows\system32\SET460.tmp
c:\windows\system32\SET462.tmp
c:\windows\system32\SET465.tmp
c:\windows\system32\SET466.tmp
c:\windows\system32\SET468.tmp
c:\windows\system32\SET46A.tmp
c:\windows\system32\SET46B.tmp
c:\windows\system32\SET46C.tmp
c:\windows\system32\SET46D.tmp
c:\windows\system32\SET475.tmp
c:\windows\system32\SET476.tmp
c:\windows\system32\SET477.tmp
c:\windows\system32\SET479.tmp
c:\windows\system32\SET47C.tmp
c:\windows\system32\SET47D.tmp
c:\windows\system32\SET47E.tmp
c:\windows\system32\SET47F.tmp
c:\windows\system32\SET480.tmp
c:\windows\system32\SET484.tmp
c:\windows\system32\SET485.tmp
c:\windows\system32\SET48C.tmp
c:\windows\system32\SET48F.tmp
c:\windows\system32\SET490.tmp
c:\windows\system32\SET493.tmp
c:\windows\system32\SET494.tmp
c:\windows\system32\SET495.tmp
c:\windows\system32\SET497.tmp
c:\windows\system32\SET498.tmp
c:\windows\system32\SET499.tmp
c:\windows\system32\SET49A.tmp
c:\windows\system32\SET49B.tmp
c:\windows\system32\SET49C.tmp
c:\windows\system32\SET49E.tmp
c:\windows\system32\SET49F.tmp
c:\windows\system32\SET4A2.tmp
c:\windows\system32\SET4A3.tmp
c:\windows\system32\SET4A4.tmp
c:\windows\system32\SET4A7.tmp
c:\windows\system32\SET4A8.tmp
c:\windows\system32\SET4A9.tmp
c:\windows\system32\SET4AA.tmp
c:\windows\system32\SET4AB.tmp
c:\windows\system32\SET4AE.tmp
c:\windows\system32\SET4AF.tmp
c:\windows\system32\SET4B0.tmp
c:\windows\system32\SET4B1.tmp
c:\windows\system32\SET4B2.tmp
c:\windows\system32\SET4B3.tmp
c:\windows\system32\SET4B6.tmp
c:\windows\system32\SET4B7.tmp
c:\windows\system32\SET4B8.tmp
c:\windows\system32\SET4B9.tmp
c:\windows\system32\SET4BE.tmp
c:\windows\system32\SET4BF.tmp
c:\windows\system32\SET4C0.tmp
c:\windows\system32\SET4C1.tmp
c:\windows\system32\SET4C3.tmp
c:\windows\system32\SET4C5.tmp
c:\windows\system32\SET4C6.tmp
c:\windows\system32\SET4C9.tmp
c:\windows\system32\SET4CB.tmp
c:\windows\system32\SET4CC.tmp
c:\windows\system32\SET4CF.tmp
c:\windows\system32\SET4D2.tmp
c:\windows\system32\SET4D4.tmp
c:\windows\system32\SET4D7.tmp
c:\windows\system32\SET4D9.tmp
c:\windows\system32\SET4DB.tmp
c:\windows\system32\SET4DC.tmp
c:\windows\system32\SET4DD.tmp
c:\windows\system32\SET4E9.tmp
c:\windows\system32\SET4EB.tmp
c:\windows\system32\SET4EC.tmp
c:\windows\system32\SET4EF.tmp
c:\windows\system32\SET4F1.tmp
c:\windows\system32\SET4F4.tmp
c:\windows\system32\SET4FB.tmp
c:\windows\system32\SET4FF.tmp
c:\windows\system32\SET505.tmp
c:\windows\system32\SET507.tmp
c:\windows\system32\SET508.tmp
c:\windows\system32\SET509.tmp
c:\windows\system32\SET510.tmp
c:\windows\system32\SET511.tmp
c:\windows\system32\SET514.tmp
c:\windows\system32\SET515.tmp
c:\windows\system32\SET516.tmp
c:\windows\system32\SET517.tmp
c:\windows\system32\SET518.tmp
c:\windows\system32\SET51A.tmp
c:\windows\system32\SET51B.tmp
c:\windows\system32\SET51C.tmp
c:\windows\system32\SET51E.tmp
c:\windows\system32\SET51F.tmp
c:\windows\system32\SET520.tmp
c:\windows\system32\SET522.tmp
c:\windows\system32\SET525.tmp
c:\windows\system32\SET52A.tmp
c:\windows\system32\SET52B.tmp
c:\windows\system32\SET52C.tmp
c:\windows\system32\SET531.tmp
c:\windows\system32\SET532.tmp
c:\windows\system32\SET533.tmp
c:\windows\system32\SET535.tmp
c:\windows\system32\SET538.tmp
c:\windows\system32\SET53A.tmp
c:\windows\system32\SET53B.tmp
c:\windows\system32\SET53E.tmp
c:\windows\system32\SET53F.tmp
c:\windows\system32\SET542.tmp
c:\windows\system32\SET545.tmp
c:\windows\system32\SET546.tmp
c:\windows\system32\SET548.tmp
c:\windows\system32\SET54D.tmp
c:\windows\system32\SET551.tmp
c:\windows\system32\SET555.tmp
c:\windows\system32\SET557.tmp
c:\windows\system32\SET558.tmp
c:\windows\system32\SET559.tmp
c:\windows\system32\SET55B.tmp
c:\windows\system32\SET55C.tmp
c:\windows\system32\SET562.tmp
c:\windows\system32\SET563.tmp
c:\windows\system32\SET565.tmp
c:\windows\system32\SET566.tmp
c:\windows\system32\SET56A.tmp
c:\windows\system32\SET56C.tmp
c:\windows\system32\SET56D.tmp
c:\windows\system32\SET56E.tmp
c:\windows\system32\SET56F.tmp
c:\windows\system32\SET570.tmp
c:\windows\system32\SET571.tmp
c:\windows\system32\SET573.tmp
c:\windows\system32\SET575.tmp
c:\windows\system32\SET577.tmp
c:\windows\system32\SET57F.tmp
c:\windows\system32\SET581.tmp
c:\windows\system32\SET583.tmp
c:\windows\system32\SET584.tmp
c:\windows\system32\SET585.tmp
c:\windows\system32\SET587.tmp
c:\windows\system32\SET588.tmp
c:\windows\system32\SET58D.tmp
c:\windows\system32\SET58F.tmp
c:\windows\system32\SET590.tmp
c:\windows\system32\SET596.tmp
c:\windows\system32\SET5A1.tmp
c:\windows\system32\SET5A5.tmp
c:\windows\system32\SET5A6.tmp
c:\windows\system32\SET5A7.tmp
c:\windows\system32\SET5AA.tmp
c:\windows\system32\SET5B2.tmp
c:\windows\system32\SET5B4.tmp
c:\windows\system32\SET5B9.tmp
c:\windows\system32\SET5BB.tmp
c:\windows\system32\SET5C0.tmp
c:\windows\system32\SET5C3.tmp
