What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

S.M.A.R.T repair [Solved]

36 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Run OTL
  • double click on the icon to run it.
  • copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:OTL
[2012/05/20 22:49:45 | 000,086,016 | —- | M] () – C:\ProgramData\cecaeadcaffcdct.exe

:Files
C:\windows\assembly\GAC\Desktop.ini
C:\ProgramData\lWJuExPgDuPCqd.exe

:Commands
[purity]
[Reboot]

  • click the Run Fix button at the top
  • let the program run unhindered, reboot when it is done
  • post a new OTL log (don't check the boxes beside LOP Check or Purity this time)
==========================================

Please download Rkill from one of the following links and save to your Desktop:

Link 1
Link 2
Link 3
Link 4
  • double click on Rkill.
  • a command window will open then disappear upon completion, this is normal.
  • please leave Rkill on the Desktop until otherwise advised.
Note: If your security software warns about Rkill, please ignore and allow the download to continue.

============================================

After running rkill, try running ComboFix again.

Logs to include in the next post:

OTL fix log
New OTL log
ComboFix.txt

Satchfan
Post #17 last edited
Ok, OTL log:


OTL logfile created on: 5/21/2012 11:21:57 PM - Run 2
OTL by OldTimer - Version 3.2.43.1 Folder = C:\Users\Liam\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

2.70 Gb Total Physical Memory | 1.10 Gb Available Physical Memory | 40.61% Memory free
5.40 Gb Paging File | 3.28 Gb Available in Paging File | 60.71% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.03 Gb Total Space | 200.30 Gb Free Space | 44.02% Space Free | Partition Type: NTFS

Computer Name: LIAM-PC | User Name: Liam | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/05/21 12:22:37 | 000,595,968 | —- | M] (OldTimer Tools) – C:\Users\Liam\Desktop\OTL.exe
PRC - [2012/05/21 11:33:47 | 000,399,264 | —- | M] (Bleeping Computer, LLC) – C:\Users\Liam\Desktop\unhide.exe
PRC - [2012/05/09 13:03:31 | 000,096,752 | —- | M] (Google Inc.) – C:\Users\Liam\AppData\Local\Google\Chrome\Application\19.0.1084.46\chrome_frame_helper.exe
PRC - [2012/04/07 16:06:59 | 030,236,672 | —- | M] () – C:\ProgramData\BOINC\slots\3\primegrid_cllr.exe
PRC - [2012/04/07 16:06:50 | 000,495,616 | —- | M] () – C:\ProgramData\BOINC\projects\www.primegrid.com\primegrid_llr_wrapper_6.13_windows_intelx86.exe
PRC - [2012/04/04 12:05:54 | 003,654,832 | —- | M] (Space Sciences Laboratory) – C:\Program Files\BOINC\boincmgr.exe
PRC - [2012/04/04 12:05:50 | 000,070,832 | —- | M] (Space Sciences Laboratory) – C:\Program Files\BOINC\boinctray.exe
PRC - [2012/04/04 12:05:46 | 000,930,992 | —- | M] (Space Sciences Laboratory) – C:\Program Files\BOINC\boinc.exe
PRC - [2012/03/13 15:34:36 | 002,330,624 | —- | M] (Totem Entertainment) – C:\Users\Liam\AppData\Local\vghd\bin\vghd.exe
PRC - [2012/02/27 23:44:06 | 001,006,864 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe
PRC - [2012/02/27 23:44:06 | 000,133,424 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe
PRC - [2012/02/17 12:43:48 | 000,694,272 | —- | M] (Totem Entertainment) – C:\Users\Liam\AppData\Local\vghd\bin\Virtuagirl_Downloader.exe
PRC - [2012/02/15 09:03:14 | 024,246,216 | —- | M] (Dropbox, Inc.) – C:\Users\Liam\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2011/12/12 14:33:46 | 001,760,328 | —- | M] (ManyCam LLC) – C:\Program Files\ManyCam\Bin\ManyCam.exe
PRC - [2011/11/15 18:05:38 | 001,660,232 | —- | M] (Bootstrap Software Development) – C:\Program Files\Common Files\BSD\AppUpdater\BSDChecker.exe
PRC - [2011/11/09 21:43:22 | 000,784,384 | —- | M] () – C:\ProgramData\BOINC\projects\climateprediction.net\hadam3p_eu_6.09_windows_intelx86.exe
PRC - [2011/10/26 00:59:16 | 000,244,960 | —- | M] () – C:\Program Files\StartNow Toolbar\ToolbarUpdaterService.exe
PRC - [2011/10/21 23:54:32 | 001,242,448 | —- | M] (Valve Corporation) – C:\Program Files\Steam\Steam.exe
PRC - [2011/10/08 18:20:56 | 000,200,632 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
PRC - [2011/10/08 18:20:56 | 000,142,952 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
PRC - [2011/07/29 09:08:12 | 001,259,376 | —- | M] () – C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2011/06/29 12:26:06 | 000,520,216 | —- | M] (Ant.com) – C:\Program Files\Ant.com\IE add-on\AntUpdaterService.exe
PRC - [2011/06/29 12:25:00 | 003,179,544 | —- | M] (Ant.com) – C:\Program Files\Ant.com\IE add-on\AntMaintainer.exe
PRC - [2011/06/24 14:22:20 | 000,271,360 | —- | M] (Microsoft Corporation) – C:\Windows\System32\conhost.exe
PRC - [2011/06/09 12:06:06 | 000,507,624 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Common Files\Java\Java Update\jucheck.exe
PRC - [2011/04/07 06:48:56 | 000,156,888 | —- | M] () – C:\Program Files\Alexa Toolbar\AlexaToolbarSSB.10.0.dll
PRC - [2011/03/03 08:39:06 | 000,468,904 | —- | M] (TOSHIBA Corporation) – C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
PRC - [2011/03/03 04:07:04 | 002,745,760 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe
PRC - [2011/03/03 03:28:40 | 000,521,640 | —- | M] (TOSHIBA Corporation) – C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
PRC - [2011/02/25 15:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2011/02/25 00:01:00 | 004,220,416 | —- | M] () – C:\ProgramData\BOINC\projects\climateprediction.net\hadrm3p_eu_um_6.09_windows_intelx86.exe
PRC - [2011/02/25 00:00:59 | 004,398,592 | —- | M] () – C:\ProgramData\BOINC\projects\climateprediction.net\hadam3p_eu_um_6.09_windows_intelx86.exe
PRC - [2011/02/02 06:20:48 | 002,656,280 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe
PRC - [2011/02/02 06:20:46 | 000,326,168 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe
PRC - [2010/12/21 00:07:48 | 000,227,712 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
PRC - [2010/12/16 08:21:44 | 000,844,152 | —- | M] (TOSHIBA Corporation) – C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
PRC - [2010/12/15 10:53:34 | 000,031,648 | —- | M] (TOSHIBA Corporation) – C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
PRC - [2010/12/10 10:43:20 | 000,468,392 | —- | M] (TOSHIBA Corporation) – C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
PRC - [2010/12/09 08:36:08 | 000,112,032 | —- | M] (TOSHIBA Corporation) – C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
PRC - [2010/12/09 08:35:36 | 001,021,344 | —- | M] (TOSHIBA Corporation) – C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
PRC - [2010/12/04 07:57:16 | 000,304,560 | —- | M] (TOSHIBA CORPORATION) – C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
PRC - [2010/11/21 07:29:19 | 000,049,152 | —- | M] (Microsoft Corporation) – C:\Windows\System32\taskhost.exe
PRC - [2010/10/21 07:40:00 | 000,128,416 | —- | M] (TOSHIBA Corporation) – C:\Windows\System32\TODDSrv.exe
PRC - [2010/09/07 09:18:00 | 000,746,384 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtHSP.exe
PRC - [2010/08/26 16:48:00 | 000,285,152 | —- | M] () – C:\Program Files\NETGEAR\WNA3100\WifiSvc.exe
PRC - [2010/08/24 09:12:00 | 000,677,264 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosA2dp.exe
PRC - [2010/08/24 09:12:00 | 000,087,440 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe
PRC - [2010/05/11 13:53:16 | 000,055,808 | —- | M] (Sanford, L.P.) – C:\Program Files\DYMO\DYMO Label Software\DLSService.exe
PRC - [2010/05/04 15:47:18 | 002,044,248 | —- | M] (Symantec Corporation) – C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe
PRC - [2010/04/13 03:46:00 | 000,152,944 | —- | M] (TOSHIBA CORPORATION) – C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe
PRC - [2010/02/03 09:35:21 | 000,103,792 | R— | M] (Symantec Corporation) – C:\Program Files\Norton PC Checkup\Engine\2.0.3.202\SymcPCCULaunchSvc.exe
PRC - [2010/01/29 09:44:24 | 000,185,712 | —- | M] (TOSHIBA CORPORATION) – C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe
PRC - [2010/01/15 22:49:20 | 000,255,536 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2009/08/25 08:49:41 | 000,126,392 | R— | M] (Symantec Corporation) – C:\Program Files\Norton PC Checkup\Engine\2.0.3.202\ccSvcHst.exe
PRC - [2009/07/29 13:26:42 | 000,062,848 | —- | M] (TOSHIBA CORPORATION) – C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
PRC - [2009/03/11 11:51:20 | 000,046,448 | —- | M] (TOSHIBA CORPORATION) – C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe


========== Modules (No Company Name) ==========

MOD - [2012/05/19 21:12:24 | 020,313,384 | —- | M] () – C:\Program Files\Steam\bin\libcef.dll
MOD - [2012/05/19 21:12:23 | 001,099,576 | —- | M] () – C:\Program Files\Steam\bin\avcodec-53.dll
MOD - [2012/05/19 21:12:23 | 000,895,312 | —- | M] () – C:\Program Files\Steam\bin\chromehtml.dll
MOD - [2012/05/19 21:12:23 | 000,190,776 | —- | M] () – C:\Program Files\Steam\bin\avformat-53.dll
MOD - [2012/05/19 21:12:23 | 000,123,192 | —- | M] () – C:\Program Files\Steam\bin\avutil-51.dll
MOD - [2012/05/12 20:13:14 | 011,492,864 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2012/04/07 16:06:59 | 030,236,672 | —- | M] () – C:\ProgramData\BOINC\slots\3\primegrid_cllr.exe
MOD - [2012/04/07 16:06:50 | 000,495,616 | —- | M] () – C:\ProgramData\BOINC\projects\www.primegrid.com\primegrid_llr_wrapper_6.13_windows_intelx86.exe
MOD - [2012/03/14 01:32:34 | 000,081,920 | —- | M] () – C:\Program Files\BOINC\zlib1.dll
MOD - [2011/12/20 10:29:50 | 000,184,832 | —- | M] () – C:\Users\Liam\AppData\Local\vghd\bin\dxmodules.dll
MOD - [2011/12/16 13:57:04 | 000,073,216 | —- | M] () – C:\Users\Liam\AppData\Local\vghd\bin\system.dll
MOD - [2011/12/12 14:33:52 | 000,498,760 | —- | M] () – C:\Program Files\ManyCam\Bin\cximagecrt.dll
MOD - [2011/12/12 14:33:48 | 000,123,976 | —- | M] () – C:\Program Files\ManyCam\Bin\CrashRpt.dll
MOD - [2011/11/25 11:59:01 | 000,166,912 | —- | M] () – C:\Program Files\WinRAR\RarExt.dll
MOD - [2011/11/16 13:33:10 | 000,029,184 | —- | M] () – C:\Users\Liam\AppData\Local\vghd\bin\imageformats\qico4.dll
MOD - [2011/11/16 13:33:08 | 000,287,232 | —- | M] () – C:\Users\Liam\AppData\Local\vghd\bin\imageformats\qtiff4.dll
MOD - [2011/11/16 13:32:56 | 000,222,720 | —- | M] () – C:\Users\Liam\AppData\Local\vghd\bin\imageformats\qmng4.dll
MOD - [2011/11/16 13:32:50 | 000,026,624 | —- | M] () – C:\Users\Liam\AppData\Local\vghd\bin\imageformats\qgif4.dll
MOD - [2011/11/16 13:32:46 | 000,200,704 | —- | M] () – C:\Users\Liam\AppData\Local\vghd\bin\imageformats\qjpeg4.dll
MOD - [2011/11/16 13:20:20 | 011,159,552 | —- | M] () – C:\Users\Liam\AppData\Local\vghd\bin\QtWebKit4.dll
MOD - [2011/11/16 12:18:30 | 000,270,336 | —- | M] () – C:\Users\Liam\AppData\Local\vghd\bin\phonon4.dll
MOD - [2011/11/16 12:12:28 | 008,451,072 | —- | M] () – C:\Users\Liam\AppData\Local\vghd\bin\QtGui4.dll
MOD - [2011/11/16 12:04:24 | 000,860,160 | —- | M] () – C:\Users\Liam\AppData\Local\vghd\bin\QtNetwork4.dll
MOD - [2011/11/16 12:03:36 | 000,358,400 | —- | M] () – C:\Users\Liam\AppData\Local\vghd\bin\QtXml4.dll
MOD - [2011/11/16 12:03:28 | 002,349,056 | —- | M] () – C:\Users\Liam\AppData\Local\vghd\bin\QtCore4.dll
MOD - [2011/11/09 21:43:22 | 000,784,384 | —- | M] () – C:\ProgramData\BOINC\projects\climateprediction.net\hadam3p_eu_6.09_windows_intelx86.exe
MOD - [2011/10/08 18:20:56 | 000,057,344 | —- | M] () – C:\Program Files\Trend Micro\AMSP\boost_date_time-vc80-mt-1_36.dll
MOD - [2011/10/08 18:20:56 | 000,049,152 | —- | M] () – C:\Program Files\Trend Micro\AMSP\boost_thread-vc80-mt-1_36.dll
MOD - [2011/09/27 06:23:00 | 000,087,912 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/09/27 06:22:40 | 001,242,472 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/07/29 09:09:42 | 000,096,112 | —- | M] () – C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2011/07/29 09:08:12 | 001,259,376 | —- | M] () – C:\Program Files\DivX\DivX Update\DivXUpdate.exe
MOD - [2011/06/01 13:28:02 | 000,045,056 | —- | M] () – C:\Users\Liam\AppData\Local\vghd\bin\Windows.dll
MOD - [2011/06/01 13:27:48 | 000,818,176 | —- | M] () – C:\Users\Liam\AppData\Local\vghd\bin\vhd.dll
MOD - [2011/04/07 06:48:56 | 000,156,888 | —- | M] () – C:\Program Files\Alexa Toolbar\AlexaToolbarSSB.10.0.dll
MOD - [2011/04/07 06:48:56 | 000,048,856 | —- | M] () – C:\Program Files\Alexa Toolbar\AlxSSBPS.dll
MOD - [2011/04/05 12:18:54 | 000,094,208 | —- | M] () – C:\Windows\System32\IccLibDll.dll
MOD - [2011/02/25 00:01:00 | 004,220,416 | —- | M] () – C:\ProgramData\BOINC\projects\climateprediction.net\hadrm3p_eu_um_6.09_windows_intelx86.exe
MOD - [2011/02/25 00:00:59 | 004,398,592 | —- | M] () – C:\ProgramData\BOINC\projects\climateprediction.net\hadam3p_eu_um_6.09_windows_intelx86.exe
MOD - [2010/12/09 08:35:12 | 000,079,264 | —- | M] () – C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll
MOD - [2010/11/19 10:18:34 | 011,205,120 | —- | M] () – C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] – C:\Program Files\DYMO\DYMO Label Software\DymoPnpService.exe – (DymoPnpService)
SRV - File not found [Auto | Running] – C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe – (Amsp)
SRV - [2012/05/19 21:12:24 | 000,529,232 | —- | M] (Valve Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Steam\SteamService.exe – (Steam Client Service)
SRV - [2012/02/04 15:18:04 | 001,987,588 | —- | M] (NCH Software) [On_Demand | Stopped] – C:\Program Files\NCH Software\ExpressInvoice\expressinvoice.exe – (ExpressInvoiceService)
SRV - [2012/02/04 15:17:51 | 002,985,988 | —- | M] (NCH Software) [On_Demand | Stopped] – C:\Program Files\NCH Software\ExpressAccounts\expressaccounts.exe – (ExpressAccountsService)
SRV - [2012/02/04 15:17:12 | 001,511,428 | —- | M] (NCH Software) [On_Demand | Stopped] – C:\Program Files\NCH Software\Inventoria\inventoria.exe – (InventoriaService)
SRV - [2011/10/26 00:59:16 | 000,244,960 | —- | M] () [Auto | Running] – C:\Program Files\StartNow Toolbar\ToolbarUpdaterService.exe – (Updater Service for StartNow Toolbar)
SRV - [2011/10/10 01:23:23 | 001,343,400 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\Wat\WatAdminSvc.exe – (WatAdminSvc)
SRV - [2011/06/29 12:26:06 | 000,520,216 | —- | M] (Ant.com) [Auto | Running] – C:\Program Files\Ant.com\IE add-on\AntUpdaterService.exe – (AntUpdaterService)
SRV - [2011/02/02 06:20:48 | 002,656,280 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe – (UNS) Intel®
SRV - [2011/02/02 06:20:46 | 000,326,168 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe – (LMS) Intel®
SRV - [2010/12/10 10:43:20 | 000,468,392 | —- | M] (TOSHIBA Corporation) [Auto | Running] – C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe – (TosCoSrv)
SRV - [2010/12/09 08:36:08 | 000,112,032 | —- | M] (TOSHIBA Corporation) [On_Demand | Running] – C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe – (TOSHIBA HDD SSD Alert Service)