c:\windows\system32\SET5C5.tmp
c:\windows\system32\SET5DE.tmp
c:\windows\system32\SET5E2.tmp
c:\windows\system32\SET5E4.tmp
c:\windows\system32\SET5E6.tmp
c:\windows\system32\SET5EC.tmp
c:\windows\system32\SET5ED.tmp
c:\windows\system32\SET5F0.tmp
c:\windows\system32\SET5F6.tmp
c:\windows\system32\SET601.tmp
c:\windows\system32\SET607.tmp
c:\windows\system32\SET609.tmp
c:\windows\system32\SET60A.tmp
c:\windows\system32\SET60B.tmp
c:\windows\system32\SET60D.tmp
c:\windows\system32\SET611.tmp
c:\windows\system32\SET615.tmp
c:\windows\system32\SET61C.tmp
c:\windows\system32\SET61F.tmp
c:\windows\system32\SET621.tmp
c:\windows\system32\SET627.tmp
c:\windows\system32\SET630.tmp
c:\windows\system32\SET631.tmp
c:\windows\system32\SET636.tmp
c:\windows\system32\SET638.tmp
c:\windows\system32\SET639.tmp
c:\windows\system32\SET63A.tmp
c:\windows\system32\SET642.tmp
c:\windows\system32\SET646.tmp
c:\windows\system32\SET64B.tmp
c:\windows\system32\SET651.tmp
c:\windows\system32\SET661.tmp
c:\windows\system32\SET662.tmp
c:\windows\system32\SET680.tmp
c:\windows\system32\SET683.tmp
c:\windows\system32\SET684.tmp
c:\windows\system32\SET687.tmp
c:\windows\system32\SET68F.tmp
c:\windows\system32\SET696.tmp
c:\windows\system32\SET697.tmp
c:\windows\system32\SET698.tmp
c:\windows\system32\SET69A.tmp
c:\windows\system32\SET69B.tmp
c:\windows\system32\SET69C.tmp
c:\windows\system32\SET69D.tmp
c:\windows\system32\SET69F.tmp
c:\windows\system32\SET6A1.tmp
c:\windows\system32\SET6A2.tmp
c:\windows\system32\SET6A3.tmp
c:\windows\system32\SET6A6.tmp
c:\windows\system32\SET6A8.tmp
c:\windows\system32\SET6AD.tmp
c:\windows\system32\SET6AE.tmp
c:\windows\system32\SET6B6.tmp
c:\windows\system32\SET6BD.tmp
c:\windows\system32\SET6BEF.tmp
c:\windows\system32\SET6BF0.tmp
c:\windows\system32\SET6BF2.tmp
c:\windows\system32\SET6BF4.tmp
c:\windows\system32\SET6BF6.tmp
c:\windows\system32\SET6BFD.tmp
c:\windows\system32\SET6BFE.tmp
c:\windows\system32\SET6C01.tmp
c:\windows\system32\SET6C06.tmp
c:\windows\system32\SET6C07.tmp
c:\windows\system32\SET6C08.tmp
c:\windows\system32\SET6C0B.tmp
c:\windows\system32\SET6C0C.tmp
c:\windows\system32\SET6C0D.tmp
c:\windows\system32\SET6C0F.tmp
c:\windows\system32\SET6C10.tmp
c:\windows\system32\SET6C13.tmp
c:\windows\system32\SET6C14.tmp
c:\windows\system32\SET6C15.tmp
c:\windows\system32\SET6C1B.tmp
c:\windows\system32\SET6C22.tmp
c:\windows\system32\SET6C23.tmp
c:\windows\system32\SET6C24.tmp
c:\windows\system32\SET6C27.tmp
c:\windows\system32\SET6C29.tmp
c:\windows\system32\SET6C2B.tmp
c:\windows\system32\SET6C31.tmp
c:\windows\system32\SET6C32.tmp
c:\windows\system32\SET6C34.tmp
c:\windows\system32\SET6C35.tmp
c:\windows\system32\SET6C36.tmp
c:\windows\system32\SET6C38.tmp
c:\windows\system32\SET6C3D.tmp
c:\windows\system32\SET6C3E.tmp
c:\windows\system32\SET6C3F.tmp
c:\windows\system32\SET6C4.tmp
c:\windows\system32\SET6C40.tmp
c:\windows\system32\SET6C43.tmp
c:\windows\system32\SET6C49.tmp
c:\windows\system32\SET6C4F.tmp
c:\windows\system32\SET6C50.tmp
c:\windows\system32\SET6C53.tmp
c:\windows\system32\SET6C56.tmp
c:\windows\system32\SET6C57.tmp
c:\windows\system32\SET6C5E.tmp
c:\windows\system32\SET6C5F.tmp
c:\windows\system32\SET6C62.tmp
c:\windows\system32\SET6C65.tmp
c:\windows\system32\SET6C66.tmp
c:\windows\system32\SET6C6F.tmp
c:\windows\system32\SET6C7.tmp
c:\windows\system32\SET6C70.tmp
c:\windows\system32\SET6C73.tmp
c:\windows\system32\SET6C75.tmp
c:\windows\system32\SET6C76.tmp
c:\windows\system32\SET6C77.tmp
c:\windows\system32\SET6C78.tmp
c:\windows\system32\SET6C79.tmp
c:\windows\system32\SET6C7A.tmp
c:\windows\system32\SET6C7E.tmp
c:\windows\system32\SET6C8A.tmp
c:\windows\system32\SET6C8F.tmp
c:\windows\system32\SET6C91.tmp
c:\windows\system32\SET6C93.tmp
c:\windows\system32\SET6C94.tmp
c:\windows\system32\SET6C95.tmp
c:\windows\system32\SET6C98.tmp
c:\windows\system32\SET6C99.tmp
c:\windows\system32\SET6C9D.tmp
c:\windows\system32\SET6C9E.tmp
c:\windows\system32\SET6CA.tmp
c:\windows\system32\SET6CA2.tmp
c:\windows\system32\SET6CA3.tmp
c:\windows\system32\SET6CA9.tmp
c:\windows\system32\SET6CAA.tmp
c:\windows\system32\SET6CAB.tmp
c:\windows\system32\SET6CB2.tmp
c:\windows\system32\SET6CB3.tmp
c:\windows\system32\SET6CB9.tmp
c:\windows\system32\SET6CBA.tmp
c:\windows\system32\SET6CBB.tmp
c:\windows\system32\SET6CBD.tmp
c:\windows\system32\SET6CBF.tmp
c:\windows\system32\SET6CC.tmp
c:\windows\system32\SET6CC5.tmp
c:\windows\system32\SET6CD1.tmp
c:\windows\system32\SET6CD3.tmp
c:\windows\system32\SET6CD5.tmp
c:\windows\system32\SET6CD6.tmp
c:\windows\system32\SET6CD7.tmp
c:\windows\system32\SET6CE3.tmp
c:\windows\system32\SET6CE5.tmp
c:\windows\system32\SET6CE6.tmp
c:\windows\system32\SET6CE9.tmp
c:\windows\system32\SET6CEB.tmp
c:\windows\system32\SET6CEE.tmp
c:\windows\system32\SET6CF9.tmp
c:\windows\system32\SET6CFF.tmp
c:\windows\system32\SET6D0.tmp
c:\windows\system32\SET6D01.tmp
c:\windows\system32\SET6D02.tmp
c:\windows\system32\SET6D03.tmp
c:\windows\system32\SET6D0A.tmp
c:\windows\system32\SET6D0B.tmp
c:\windows\system32\SET6D0E.tmp
c:\windows\system32\SET6D0F.tmp
c:\windows\system32\SET6D10.tmp
c:\windows\system32\SET6D11.tmp
c:\windows\system32\SET6D12.tmp
c:\windows\system32\SET6D14.tmp
c:\windows\system32\SET6D15.tmp
c:\windows\system32\SET6D16.tmp
c:\windows\system32\SET6D18.tmp
c:\windows\system32\SET6D19.tmp
c:\windows\system32\SET6D1A.tmp
c:\windows\system32\SET6D1C.tmp
c:\windows\system32\SET6D1F.tmp
c:\windows\system32\SET6D24.tmp
c:\windows\system32\SET6D25.tmp
c:\windows\system32\SET6D26.tmp
c:\windows\system32\SET6D2B.tmp
c:\windows\system32\SET6D2C.tmp
c:\windows\system32\SET6D2D.tmp
c:\windows\system32\SET6D2F.tmp
c:\windows\system32\SET6D3.tmp
c:\windows\system32\SET6D32.tmp
c:\windows\system32\SET6D34.tmp
c:\windows\system32\SET6D35.tmp
c:\windows\system32\SET6D38.tmp
c:\windows\system32\SET6D39.tmp
c:\windows\system32\SET6D3C.tmp
c:\windows\system32\SET6D3F.tmp
c:\windows\system32\SET6D4.tmp
c:\windows\system32\SET6D40.tmp
c:\windows\system32\SET6D42.tmp
c:\windows\system32\SET6D47.tmp
c:\windows\system32\SET6D49.tmp
c:\windows\system32\SET6D4C.tmp
c:\windows\system32\SET6D5.tmp
c:\windows\system32\SET6D50.tmp
c:\windows\system32\SET6D52.tmp
c:\windows\system32\SET6D53.tmp
c:\windows\system32\SET6D54.tmp
c:\windows\system32\SET6D56.tmp
c:\windows\system32\SET6D57.tmp
c:\windows\system32\SET6D5D.tmp
c:\windows\system32\SET6D5E.tmp
c:\windows\system32\SET6D60.tmp
c:\windows\system32\SET6D61.tmp
c:\windows\system32\SET6D65.tmp
c:\windows\system32\SET6D66.tmp
c:\windows\system32\SET6D67.tmp
c:\windows\system32\SET6D68.tmp
c:\windows\system32\SET6D69.tmp
c:\windows\system32\SET6D6A.tmp
c:\windows\system32\SET6D6B.tmp
c:\windows\system32\SET6D6C.tmp
c:\windows\system32\SET6D6E.tmp
c:\windows\system32\SET6D70.tmp
c:\windows\system32\SET6D72.tmp
c:\windows\system32\SET6D7C.tmp
c:\windows\system32\SET6D7E.tmp
c:\windows\system32\SET6D7F.tmp
c:\windows\system32\SET6D8.tmp
c:\windows\system32\SET6D80.tmp
c:\windows\system32\SET6D82.tmp
c:\windows\system32\SET6D84.tmp
c:\windows\system32\SET6D89.tmp
c:\windows\system32\SET6D8B.tmp
c:\windows\system32\SET6D8C.tmp
c:\windows\system32\SET6D9.tmp
c:\windows\system32\SET6D92.tmp
c:\windows\system32\SET6D9D.tmp
c:\windows\system32\SET6DA.tmp
c:\windows\system32\SET6DA1.tmp
c:\windows\system32\SET6DA2.tmp
c:\windows\system32\SET6DA3.tmp
c:\windows\system32\SET6DA6.tmp
c:\windows\system32\SET6DAE.tmp
c:\windows\system32\SET6DB0.tmp
c:\windows\system32\SET6DB5.tmp
c:\windows\system32\SET6DB7.tmp
c:\windows\system32\SET6DBD.tmp
c:\windows\system32\SET6DC0.tmp
c:\windows\system32\SET6DC2.tmp
c:\windows\system32\SET6DCC.tmp
c:\windows\system32\SET6DD.tmp
c:\windows\system32\SET6DDC.tmp
c:\windows\system32\SET6DE.tmp
c:\windows\system32\SET6DE0.tmp
c:\windows\system32\SET6DE2.tmp
c:\windows\system32\SET6DE4.tmp
c:\windows\system32\SET6DEA.tmp
c:\windows\system32\SET6DEB.tmp
c:\windows\system32\SET6DEE.tmp
c:\windows\system32\SET6DFC.tmp
c:\windows\system32\SET6DFF.tmp
c:\windows\system32\SET6E05.tmp
c:\windows\system32\SET6E07.tmp
c:\windows\system32\SET6E08.tmp
c:\windows\system32\SET6E09.tmp
c:\windows\system32\SET6E0B.tmp
c:\windows\system32\SET6E0F.tmp
c:\windows\system32\SET6E13.tmp
c:\windows\system32\SET6E1A.tmp
c:\windows\system32\SET6E1D.tmp
c:\windows\system32\SET6E1F.tmp
c:\windows\system32\SET6E25.tmp
c:\windows\system32\SET6E2E.tmp
c:\windows\system32\SET6E3.tmp
c:\windows\system32\SET6E33.tmp
c:\windows\system32\SET6E34.tmp
c:\windows\system32\SET6E36.tmp
c:\windows\system32\SET6E37.tmp
c:\windows\system32\SET6E38.tmp
c:\windows\system32\SET6E44.tmp
c:\windows\system32\SET6E49.tmp
c:\windows\system32\SET6E4F.tmp
c:\windows\system32\SET6E5F.tmp
c:\windows\system32\SET6E6.tmp
c:\windows\system32\SET6E60.tmp
c:\windows\system32\SET6E8D.tmp
c:\windows\system32\SET6E9.tmp
c:\windows\system32\SET6E94.tmp
c:\windows\system32\SET6E95.tmp
c:\windows\system32\SET6E96.tmp
c:\windows\system32\SET6E98.tmp
c:\windows\system32\SET6E99.tmp
c:\windows\system32\SET6E9A.tmp
c:\windows\system32\SET6E9D.tmp
c:\windows\system32\SET6E9F.tmp
c:\windows\system32\SET6EA0.tmp
c:\windows\system32\SET6EA2.tmp
c:\windows\system32\SET6EA5.tmp
c:\windows\system32\SET6EA7.tmp
c:\windows\system32\SET6EAC.tmp
c:\windows\system32\SET6EAD.tmp
c:\windows\system32\SET6EB5.tmp
c:\windows\system32\SET6EBC.tmp
c:\windows\system32\SET6EC3.tmp
c:\windows\system32\SET6EC6.tmp
c:\windows\system32\SET6EC9.tmp
c:\windows\system32\SET6ECB.tmp
c:\windows\system32\SET6ECF.tmp
c:\windows\system32\SET6ED.tmp
c:\windows\system32\SET6ED2.tmp
c:\windows\system32\SET6ED3.tmp
c:\windows\system32\SET6ED7.tmp
c:\windows\system32\SET6ED8.tmp
c:\windows\system32\SET6ED9.tmp
c:\windows\system32\SET6EDC.tmp
c:\windows\system32\SET6EDD.tmp