SRV - [2010/11/30 07:58:30 | 000,054,136 | —- | M] (TOSHIBA Corporation) [On_Demand | Stopped] – C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe – (TMachInfo)
SRV - [2010/10/21 07:40:00 | 000,128,416 | —- | M] (TOSHIBA Corporation) [Auto | Running] – C:\Windows\System32\TODDSrv.exe – (TODDSrv)
SRV - [2010/08/26 16:48:00 | 000,285,152 | —- | M] () [Auto | Running] – C:\Program Files\NETGEAR\WNA3100\WifiSvc.exe – (WSWNA3100)
SRV - [2010/05/04 15:47:18 | 002,044,248 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe – (NOBU)
SRV - [2010/04/13 03:46:00 | 000,152,944 | —- | M] (TOSHIBA CORPORATION) [On_Demand | Running] – C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe – (TOSHIBA Bluetooth Service)
SRV - [2010/04/04 09:01:24 | 000,246,520 | —- | M] (WildTangent, Inc.) [On_Demand | Stopped] – C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe – (GameConsoleService)
SRV - [2010/02/03 09:35:21 | 000,103,792 | R— | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Norton PC Checkup\Engine\2.0.3.202\SymcPCCULaunchSvc.exe – (Norton PC Checkup Application Launcher)
SRV - [2010/01/29 09:44:24 | 000,185,712 | —- | M] (TOSHIBA CORPORATION) [Auto | Running] – C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe – (cfWiMAXService)
SRV - [2010/01/15 22:49:20 | 000,227,232 | —- | M] (McAfee, Inc.) [On_Demand | Stopped] – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe – (McComponentHostService)
SRV - [2009/08/25 08:49:41 | 000,126,392 | R— | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Norton PC Checkup\Engine\2.0.3.202\ccSvcHst.exe – (PCCUJobMgr)
SRV - [2009/07/14 11:16:13 | 000,025,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sensrsvc.dll – (SensrSvc)
SRV - [2009/07/14 11:15:41 | 000,680,960 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2009/03/11 11:51:20 | 000,046,448 | —- | M] (TOSHIBA CORPORATION) [Auto | Running] – C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe – (ConfigFree Service)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – C:\windows\system32\drivers\EagleXNt.sys – (EagleXNt)
DRV - [2011/10/08 18:20:56 | 000,205,072 | —- | M] (Trend Micro Inc.) [Kernel | System | Running] – C:\Windows\System32\drivers\tmcomm.sys – (tmcomm)
DRV - [2011/10/08 18:20:56 | 000,092,432 | —- | M] (Trend Micro Inc.) [Kernel | System | Running] – C:\Windows\System32\drivers\tmtdi.sys – (tmtdi)
DRV - [2011/10/08 18:20:56 | 000,081,168 | —- | M] (Trend Micro Inc.) [Kernel | System | Running] – C:\Windows\System32\drivers\tmactmon.sys – (tmactmon)
DRV - [2011/10/08 18:20:56 | 000,068,368 | —- | M] (Trend Micro Inc.) [Kernel | System | Running] – C:\Windows\System32\drivers\tmevtmgr.sys – (tmevtmgr)
DRV - [2011/08/02 16:38:44 | 000,018,432 | —- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\netaapl.sys – (Netaapl)
DRV - [2011/03/11 10:02:28 | 001,282,688 | —- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\CHDRT32.sys – (CnxtHdAudService)
DRV - [2011/02/24 04:03:04 | 000,235,824 | —- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\tosrfbd.sys – (tosrfbd)
DRV - [2011/02/10 04:28:12 | 000,068,720 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\L1C62x86.sys – (L1C)
DRV - [2011/02/09 12:08:00 | 000,033,616 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\PGEffect.sys – (PGEffect)
DRV - [2011/01/28 08:26:16 | 000,056,888 | —- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\tosrfusb.sys – (Tosrfusb)
DRV - [2010/12/18 12:44:24 | 002,129,408 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\athr.sys – (athr)
DRV - [2010/11/30 04:47:00 | 000,070,448 | —- | M] (TOSHIBA Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\tosrfcom.sys – (Tosrfcom)
DRV - [2010/11/21 07:29:24 | 000,052,224 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV - [2010/11/21 07:29:03 | 000,035,968 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\winusb.sys – (WinUsb)
DRV - [2010/11/21 07:29:03 | 000,027,264 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\TsUsbGD.sys – (TsUsbGD)
DRV - [2010/11/12 03:26:00 | 000,042,672 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\tosrfbnp.sys – (tosrfbnp)
DRV - [2010/10/20 09:33:40 | 000,041,088 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\HECI.sys – (MEI) Intel®
DRV - [2010/10/19 07:13:58 | 000,033,640 | R— | M] (Atheros) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\btfilter.sys – (BtFilter)
DRV - [2010/10/09 04:49:06 | 000,190,464 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\RtsUStor.sys – (RSUSBSTOR)
DRV - [2010/08/31 03:48:00 | 000,080,064 | —- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\Tosrfhid.sys – (Tosrfhid)
DRV - [2010/06/19 09:44:00 | 000,015,160 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosrfec.sys – (tosrfec)
DRV - [2010/04/27 04:48:00 | 000,053,760 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\TosRfSnd.sys – (TosRfSnd)
DRV - [2010/02/03 10:21:56 | 000,050,704 | —- | M] (CACE Technologies, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\npf.sys – (NPF)
DRV - [2009/07/31 10:45:56 | 000,022,912 | —- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tdcmdpst.sys – (tdcmdpst)
DRV - [2009/07/25 04:31:00 | 000,021,608 | —- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\tosrfnds.sys – (tosrfnds)
DRV - [2009/07/15 08:28:42 | 000,023,512 | —- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\TVALZ_O.SYS – (TVALZ)
DRV - [2009/07/14 09:52:10 | 000,014,336 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\vwifimp.sys – (vwifimp)
DRV - [2009/07/08 01:53:06 | 000,007,680 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\FwLnk.sys – (FwLnk)
DRV - [2009/06/25 08:08:30 | 000,275,536 | —- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\tos_sps32.sys – (tos_sps32)
DRV - [2009/06/18 04:59:00 | 000,046,984 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosporte.sys – (tosporte)
DRV - [2008/05/06 15:06:00 | 000,011,520 | —- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\wdcsam.sys – (WDC_SAM)
DRV - [2008/01/14 20:06:32 | 000,021,632 | —- | M] (ManyCam LLC.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\ManyCam.sys – (ManyCam)
DRV - [2007/01/19 17:20:54 | 000,021,728 | —- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | Boot | Running] – C:\Windows\System32\drivers\SCMNdisP.sys – (SCMNdisP)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope = {F4ED0519-C584-4DDA-BE93-FA0B93D040F6}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{F4ED0519-C584-4DDA-BE93-FA0B93D040F6}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox


IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {F4ED0519-C584-4DDA-BE93-FA0B93D040F6}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {F4ED0519-C584-4DDA-BE93-FA0B93D040F6}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-3529970971-4163437698-1443127188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://toshiba.msn.com
IE - HKU\S-1-5-21-3529970971-4163437698-1443127188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.au/
IE - HKU\S-1-5-21-3529970971-4163437698-1443127188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.com.au/
IE - HKU\S-1-5-21-3529970971-4163437698-1443127188-1000\..\SearchScopes,DefaultScope = {F4ED0519-C584-4DDA-BE93-FA0B93D040F6}
IE - HKU\S-1-5-21-3529970971-4163437698-1443127188-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKU\S-1-5-21-3529970971-4163437698-1443127188-1000\..\SearchScopes\{31C96125-66CD-4F67-A8F1-447ABE8AA385}: "URL" = http://www.ant.com/search?s=browser&q={searchTerms}
IE - HKU\S-1-5-21-3529970971-4163437698-1443127188-1000\..\SearchScopes\{66D659B8-AAE0-4492-9988-1C89F128CE1B}: "URL" = http://websearch.ask.com/redirect?client=i…B4-9648105A1267
IE - HKU\S-1-5-21-3529970971-4163437698-1443127188-1000\..\SearchScopes\{F4ED0519-C584-4DDA-BE93-FA0B93D040F6}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKU\S-1-5-21-3529970971-4163437698-1443127188-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3529970971-4163437698-1443127188-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.msn.com/?pc=Z190&ocid=zdhp&install_date=20111126"
FF - prefs.js..keyword.URL: "http://www.bing.com/search?pc=Z190&form=ZGAADF&install_date=20111126&q="
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@dymo.com/DymoLabelFramework: C:\Program Files\DYMO\DYMO Label Software\Framework\npDYMOLabelFramework.dll ( Sanford L.P.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@TrendMicro.com/FFExtension: C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension\components\npToolbarChrome.dll (Trend Micro Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Liam\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Liam\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Liam\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\Liam\AppData\Local\Facebook\Messenger\2.1.4520.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{38783831-6098-4faa-A9C9-1EE1E343F4D2}: C:\Program Files\Trend Micro\AMSP\Module\20002\7.1.1102\7.1.1102\firefoxextension [2012/05/21 11:47:35 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22181a4d-af90-4ca3-a569-faed9118d6bc}: C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension [2011/10/08 18:26:46 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension\ [2012/05/21 11:48:04 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/05/11 22:17:25 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/18 14:16:31 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/05/11 22:17:22 | 000,000,000 | —D | M]