c:\windows\system32\SET6EE2.tmp
c:\windows\system32\SET6EE4.tmp
c:\windows\system32\SET6EE7.tmp
c:\windows\system32\SET6EEA.tmp
c:\windows\system32\SET6EEE.tmp
c:\windows\system32\SET6EF.tmp
c:\windows\system32\SET6EF0.tmp
c:\windows\system32\SET6EF2.tmp
c:\windows\system32\SET6F1.tmp
c:\windows\system32\SET7AE8.tmp
c:\windows\system32\SET7AEB.tmp
c:\windows\system32\SET7AF0.tmp
c:\windows\system32\SET7B22.tmp
c:\windows\system32\setb4.tmp
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At25.job
c:\windows\Tasks\At26.job
c:\windows\Tasks\At27.job
c:\windows\Tasks\At28.job
c:\windows\Tasks\At29.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At30.job
c:\windows\Tasks\At31.job
c:\windows\Tasks\At32.job
c:\windows\Tasks\At33.job
c:\windows\Tasks\At34.job
c:\windows\Tasks\At35.job
c:\windows\Tasks\At36.job
c:\windows\Tasks\At37.job
c:\windows\Tasks\At38.job
c:\windows\Tasks\At39.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At40.job
c:\windows\Tasks\At41.job
c:\windows\Tasks\At42.job
c:\windows\Tasks\At43.job
c:\windows\Tasks\At44.job
c:\windows\Tasks\At45.job
c:\windows\Tasks\At46.job
c:\windows\Tasks\At47.job
c:\windows\Tasks\At48.job
c:\windows\Tasks\At49.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At50.job
c:\windows\Tasks\At51.job
c:\windows\Tasks\At52.job
c:\windows\Tasks\At53.job
c:\windows\Tasks\At54.job
c:\windows\Tasks\At55.job
c:\windows\Tasks\At56.job
c:\windows\Tasks\At57.job
c:\windows\Tasks\At58.job
c:\windows\Tasks\At59.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At60.job
c:\windows\Tasks\At61.job
c:\windows\Tasks\At62.job
c:\windows\Tasks\At63.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
D:\Autorun.inf
.
.
((((((((((((((((((((((((( Files Created from 2012-03-21 to 2012-04-21 )))))))))))))))))))))))))))))))
.
.
2012-04-21 13:46 . 2012-04-13 07:36 6734704 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CAE9FD6E-A603-4326-9570-25CCCE82CD12}\mpengine.dll
2012-04-10 03:30 . 2012-04-10 03:35 ——– d—–w- C:\sh4ldr
2012-04-10 03:30 . 2012-04-10 03:30 ——– d—–w- c:\program files\Enigma Software Group
2012-04-10 03:28 . 2012-04-10 03:35 ——– d—–w- c:\windows\4E0C6314A8B84026AC15084E8B63AFB5.TMP
2012-04-10 03:13 . 2012-04-21 14:10 ——– d—–w- c:\documents and settings\Administrator
2012-04-08 23:04 . 2012-01-31 12:44 237072 ——w- c:\windows\system32\MpSigStub.exe
2012-04-08 22:51 . 2012-04-08 22:52 ——– d—–w- c:\program files\Microsoft Security Client
2012-03-28 03:49 . 2012-03-28 03:49 ——– d—–w- c:\documents and settings\All Users\Application Data\HitmanPro
2012-03-28 03:49 . 2012-03-28 03:49 ——– d—–w- c:\program files\HitmanPro
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-21 13:42 . 2004-08-10 15:43 4143 —-a-w- c:\windows\viassary-hp.reg
2012-04-04 19:56 . 2010-07-21 23:07 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-03-01 11:01 . 2004-09-17 22:12 1469440 ——w- c:\windows\system32\inetcpl.cpl
2012-03-01 11:01 . 2004-09-17 21:38 916992 —-a-w- c:\windows\system32\wininet.dll
2012-03-01 11:01 . 2004-09-17 21:36 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-02-29 14:10 . 2010-08-02 00:47 148480 —-a-w- c:\windows\system32\imagehlp.dll
2012-02-29 14:10 . 2004-09-17 21:38 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-02-29 12:17 . 2004-09-17 22:12 385024 —-a-w- c:\windows\system32\html.iec
2012-02-07 15:02 . 2012-02-07 15:02 1070352 —-a-w- c:\windows\system32\MSCOMCTL.OCX
2012-02-03 09:22 . 2010-08-02 00:47 1860096 —-a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-04-05 77824]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2004-08-10 180269]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-15 233472]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 88209]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2003-12-18 118784]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-04-05 94208]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2003-12-13 33792]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"Persistence"="c:\windows\system32\igfxpers.exe" [2005-04-05 114688]
"SoundMan"="SOUNDMAN.EXE" [2005-04-06 90112]
"AlcWzrd"="ALCWZRD.EXE" [2005-04-06 2805248]
"SsAAD.exe"="c:\progra~1\Sony\SONICS~1\SsAAD.exe" [2005-01-24 81920]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-02-23 278528]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]
"iRiver Updater"="\Updater.exe" [2004-07-01 212992]
"tsnpstd3"="c:\windows\tsnpstd3.exe" [2005-11-04 90112]
"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]
"Computer Alarm Clock"="c:\progra~1\COMPUT~1\cac.exe" [2009-04-08 696320]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-08 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"WTClient"="WTClient.exe" [2007-04-11 40960]
"Nikon Transfer Monitor"="c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe" [2009-05-29 479232]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-25 218496]
.