[2011/10/08 22:49:30 | 000,000,000 | —D | M] (No name found) – C:\Users\Liam\AppData\Roaming\Mozilla\Extensions
[2012/05/05 15:15:56 | 000,000,000 | —D | M] (No name found) – C:\Users\Liam\AppData\Roaming\Mozilla\Firefox\Profiles\9uxzcp68.default\extensions
[2011/11/26 21:02:56 | 000,000,000 | —D | M] (StartNow Toolbar) – C:\Users\Liam\AppData\Roaming\Mozilla\Firefox\Profiles\9uxzcp68.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}
[2012/04/04 13:51:49 | 000,000,000 | —D | M] (Codecv) – C:\Users\Liam\AppData\Roaming\Mozilla\Firefox\Profiles\9uxzcp68.default\extensions\[removed]
[2011/12/14 23:27:51 | 000,000,000 | —D | M] (Yontoo Layers (Drop Down Deals)) – C:\Users\Liam\AppData\Roaming\Mozilla\Firefox\Profiles\9uxzcp68.default\extensions\[removed]
[2012/02/27 15:41:52 | 000,002,577 | —- | M] () – C:\Users\Liam\AppData\Roaming\Mozilla\Firefox\Profiles\9uxzcp68.default\searchplugins\askcom.xml
[2011/11/26 21:02:51 | 000,001,945 | —- | M] () – C:\Users\Liam\AppData\Roaming\Mozilla\Firefox\Profiles\9uxzcp68.default\searchplugins\bing-zugo.xml
[2012/04/18 14:16:31 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/03/13 14:39:39 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/03/13 14:38:32 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/09/29 11:16:42 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml.old
[2012/03/13 14:38:32 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Ask (Enabled)
CHR - default_search_provider: search_url = http://websearch.ask.com/redirect?client=c…q={searchTerms}
CHR - default_search_provider: suggest_url = http://ss.websearch.ask.com/query?qsrc=292…q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.168\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.168\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.168\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: registryAccess (Enabled) = C:\Users\Liam\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaodnbkkemkkaekocofmphoadofkdh\7.14.1.0_0\background/registryAccess.dll
CHR - plugin: Trend Micro Titanium (Enabled) = C:\Users\Liam\AppData\Local\Google\Chrome\User Data\Default\Extensions\heoldelcflnigdllmlopiefhkkobendj\5.2.0.1035_0\npToolbarChrome.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U29 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL
CHR - plugin: DYMO Label Framework (Enabled) = C:\Program Files\DYMO\DYMO Label Software\Framework\npDYMOLabelFramework.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Facebook Desktop (Enabled) = C:\Users\Liam\AppData\Local\Facebook\Messenger\2.0.4478.0\npFbDesktopPlugin.dll
CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Users\Liam\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - Extension: Ask Toolbar = C:\Users\Liam\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaodnbkkemkkaekocofmphoadofkdh\7.14.1.0_0\
CHR - Extension: YouTube = C:\Users\Liam\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\
CHR - Extension: Google Search = C:\Users\Liam\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\
CHR - Extension: TrendMicro Toolbar = C:\Users\Liam\AppData\Local\Google\Chrome\User Data\Default\Extensions\heoldelcflnigdllmlopiefhkkobendj\5.2.0.1035_0\
CHR - Extension: Codecv = C:\Users\Liam\AppData\Local\Google\Chrome\User Data\Default\Extensions\joifgdlkhokekeaenpkaehbnjhncglbh\1.0_0\
CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo\u003E = C:\Users\Liam\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Gmail = C:\Users\Liam\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\