c:\documents and settings\Compaq_Owner\Start Menu\Programs\Startup\
Compaq Organize.lnk - c:\program files\Hewlett-Packard\Compaq Organize\bin\displayAgent.exe [2004-8-10 36864]
Dropbox.lnk - c:\documents and settings\Administrator\Application Data\Dropbox\bin\Dropbox.exe [N/A]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]
Compaq Connections.lnk - c:\program files\Compaq Connections\6750491\Program\Compaq Connections.exe [2004-8-10 16423]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-10-17 02:55 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Compaq Connections\\6750491\\Program\\Compaq Connections.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Starcraft\\starcraft.exe"=
"c:\\Program Files\\SmartFTP\\SmartFTP.exe"=
"c:\\WINDOWS\\system32\\skcbgm.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Pruna\\Pruna.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Sierra\\SWAT 4\\Content\\System\\Swat4.exe"=
"c:\\Program Files\\Sierra\\SWAT 4\\Content\\System\\Swat4DedicatedServer.exe"=
"c:\\WINDOWS\\system32\\pdrtvsvr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Sierra\\SWAT 4\\ContentExpansion\\System\\swat4X.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\StarCraft II Beta\\StarCraft II.exe"=
"c:\\Program Files\\StarCraft II Beta\\Versions\\Base14356\\SC2.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsasvr.exe"=
"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsvsvr.exe"=
"c:\\Documents and Settings\\Compaq_Owner\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Rogers Online Protection\\Rogers Servicepoint Agent\\ServicepointService.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\Compaq_Owner\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Program Files\\Cytoscape_v2.8.2\\Cytoscape.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"6881:TCP"= 6881:TCP:Blizzard Downloader: 6881
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [8/10/2006 10:23 AM 639224]
R2 ServicepointService;ServicepointService;c:\program files\Rogers Online Protection\Rogers Servicepoint Agent\ServicepointService.exe [1/30/2011 10:34 AM 689464]
R3 PTSimBus;PenTablet Bus Enumerator;c:\windows\system32\drivers\PTSimBus.sys [6/7/2007 1:16 PM 18944]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [12/4/2008 2:50 PM 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12/4/2008 2:50 PM 67656]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 2:16 PM 130384]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [6/28/2010 8:20 PM 237984]
S2 PV8630;USB Scan 600 Device Driver;c:\windows\system32\drivers\PV8630.sys [2/4/2005 7:24 PM 20232]
S2 RogersUpdateManager;Rogers Update Manager;c:\program files\Rogers\Update Manager\RogersUpdateManager.exe [4/7/2008 8:57 AM 163840]
S3 cdspacex;cdspacex;c:\windows\system32\DRIVERS\CDSPACEX.sys –> c:\windows\system32\DRIVERS\CDSPACEX.sys [?]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [6/28/2010 8:20 PM 36608]
S3 PTSimHid;PenTablet Simulated HID MiniDriver;c:\windows\system32\drivers\PTSimHid.sys [4/23/2007 11:28 AM 10752]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [12/4/2008 2:50 PM 12872]
S3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\drivers\sscebus.sys [6/28/2010 8:21 PM 90240]
S3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\drivers\sscemdfl.sys [6/28/2010 8:21 PM 14976]
S3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\drivers\sscemdm.sys [6/28/2010 8:21 PM 121856]
S3 TwoRabts;Two Rabbits Live Bus;c:\windows\system32\DRIVERS\TwoRabts.sys –> c:\windows\system32\DRIVERS\TwoRabts.sys [?]
S3 vaxscsi;vaxscsi;c:\windows\system32\drivers\vaxscsi.sys [3/18/2006 9:49 PM 223128]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 2:16 PM 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
getPlusHelper REG_MULTI_SZ getPlusHelper
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
2009-03-08 08:32 128512 —-a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2012-04-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
.
2012-04-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1035403148-196709140-681716934-1009Core1cb6f87e96545ac.job
- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-08-01 15:39]
.
2012-04-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1035403148-196709140-681716934-1009UA.job
- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-08-01 15:39]
.
2012-04-21 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 19:39]
.
.
——- Supplementary Scan ——-
.
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=presario&pf=desktop
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
Trusted Zone: buddybuddy.co.kr
TCP: DhcpNameServer = [removed]
Handler: spotfire - {0937B384-6404-4E4A-B271-F2DC6B1199FE} - c:\program files\Spotfire\Packages\Spotfire.Package.ClientRuntime_19.1.1518\bin\SfPackageManager.dll
DPF: {04E7BADF-F3B9-420D-B82D-8D8CADEFE4F9} - hxxp://cyimg7.cyworld.nate.com/ImageUpload/CyImageUpload2.cab
DPF: {1DE9BB01-B121-401D-8877-BCD5ED5B7EE5} - hxxp://www.crezio.com/test/leeyunho/AlwaysOn/AlwaysOn.CAB
DPF: {217CA616-08DD-4783-9DE3-9AE02F4EB2D0} - hxxp://dr-clean.co.kr/install/nochk/drclean.cab
DPF: {243C3672-9526-40AA-BE22-988F92CFA591} - hxxp://nclean.co.kr/install/nclean.cab
DPF: {24A04430-81DA-467A-BE87-774DFAECBBF6} - hxxp://cyimg7.cyworld.nate.com/storyRoom/CyImageResizeCtl.cab
DPF: {4C833081-D026-4FF8-968F-7EAB660D2FBA} - hxxp://www.sc2.org/misc/tvants.cab
DPF: {5066F781-0BDF-4A28-A7B5-5EF4F7DC6F21} - hxxp://mptop.cyworld.nate.com/activex/CyworldMovieUpload.cab
DPF: {68253470-5D4F-4CDF-8D9C-353C14A2F013} - hxxp://221.139.0.179/pandora/SVPorsche.cab
DPF: {695D7312-9B91-42E8-8893-75419A2873EC} - hxxp://ftp.entica.com/EnLaunch/SeM/ssunit.cab
DPF: {6A2E758A-028B-46BB-A11D-0608AB5A4ED3} - hxxp://listen.daum.net/52st/bgmplayer/Daum52stBGMPlayer.cab
DPF: {7E9FDB80-5316-11D4-B02C-00C04F0CD404} - hxxp://ebank.keb.co.kr/XecureObject/xw_install.cab
DPF: {8DC067B8-911D-473A-90F1-1171B887CDE0} - hxxp://cyimg8.cyworld.com/ImageUpload/CyPictureU1233.cab?20081124
DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} - hxxp://cafeimg.hanmail.net/cab9_1/dmcc2.cab?Version=1,0,0,10
DPF: {93F79C47-F414-4EEE-95C5-A0F0ACE59A0E} - hxxp://www.altools.co.kr/ALDX.cab
DPF: {A00B2A53-60D9-4477-ADA3-60490770C5E0} - hxxp://mail.daum.net/hanmail-ax/hanmail.cab
DPF: {A671DC03-71D0-4CF0-895C-7D4A248FC1F1} - hxxp://cyimg7.cyworld.nate.com/cymusic/package/skcbgmset.cab
DPF: {AD906BA4-9679-4A50-94C6-D677526BB92A} - hxxp://cyimg2.cyworld.nate.com/ImageUpload/CyImageUpload.cab
DPF: {B005D02C-E461-4851-8A79-C7FDC8563C07} - hxxp://www.buddybuddy.co.kr/cab/BBNPort.cab
DPF: {B976AEC6-BEB2-4B98-B21C-7AB1C2B4E8E9} - hxxp://goalibaba.com/setup/CAXAlibabaA.cab
DPF: {B9B38E70-EEF6-4E3A-AE84-DDE59A053B7C} - hxxp://mail.daum.net/hanmail-ax/DaumActiveX/2_0_0_4/DaumActiveX.cab?ver=2,0,0,4