O1 HOSTS File: ([2009/06/11 07:39:37 | 000,000,824 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.0.1313\6.8.1078\TmIEPlg.dll File not found
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Ant.com browser helper (video detector)) - {346FDE31-DFF9-418A-90C8-BA31DC9FF2EF} - C:\Program Files\Ant.com\IE add-on\Download.dll (Ant.com)
O2 - BHO: (TSToolbarBHO) - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
O2 - BHO: (StartNow Toolbar Helper) - {6E13D095-45C3-4271-9475-F3B48227DD9F} - C:\Program Files\StartNow Toolbar\Toolbar32.dll ()
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.1.1102\7.1.1102\TmBpIe32.dll File not found
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll ()
O2 - BHO: (Yontoo Layers (Drop Down Deals)) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers Runtime (Drop Down Deals)\YontooIEClient.dll (Yontoo LLC)
O3 - HKLM\..\Toolbar: (Ant.com Video Downloader toolbar) - {2E924F4F-67F0-4BD8-9560-49F468E843D2} - C:\Program Files\Ant.com\IE add-on\AntToolbar.dll (Ant.com)
O3 - HKLM\..\Toolbar: (StartNow Toolbar) - {5911488E-9D1E-40ec-8CBB-06B231CC153F} - C:\Program Files\StartNow Toolbar\Toolbar32.dll ()
O3 - HKLM\..\Toolbar: (Trend Micro Toolbar) - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
O3 - HKLM\..\Toolbar: (Alexa Toolbar) - {EA582743-9076-4178-9AA6-7393FDF4D5CE} - C:\Program Files\Alexa Toolbar\AlexaToolbar.10.0.dll (Alexa.com)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-3529970971-4163437698-1443127188-1000\..\Toolbar\WebBrowser: (Ant.com Video Downloader toolbar) - {2E924F4F-67F0-4BD8-9560-49F468E843D2} - C:\Program Files\Ant.com\IE add-on\AntToolbar.dll (Ant.com)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [boincmgr] C:\Program Files\BOINC\boincmgr.exe (Space Sciences Laboratory)
O4 - HKLM..\Run: [boinctray] C:\Program Files\BOINC\boinctray.exe (Space Sciences Laboratory)
O4 - HKLM..\Run: [BSDAppUpdater] C:\Program Files\Common Files\BSD\AppUpdater\BSDChecker.exe (Bootstrap Software Development)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [DLSService] C:\Program Files\DYMO\DYMO Label Software\DLSService.exe (Sanford, L.P.)
O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [NortonOnlineBackup] C:\Program Files\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)
O4 - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe (Conexant systems, Inc.)
O4 - HKLM..\Run: [Talk] C:\Program Files\NCH Software\Talk\talk.exe (NCH Software)
O4 - HKLM..\Run: [TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TosNC] C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe (Trend Micro Inc.)
O4 - HKU\S-1-5-21-3529970971-4163437698-1443127188-1000..\Run: [ChromeFrameHelper] C:\Users\Liam\AppData\Local\Google\Chrome\Application\19.0.1084.46\chrome_frame_helper.exe (Google Inc.)
O4 - HKU\S-1-5-21-3529970971-4163437698-1443127188-1000..\Run: [Facebook Update] C:\Users\Liam\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKU\S-1-5-21-3529970971-4163437698-1443127188-1000..\Run: [ManyCam] C:\Program Files\ManyCam\Bin\ManyCam.exe (ManyCam LLC)
O4 - HKU\S-1-5-21-3529970971-4163437698-1443127188-1000..\Run: [Optimizer Pro] C:\Program Files\Optimizer Pro\OptProLauncher.exe (PC Utilities Pro)
O4 - HKU\S-1-5-21-3529970971-4163437698-1443127188-1000..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)
O4 - Startup: C:\Users\Liam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DesktopVideoPlayer.lnk = C:\Users\Liam\AppData\Local\vghd\bin\vghd.exe (Totem Entertainment)
O4 - Startup: C:\Users\Liam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Liam\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Liam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk = C:\Users\Liam\AppData\Local\Facebook\Messenger\2.1.4520.0\FacebookMessenger.exe (Facebook)
O4 - Startup: C:\Users\Liam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O8 - Extra context menu item: Add to TOSHIBA Bulletin Board - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Download videos by Ant.com - {70AF6C9F-0818-4cf7-924A-BBDBB24211D3} - C:\Program Files\Ant.com\IE add-on\Download.dll (Ant.com)
O9 - Extra Button: Add to Wish List - {76c5fb99-dd0a-4186-9e75-65d1bf3da283} - C:\Program Files\Amazon\Add to Wish List IE Extension\run.htm ()
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-229 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)
O9 - Extra 'Tools' menuitem : @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-228 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0157329A-30D5-472A-A22A-FBEC916FD376}: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0EF42FF1-5F08-4E45-A150-7F0F8E641BA0}: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2C5719F9-2429-4ADE-B29D-843F67C9A841}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.1.1102\7.1.1102\TmBpIe32.dll File not found
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.0.1313\6.8.1078\TmIEPlg.dll File not found
O18 - Protocol\Handler\tmtb {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
O18 - Protocol\Handler\tmtbim {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/11 07:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/05/21 22:21:46 | 000,000,000 | —D | C] – C:\_OTL
[2012/05/21 20:28:57 | 000,000,000 | —D | C] – C:\Users\Liam\Desktop\Desktop
[2012/05/21 19:58:28 | 004,500,115 | R— | C] (Swearware) – C:\Users\Liam\Desktop\ComboFix.exe
[2012/05/21 19:54:01 | 000,000,000 | –SD | C] – C:\32788R22FWJFW
[2012/05/21 19:47:50 | 002,126,424 | —- | C] (Kaspersky Lab ZAO) – C:\Users\Liam\Desktop\TDSSKiller.exe
[2012/05/21 19:47:49 | 000,000,000 | —D | C] – C:\Users\Liam\Desktop\tdsskiller
[2012/05/21 12:22:36 | 000,595,968 | —- | C] (OldTimer Tools) – C:\Users\Liam\Desktop\OTL.exe
[2012/05/21 11:33:47 | 000,399,264 | —- | C] (Bleeping Computer, LLC) – C:\Users\Liam\Desktop\unhide.exe
[2012/05/20 23:22:40 | 000,000,000 | —D | C] – C:\Users\Liam\Desktop\FakeAVRemover
[2012/05/20 22:58:10 | 000,000,000 | —D | C] – C:\Users\Liam\AppData\Local\ElevatedDiagnostics
[2012/05/20 22:39:24 | 000,000,000 | —D | C] – C:\Users\Liam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data Recovery
[2012/05/18 22:20:21 | 000,000,000 | —D | C] – C:\Users\Liam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Facebook
[2012/05/14 21:00:45 | 000,000,000 | —D | C] – C:\Users\Liam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BOINC
[2012/05/14 21:00:43 | 000,000,000 | —D | C] – C:\Program Files\BOINC
[2012/05/12 18:41:31 | 001,077,248 | —- | C] (Microsoft Corporation) – C:\windows\System32\DWrite.dll
[2012/05/12 18:31:38 | 003,968,368 | —- | C] (Microsoft Corporation) – C:\windows\System32\ntkrnlpa.exe
[2012/05/12 18:31:37 | 003,913,072 | —- | C] (Microsoft Corporation) – C:\windows\System32\ntoskrnl.exe
[2012/05/12 18:31:37 | 002,343,424 | —- | C] (Microsoft Corporation) – C:\windows\System32\win32k.sys
[2012/05/11 22:17:01 | 000,000,000 | —D | C] – C:\Users\Liam\AppData\Roaming\DivX
[2012/05/11 22:16:23 | 000,000,000 | —D | C] – C:\Program Files\Common Files\PX Storage Engine
[2012/05/11 22:15:24 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX Plus
[2012/05/11 22:14:53 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DivX Shared
[2012/05/11 21:59:11 | 000,000,000 | —D | C] – C:\Program Files\DivX
[2012/05/11 21:56:49 | 000,000,000 | —D | C] – C:\ProgramData\DivX
[2012/05/07 18:59:11 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2012/05/07 18:57:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012/04/25 21:44:30 | 000,000,000 | —D | C] – C:\Users\Liam\Desktop\Bukkit
[2012/04/23 15:43:14 | 000,000,000 | —D | C] – C:\Users\Liam\Desktop\Desktop1
[2011/11/19 14:29:13 | 000,047,360 | —- | C] (VSO Software) – C:\Users\Liam\AppData\Roaming\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2012/05/21 23:22:00 | 000,000,904 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-3529970971-4163437698-1443127188-1000UA.job
[2012/05/21 22:50:03 | 000,025,120 | —- | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/05/21 22:50:03 | 000,025,120 | —- | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/05/21 22:47:02 | 000,000,882 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/05/21 22:41:56 | 000,000,878 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/05/21 22:41:42 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2012/05/21 22:41:37 | 2175,160,320 | -HS- | M] () – C:\hiberfil.sys
[2012/05/21 22:29:08 | 001,012,656 | —- | M] () – C:\Users\Liam\Desktop\rkill.exe
[2012/05/21 22:19:03 | 000,000,924 | —- | M] () – C:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-3529970971-4163437698-1443127188-1000UA.job
[2012/05/21 21:22:01 | 000,000,852 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-3529970971-4163437698-1443127188-1000Core.job
[2012/05/21 20:28:31 | 000,000,258 | RHS- | M] () – C:\ProgramData\ntuser.pol
[2012/05/21 19:58:31 | 004,500,115 | R— | M] (Swearware) – C:\Users\Liam\Desktop\ComboFix.exe
[2012/05/21 19:19:01 | 000,000,902 | —- | M] () – C:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-3529970971-4163437698-1443127188-1000Core.job
[2012/05/21 12:22:37 | 000,595,968 | —- | M] (OldTimer Tools) – C:\Users\Liam\Desktop\OTL.exe
[2012/05/21 11:33:47 | 000,399,264 | —- | M] (Bleeping Computer, LLC) – C:\Users\Liam\Desktop\unhide.exe
[2012/05/21 01:27:27 | 000,288,771 | —- | M] () – C:\Users\Liam\AppData\Local\census.cache
[2012/05/21 01:27:13 | 000,129,958 | —- | M] () – C:\Users\Liam\AppData\Local\ars.cache
[2012/05/21 01:18:49 | 000,000,036 | —- | M] () – C:\Users\Liam\AppData\Local\housecall.guid.cache
[2012/05/20 23:28:16 | 000,000,152 | —- | M] () – C:\ProgramData\-GO9APCOFkP3bgmr
[2012/05/20 23:28:16 | 000,000,000 | —- | M] () – C:\ProgramData\-GO9APCOFkP3bgm
[2012/05/20 22:22:01 | 000,108,048 | —- | M] () – C:\windows\RegBootClean.exe
[2012/05/18 22:20:21 | 000,001,292 | —- | M] () – C:\Users\Liam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
[2012/05/18 21:52:07 | 000,002,261 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2012/05/16 17:40:44 | 002,126,424 | —- | M] (Kaspersky Lab ZAO) – C:\Users\Liam\Desktop\TDSSKiller.exe
[2012/05/16 11:26:53 | 000,723,530 | —- | M] () – C:\windows\System32\perfh009.dat
[2012/05/16 11:26:53 | 000,147,448 | —- | M] () – C:\windows\System32\perfc009.dat
[2012/05/12 20:12:10 | 000,378,840 | —- | M] () – C:\windows\System32\FNTCACHE.DAT
[2012/05/12 18:57:32 | 000,419,488 | —- | M] (Adobe Systems Incorporated) – C:\windows\System32\FlashPlayerApp.exe
[2012/05/12 18:57:32 | 000,070,304 | —- | M] (Adobe Systems Incorporated) – C:\windows\System32\FlashPlayerCPLApp.cpl
[2012/05/11 22:17:40 | 000,002,037 | —- | M] () – C:\Users\Public\Desktop\DivX Plus Converter.lnk
[2012/05/11 22:16:56 | 000,001,057 | —- | M] () – C:\Users\Public\Desktop\DivX Plus Player.lnk
[2012/04/29 20:28:57 | 000,000,442 | -HS- | M] () – C:\windows\System32\signed_DOCLERW.lic
[2012/04/29 20:28:57 | 000,000,272 | -HS- | M] () – C:\windows\System32\DOCLERW_license_public_key.pem
[2012/04/29 20:28:52 | 000,000,021 | —- | M] () – C:\windows\System32\dllresult
[2012/04/24 17:09:29 | 000,126,428 | —- | M] () – C:\Users\Liam\Desktop\g3kmc.jpg