DPF: {BCA935CA-7E41-4F73-BA9C-FAB4393DBAC0} - hxxp://www.csafer.net/ActiveX/MAStreamCtrl.cab
DPF: {D089883E-7AD7-471E-818D-6797966F9A2B} - hxxp://www.zeromovie.com/spy_dr/download/SpyDoctorRun.cab
DPF: {D4B8CB6E-3445-4553-B717-750CEFA98B3E} - hxxp://down.adscan.co.kr/adscan/activex/ADScanInstaller.cab
DPF: {D572CD64-9310-4712-8FFC-A4F9DC9D4AC1} - hxxp://qbic.hanafos.com/component/QbicUpdate.CAB
DPF: {D8798B2A-5EB1-424A-AB19-E38CFB69E295} - hxxp://mptop.cyworld.nate.com/activex/CyworldMovieUp.cab
DPF: {D885750C-6002-460E-A162-713400FB1FD4} - hxxp://www.goalibaba.com/setup/CActiveXFileCtrl.cab
DPF: {D95F5F60-5BB7-4655-BACE-FC5371EFC3E0} - hxxp://update.nprotect.net/nprotect/keb/npx2.cab
DPF: {DDE6FED7-88AB-405B-9D77-FD4CDA8B9EB5} - hxxp://qbic.hanafos.com/component/Qbic.CAB
DPF: {E1CDC08F-F464-4682-AE6A-7689451387C0} - hxxp://cafeimg.hanmail.net/activex/dmcm.cab?Version=1,0,0,21
DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} - hxxps://www.vpay.co.kr/kvpfiles/KVPISPCTLD.cab
DPF: {F36C3235-C4AF-409F-B6A1-4F96BB1B533E} - hxxp://fs1.us.cyworld.com/common/activex/CyGlobal.cab
DPF: {F4A1D5E2-AF49-47A7-A945-23038106F3A4} - hxxp://imgcdn.pandora.tv/pan_img/launcher/codebase/Pandora_SetUpAX.cab
DPF: {FCEAE646-DCF9-4D59-B994-6BD30A315139} - hxxp://www.mtv.com/overdrive/bin/MTVNAlerts1.0.exe
FF - ProfilePath - c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\t3dx7xat.default\
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - www.google.ca
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13161&gct=&gc=1&q=
FF - Ext: QuickStores-Toolbar: [removed] - c:\program files\Mozilla Firefox\extensions\[removed]
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: PlayBryte: [removed] - %profile%\extensions\[removed]
FF - Ext: Yontoo Layers: [removed] - %profile%\extensions\[removed]
FF - Ext: QuickStores-Toolbar: [removed] - %profile%\extensions\[removed]
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: PriceGong: {8A9386B4-E958-4c4c-ADF4-8F26DB3E4829} - %profile%\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{05417E8D-D8CB-433B-AB76-6BA4E5C062F7} - (no file)
BHO-{06FB63F7-3609-448B-8D8B-C0F0A075ACEC} - (no file)
BHO-{11E9248D-2034-4B3D-B58B-A9FF2ADE5171} - (no file)
BHO-{18BB8F7A-0289-473D-970E-55B6D3DC8FC0} - (no file)
BHO-{257B5DFE-38EC-4596-AE20-1197BEC1E238} - (no file)
BHO-{4C3F9648-ABBD-4F3A-8C4D-476EDD24CE51} - (no file)
BHO-{4FEB3E56-3DED-4340-9597-45F8C7979212} - (no file)
BHO-{5455E891-8814-4D8F-835F-3D65F7A3D2A8} - (no file)
BHO-{56AC91A5-21A0-4169-8A00-DA90D22CBB89} - (no file)
BHO-{5C57F173-E6A9-4F3E-A28D-719D2E207D5C} - (no file)
BHO-{60D97CCB-B33F-4700-A459-84D7E5E8BC1D} - (no file)
BHO-{613B0A32-10DD-43AB-8606-D40C7EA25225} - (no file)
BHO-{72a4e634-2b5f-4623-9c5a-1cdf911bc1c1} - (no file)
BHO-{7373D144-6B71-4584-8429-ABB23858AB03} - (no file)
BHO-{77fd6e4c-8167-4c1a-b126-ca77ea4d27ae} - (no file)
BHO-{78297916-E517-47B4-B291-20FAFD328F63} - (no file)
BHO-{82EFC2F3-5604-455A-BE7B-A324F78EF9CB} - (no file)
BHO-{855D2F4C-38CE-4637-A8C6-C12E6342947B} - (no file)
BHO-{88B6B972-9436-4F14-84EF-C6C086E44F08} - (no file)
BHO-{8d82bcf9-fff3-46d5-8698-41201224809c} - (no file)
BHO-{8E313305-F619-49AD-AF87-150F1D7BEBA8} - (no file)
BHO-{917e1ea6-bb22-4072-8a2b-0f38235fb253} - (no file)
BHO-{AE660DE3-3622-46D4-ACEF-471AB1370E0F} - (no file)
BHO-{B0F91A66-6EB8-4247-91D1-3D6C336D031F} - (no file)
BHO-{B6B41949-05D3-42E0-9EAE-98505549C5E6} - (no file)
BHO-{CA8E46C4-CFFC-440F-B002-2F9F63C9D90B} - (no file)
BHO-{CF11B797-70AB-4A7D-A9C8-B322EA19AF01} - (no file)
BHO-{DB46DD90-2F0A-4ECA-9EDB-F129905D476B} - (no file)
BHO-{E9964733-3E3E-41A4-BC50-9500E34AFF1F} - (no file)
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
HKLM-Run-NPSStartup - (no file)
HKLM-Run-VTTimer - VTTimer.exe
Notify-yayaXNFY - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-04-21 10:13
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(492)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
Completion time: 2012-04-21 10:17:09
ComboFix-quarantined-files.txt 2012-04-21 14:17
.
Pre-Run: 19,602,325,504 bytes free
Post-Run: 20,249,763,840 bytes free
.
- - End Of File - - EB3D1EB649E04E0EACF5D3B8782D4E35

Hi,

Here are the logs!

I don't think I have any outstanding issue.

Please let me know if more steps should be taken.

Regards,
Foxx


ComboFix 12-04-19.02 - Administrator 3/2012 Mon 19:58:24.4.1 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.949.82.1033.18.1535.1188 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Compaq_Owner\Desktop\CFScript.txt
AV: BitDefender Professional Edition v7.2 *Disabled/Outdated* {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
FW: BitDefender Professional Edition v7.2 *Disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
.
Error: Cfiles.dat
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\t3dx7xat.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}
c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\t3dx7xat.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome.manifest
c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\t3dx7xat.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\content\options.js
c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\t3dx7xat.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\content\options.xul
c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\t3dx7xat.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\content\overlay.js
c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\t3dx7xat.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\content\PriceGong.png
c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\t3dx7xat.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\content\pricegong.xul
c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\t3dx7xat.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\locale\en-US\overlay.dtd
c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\t3dx7xat.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\locale\en-US\pricegong.dtd
c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\t3dx7xat.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\skin\overlay.css
c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\t3dx7xat.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\components\PriceGong.xpt
c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\t3dx7xat.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\components\PriceGongFF.dll
c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\t3dx7xat.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\install.rdf
c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\t3dx7xat.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\modules\Observers.js
c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\t3dx7xat.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\modules\pricegong.js
c:\documents and settings\NetworkService\Application Data\uid_pal
.