========== Files Created - No Company Name ==========

[2012/05/21 22:29:02 | 001,012,656 | —- | C] () – C:\Users\Liam\Desktop\rkill.exe
[2012/05/21 12:20:49 | 000,002,443 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
[2012/05/21 12:20:49 | 000,002,261 | —- | C] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2012/05/21 12:20:49 | 000,002,037 | —- | C] () – C:\Users\Public\Desktop\DivX Plus Converter.lnk
[2012/05/21 12:20:49 | 000,001,515 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2012/05/21 12:20:49 | 000,001,415 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
[2012/05/21 12:20:49 | 000,001,352 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
[2012/05/21 12:20:49 | 000,001,331 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk
[2012/05/21 12:20:49 | 000,001,326 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012/05/21 12:20:49 | 000,001,262 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk
[2012/05/21 12:20:49 | 000,001,246 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
[2012/05/21 12:20:49 | 000,001,210 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
[2012/05/21 12:20:49 | 000,001,057 | —- | C] () – C:\Users\Public\Desktop\DivX Plus Player.lnk
[2012/05/21 12:20:46 | 000,002,225 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recovery Media Creator Help.lnk
[2012/05/21 12:20:46 | 000,002,189 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recovery Media Creator.lnk
[2012/05/21 12:20:46 | 000,001,810 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/05/21 12:20:46 | 000,001,330 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[2012/05/21 12:20:46 | 000,000,914 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk
[2012/05/21 12:20:45 | 000,002,435 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2010.lnk
[2012/05/21 12:20:45 | 000,001,838 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn.lnk
[2012/05/21 12:20:45 | 000,001,345 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012/05/21 12:20:45 | 000,001,117 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inventoria Stock Manager.lnk
[2012/05/21 12:20:45 | 000,000,994 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/05/21 12:20:44 | 000,001,151 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Accounts.lnk
[2012/05/21 12:20:44 | 000,001,139 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Invoice.lnk
[2012/05/21 12:20:44 | 000,001,025 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Talk.lnk
[2012/05/21 12:20:43 | 000,002,519 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2012/05/21 12:20:43 | 000,002,441 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2012/05/21 12:20:43 | 000,001,563 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ABC Inventory.lnk
[2012/05/21 12:20:43 | 000,001,067 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Debut Video Capture Software.lnk
[2012/05/21 01:27:27 | 000,288,771 | —- | C] () – C:\Users\Liam\AppData\Local\census.cache
[2012/05/21 01:27:13 | 000,129,958 | —- | C] () – C:\Users\Liam\AppData\Local\ars.cache
[2012/05/21 01:17:16 | 000,000,036 | —- | C] () – C:\Users\Liam\AppData\Local\housecall.guid.cache
[2012/05/20 22:39:29 | 000,000,152 | —- | C] () – C:\ProgramData\-GO9APCOFkP3bgmr
[2012/05/20 22:39:28 | 000,000,000 | —- | C] () – C:\ProgramData\-GO9APCOFkP3bgm
[2012/05/20 22:13:27 | 000,108,048 | —- | C] () – C:\windows\RegBootClean.exe
[2012/04/29 20:28:57 | 000,000,442 | -HS- | C] () – C:\windows\System32\signed_DOCLERW.lic
[2012/04/29 20:28:57 | 000,000,272 | -HS- | C] () – C:\windows\System32\DOCLERW_license_public_key.pem
[2012/04/29 20:28:52 | 000,000,021 | —- | C] () – C:\windows\System32\dllresult
[2012/04/24 17:14:05 | 000,126,428 | —- | C] () – C:\Users\Liam\Desktop\g3kmc.jpg
[2012/04/18 00:24:11 | 000,103,031 | —- | C] () – C:\Users\Liam\AppData\Roaming\Talk.dmp
[2011/12/07 11:42:09 | 000,000,262 | —- | C] () – C:\windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2011/11/26 20:32:47 | 000,057,344 | —- | C] () – C:\windows\System32\ff_vfw.dll
[2011/11/25 21:54:26 | 000,007,602 | —- | C] () – C:\Users\Liam\AppData\Local\Resmon.ResmonCfg
[2011/11/19 14:29:13 | 000,087,608 | —- | C] () – C:\Users\Liam\AppData\Roaming\inst.exe
[2011/11/19 14:29:13 | 000,007,887 | —- | C] () – C:\Users\Liam\AppData\Roaming\pcouffin.cat
[2011/11/19 14:29:13 | 000,001,144 | —- | C] () – C:\Users\Liam\AppData\Roaming\pcouffin.inf
[2011/11/04 18:47:04 | 000,053,299 | —- | C] () – C:\windows\System32\pthreadVC.dll
[2011/10/12 19:13:17 | 000,000,410 | —- | C] () – C:\windows\BRWMARK.INI
[2011/10/12 19:13:17 | 000,000,034 | —- | C] () – C:\windows\System32\BD7040.DAT
[2011/10/08 19:08:36 | 000,000,048 | —- | C] () – C:\ProgramData\ezsidmv.dat
[2011/10/08 18:26:03 | 000,000,056 | —- | C] () – C:\windows\System32\SupportTool.exe.bat
[2011/10/08 18:26:02 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2011/09/28 16:44:14 | 000,179,271 | —- | C] () – C:\windows\System32\xlive.dll.cat
[2011/09/19 17:07:46 | 000,015,360 | —- | C] () – C:\windows\System32\bdmjpeg.dll
[2011/09/19 17:07:32 | 000,058,368 | —- | C] () – C:\windows\System32\bdmpegv.dll
[2011/07/23 00:22:57 | 000,000,000 | —- | C] () – C:\windows\NDSTray.INI
[2011/07/22 23:51:04 | 000,008,192 | —- | C] () – C:\windows\System32\drivers\IntelMEFWVer.dll
[2011/04/05 12:58:26 | 000,963,116 | —- | C] () – C:\windows\System32\igkrng600.bin
[2011/04/05 12:58:26 | 000,216,876 | —- | C] () – C:\windows\System32\igfcg600m.bin
[2011/04/05 12:58:26 | 000,145,804 | —- | C] () – C:\windows\System32\igcompkrng600.bin
[2011/04/05 12:23:46 | 000,004,096 | —- | C] ( ) – C:\windows\System32\IGFXDEVLib.dll
[2011/04/05 12:22:00 | 000,000,151 | —- | C] () – C:\windows\System32\GfxUI.exe.config
[2011/04/05 12:18:54 | 000,094,208 | —- | C] () – C:\windows\System32\IccLibDll.dll
[2011/02/19 23:39:46 | 000,246,804 | R— | C] () – C:\windows\System32\drivers\AtherosBT.bin
[2010/10/29 05:22:18 | 000,030,895 | —- | C] () – C:\windows\System32\drivers\Mixer.ini