.
((((((((((((((((((((((((( Files Created from 2012-03-24 to 2012-04-24 )))))))))))))))))))))))))))))))
.
.
2012-04-23 23:01 . 2012-04-13 07:36 6734704 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{34CC68EA-D8BA-49AC-B74D-1A91EE789DAE}\mpengine.dll
2012-04-22 15:11 . 2012-04-13 07:36 6734704 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-04-10 03:30 . 2012-04-10 03:35 ——– d—–w- C:\sh4ldr
2012-04-10 03:30 . 2012-04-10 03:30 ——– d—–w- c:\program files\Enigma Software Group
2012-04-10 03:28 . 2012-04-10 03:35 ——– d—–w- c:\windows\4E0C6314A8B84026AC15084E8B63AFB5.TMP
2012-04-10 03:13 . 2012-04-21 14:10 ——– d—–w- c:\documents and settings\Administrator
2012-04-08 23:04 . 2012-01-31 12:44 237072 ——w- c:\windows\system32\MpSigStub.exe
2012-04-08 22:51 . 2012-04-08 22:52 ——– d—–w- c:\program files\Microsoft Security Client
2012-03-28 03:49 . 2012-03-28 03:49 ——– d—–w- c:\documents and settings\All Users\Application Data\HitmanPro
2012-03-28 03:49 . 2012-03-28 03:49 ——– d—–w- c:\program files\HitmanPro
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-23 23:41 . 2004-08-10 15:43 4143 —-a-w- c:\windows\viassary-hp.reg
2012-04-04 19:56 . 2010-07-21 23:07 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-03-01 11:01 . 2004-09-17 22:12 1469440 ——w- c:\windows\system32\inetcpl.cpl
2012-03-01 11:01 . 2004-09-17 21:38 916992 —-a-w- c:\windows\system32\wininet.dll
2012-03-01 11:01 . 2004-09-17 21:36 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-02-29 14:10 . 2010-08-02 00:47 148480 —-a-w- c:\windows\system32\imagehlp.dll
2012-02-29 14:10 . 2004-09-17 21:38 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-02-29 12:17 . 2004-09-17 22:12 385024 —-a-w- c:\windows\system32\html.iec
2012-02-07 15:02 . 2012-02-07 15:02 1070352 —-a-w- c:\windows\system32\MSCOMCTL.OCX
2012-02-03 09:22 . 2010-08-02 00:47 1860096 —-a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2012-04-21_14.13.42 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-04-05 77824]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2004-08-10 180269]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-15 233472]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 88209]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2003-12-18 118784]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-04-05 94208]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2003-12-13 33792]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"Persistence"="c:\windows\system32\igfxpers.exe" [2005-04-05 114688]
"SoundMan"="SOUNDMAN.EXE" [2005-04-06 90112]
"AlcWzrd"="ALCWZRD.EXE" [2005-04-06 2805248]
"SsAAD.exe"="c:\progra~1\Sony\SONICS~1\SsAAD.exe" [2005-01-24 81920]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-02-23 278528]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]
"iRiver Updater"="\Updater.exe" [2004-07-01 212992]
"tsnpstd3"="c:\windows\tsnpstd3.exe" [2005-11-04 90112]
"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]
"Computer Alarm Clock"="c:\progra~1\COMPUT~1\cac.exe" [2009-04-08 696320]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-08 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"WTClient"="WTClient.exe" [2007-04-11 40960]
"Nikon Transfer Monitor"="c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe" [2009-05-29 479232]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-25 218496]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]
Compaq Connections.lnk - c:\program files\Compaq Connections\6750491\Program\Compaq Connections.exe [2004-8-10 16423]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-10-17 02:55 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Compaq Connections\\6750491\\Program\\Compaq Connections.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Starcraft\\starcraft.exe"=
"c:\\Program Files\\SmartFTP\\SmartFTP.exe"=
"c:\\WINDOWS\\system32\\skcbgm.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Pruna\\Pruna.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Sierra\\SWAT 4\\Content\\System\\Swat4.exe"=
"c:\\Program Files\\Sierra\\SWAT 4\\Content\\System\\Swat4DedicatedServer.exe"=
"c:\\WINDOWS\\system32\\pdrtvsvr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Sierra\\SWAT 4\\ContentExpansion\\System\\swat4X.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\StarCraft II Beta\\StarCraft II.exe"=
"c:\\Program Files\\StarCraft II Beta\\Versions\\Base14356\\SC2.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsasvr.exe"=
"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsvsvr.exe"=
"c:\\Documents and Settings\\Compaq_Owner\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Rogers Online Protection\\Rogers Servicepoint Agent\\ServicepointService.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\Compaq_Owner\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Program Files\\Cytoscape_v2.8.2\\Cytoscape.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"6881:TCP"= 6881:TCP:Blizzard Downloader: 6881
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [8/10/2006 10:23 AM 639224]
R2 ServicepointService;ServicepointService;c:\program files\Rogers Online Protection\Rogers Servicepoint Agent\ServicepointService.exe [1/30/2011 10:34 AM 689464]
R3 PTSimBus;PenTablet Bus Enumerator;c:\windows\system32\drivers\PTSimBus.sys [6/7/2007 1:16 PM 18944]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [12/4/2008 2:50 PM 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12/4/2008 2:50 PM 67656]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 2:16 PM 130384]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [6/28/2010 8:20 PM 237984]
S2 PV8630;USB Scan 600 Device Driver;c:\windows\system32\drivers\PV8630.sys [2/4/2005 7:24 PM 20232]
S2 RogersUpdateManager;Rogers Update Manager;c:\program files\Rogers\Update Manager\RogersUpdateManager.exe [4/7/2008 8:57 AM 163840]
S3 cdspacex;cdspacex;c:\windows\system32\DRIVERS\CDSPACEX.sys –> c:\windows\system32\DRIVERS\CDSPACEX.sys [?]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [6/28/2010 8:20 PM 36608]
S3 PTSimHid;PenTablet Simulated HID MiniDriver;c:\windows\system32\drivers\PTSimHid.sys [4/23/2007 11:28 AM 10752]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [12/4/2008 2:50 PM 12872]
S3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\drivers\sscebus.sys [6/28/2010 8:21 PM 90240]
S3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\drivers\sscemdfl.sys [6/28/2010 8:21 PM 14976]
S3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\drivers\sscemdm.sys [6/28/2010 8:21 PM 121856]
S3 TwoRabts;Two Rabbits Live Bus;c:\windows\system32\DRIVERS\TwoRabts.sys –> c:\windows\system32\DRIVERS\TwoRabts.sys [?]
S3 vaxscsi;vaxscsi;c:\windows\system32\drivers\vaxscsi.sys [3/18/2006 9:49 PM 223128]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 2:16 PM 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
getPlusHelper REG_MULTI_SZ getPlusHelper
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
2009-03-08 08:32 128512 —-a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2012-04-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
.
2012-04-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1035403148-196709140-681716934-1009Core1cb6f87e96545ac.job
- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-08-01 15:39]
.
2012-04-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1035403148-196709140-681716934-1009UA.job
- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-08-01 15:39]
.
2012-04-23 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 19:39]
.
.
——- Supplementary Scan ——-
.
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=presario&pf=desktop
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
Trusted Zone: buddybuddy.co.kr
TCP: DhcpNameServer = [removed]
Handler: spotfire - {0937B384-6404-4E4A-B271-F2DC6B1199FE} - c:\program files\Spotfire\Packages\Spotfire.Package.ClientRuntime_19.1.1518\bin\SfPackageManager.dll
DPF: {04E7BADF-F3B9-420D-B82D-8D8CADEFE4F9} - hxxp://cyimg7.cyworld.nate.com/ImageUpload/CyImageUpload2.cab
DPF: {1DE9BB01-B121-401D-8877-BCD5ED5B7EE5} - hxxp://www.crezio.com/test/leeyunho/AlwaysOn/AlwaysOn.CAB
DPF: {217CA616-08DD-4783-9DE3-9AE02F4EB2D0} - hxxp://dr-clean.co.kr/install/nochk/drclean.cab
DPF: {243C3672-9526-40AA-BE22-988F92CFA591} - hxxp://nclean.co.kr/install/nclean.cab
DPF: {24A04430-81DA-467A-BE87-774DFAECBBF6} - hxxp://cyimg7.cyworld.nate.com/storyRoom/CyImageResizeCtl.cab
DPF: {4C833081-D026-4FF8-968F-7EAB660D2FBA} - hxxp://www.sc2.org/misc/tvants.cab
DPF: {5066F781-0BDF-4A28-A7B5-5EF4F7DC6F21} - hxxp://mptop.cyworld.nate.com/activex/CyworldMovieUpload.cab
DPF: {68253470-5D4F-4CDF-8D9C-353C14A2F013} - hxxp://221.139.0.179/pandora/SVPorsche.cab
DPF: {695D7312-9B91-42E8-8893-75419A2873EC} - hxxp://ftp.entica.com/EnLaunch/SeM/ssunit.cab
DPF: {6A2E758A-028B-46BB-A11D-0608AB5A4ED3} - hxxp://listen.daum.net/52st/bgmplayer/Daum52stBGMPlayer.cab
DPF: {7E9FDB80-5316-11D4-B02C-00C04F0CD404} - hxxp://ebank.keb.co.kr/XecureObject/xw_install.cab
DPF: {8DC067B8-911D-473A-90F1-1171B887CDE0} - hxxp://cyimg8.cyworld.com/ImageUpload/CyPictureU1233.cab?20081124
DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} - hxxp://cafeimg.hanmail.net/cab9_1/dmcc2.cab?Version=1,0,0,10
DPF: {93F79C47-F414-4EEE-95C5-A0F0ACE59A0E} - hxxp://www.altools.co.kr/ALDX.cab
DPF: {A00B2A53-60D9-4477-ADA3-60490770C5E0} - hxxp://mail.daum.net/hanmail-ax/hanmail.cab
DPF: {A671DC03-71D0-4CF0-895C-7D4A248FC1F1} - hxxp://cyimg7.cyworld.nate.com/cymusic/package/skcbgmset.cab
DPF: {AD906BA4-9679-4A50-94C6-D677526BB92A} - hxxp://cyimg2.cyworld.nate.com/ImageUpload/CyImageUpload.cab
DPF: {B005D02C-E461-4851-8A79-C7FDC8563C07} - hxxp://www.buddybuddy.co.kr/cab/BBNPort.cab
DPF: {B976AEC6-BEB2-4B98-B21C-7AB1C2B4E8E9} - hxxp://goalibaba.com/setup/CAXAlibabaA.cab
DPF: {B9B38E70-EEF6-4E3A-AE84-DDE59A053B7C} - hxxp://mail.daum.net/hanmail-ax/DaumActiveX/2_0_0_4/DaumActiveX.cab?ver=2,0,0,4
DPF: {BCA935CA-7E41-4F73-BA9C-FAB4393DBAC0} - hxxp://www.csafer.net/ActiveX/MAStreamCtrl.cab
DPF: {D089883E-7AD7-471E-818D-6797966F9A2B} - hxxp://www.zeromovie.com/spy_dr/download/SpyDoctorRun.cab
DPF: {D4B8CB6E-3445-4553-B717-750CEFA98B3E} - hxxp://down.adscan.co.kr/adscan/activex/ADScanInstaller.cab
DPF: {D572CD64-9310-4712-8FFC-A4F9DC9D4AC1} - hxxp://qbic.hanafos.com/component/QbicUpdate.CAB
DPF: {D8798B2A-5EB1-424A-AB19-E38CFB69E295} - hxxp://mptop.cyworld.nate.com/activex/CyworldMovieUp.cab
DPF: {D885750C-6002-460E-A162-713400FB1FD4} - hxxp://www.goalibaba.com/setup/CActiveXFileCtrl.cab
DPF: {D95F5F60-5BB7-4655-BACE-FC5371EFC3E0} - hxxp://update.nprotect.net/nprotect/keb/npx2.cab
DPF: {DDE6FED7-88AB-405B-9D77-FD4CDA8B9EB5} - hxxp://qbic.hanafos.com/component/Qbic.CAB
DPF: {E1CDC08F-F464-4682-AE6A-7689451387C0} - hxxp://cafeimg.hanmail.net/activex/dmcm.cab?Version=1,0,0,21
DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} - hxxps://www.vpay.co.kr/kvpfiles/KVPISPCTLD.cab
DPF: {F36C3235-C4AF-409F-B6A1-4F96BB1B533E} - hxxp://fs1.us.cyworld.com/common/activex/CyGlobal.cab
DPF: {F4A1D5E2-AF49-47A7-A945-23038106F3A4} - hxxp://imgcdn.pandora.tv/pan_img/launcher/codebase/Pandora_SetUpAX.cab
DPF: {FCEAE646-DCF9-4D59-B994-6BD30A315139} - hxxp://www.mtv.com/overdrive/bin/MTVNAlerts1.0.exe
FF - ProfilePath -
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-04-23 20:09
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(492)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
Completion time: 2012-04-23 20:11:50
ComboFix-quarantined-files.txt 2012-04-24 00:11
ComboFix2.txt 2012-04-21 14:17
.
Pre-Run: 19,828,310,016 bytes free
Post-Run: 19,802,791,936 bytes free
.
- - End Of File - - 021A84930773BDF7130F78F455A0006F










Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.04.24.01

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Compaq_Owner :: YOUR-7008FFA13B [administrator]

2012-04-24 오전 12:53:33
mbam-log-2012-04-24 (00-53-33).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 238510
Time elapsed: 14 minute(s), 10 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)