< End of report >




ComboFix still isn't running properly. And on anther note, I saw a mention of Ask toolbar in the log. I uninstalled that through the control panel. Should it still be appearing there?
Post #18
Don't worry about the Ask entries, we'll deal with that later.

Let’s try this:

Run RogueKiller

IMPORTANT: Do not reboot your computer if at all possible otherwise the malware will reactivate and you will have to run RogueKiller again

Download RogueKiller to your desktop.
  • close all running programs
  • for Windows Vista/Seven, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
  • when the prescan is finished, click on Scan
  • the RKreport.txt will be generated next to the executable, (on the desktop).
    If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe
Please post the contents of the RKreport.txt in your next Reply.

Remember: do not reboot your computer if at all possible otherwise the malware will reactivate and you will have to run RogueKiller again

You can try running ComboFix again,

Satchfan
Post #19 last edited
When I tried to run it normally it crashed the computer. So I ran it in safe mode:

RogueKiller V7.4.5 [05/18/2012] by Tigzy
mail: tigzyRKgmailcom
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Safe mode with network support
User: Liam [Admin rights]
Mode: Scan – Date: 05/22/2012 12:38:11

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 11 ¤¤¤
[SUSP PATH] HKCU\[…]\Run : ChromeFrameHelper ("C:\Users\Liam\AppData\Local\Google\Chrome\Application\19.0.1084.46\chrome_frame_helper.exe" –startup) -> FOUND
[SUSP PATH] HKUS\S-1-5-21-3529970971-4163437698-1443127188-1000[…]\Run : ChromeFrameHelper ("C:\Users\Liam\AppData\Local\Google\Chrome\Application\19.0.1084.46\chrome_frame_helper.exe" –startup) -> FOUND
[SUSP PATH] DesktopVideoPlayer.lnk @Liam : C:\Users\Liam\AppData\Local\vghd\bin\vghd.exe -> FOUND
[SUSP PATH] Facebook Messenger.lnk @Liam : C:\Users\Liam\AppData\Local\Facebook\Messenger\2.1.4520.0\FacebookMessenger.exe -> FOUND
[HJ] HKLM\[…]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJ] HKLM\[…]\System : EnableLUA (0) -> FOUND
[HJ] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKCU\[…]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[…]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[…]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: TOSHIBA MK5075GSX +++++
— User —
[MBR] 4e936246e7e4f51ef7191aced684a894
[BSP] aa3ce8eec94a52fa48ec1a9096081e17 : Windows Vista MBR Code
Partition table:
0 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 465949 Mo
2 - [XXXXXX] NTFS (0x17) [HIDDEN!] Offset (sectors): 957337600 | Size: 9490 Mo
User = LL1 … OK!
User = LL2 … OK!

Finished : << RKreport[1].txt >>
RKreport[1].txt




And combofix still isn't working properly, but it did update, and then ran an autoscan, or something.
Post #20
Let’s try running ComboFix in another way.

Click the Windows “Start” button, select Run, then copy/paste the following bolded text into the run box and then click OK

combofix /nombr

Satchfan
Post #26
Do you have a flash (USB) drive? If you do, please delete the version of ComboFix you have downloaded and try downloading and running a new vesion from your flash drive. If that doesn't work there is another scan we can try with a flash drive.
Post #28
Can you check both locations to see if a log has been produced: Even on the C drive, sometimes when it appears not to have run successfully it actually might have.

c:\combofix.txt and your flash drive letter
Post #30
Getting a bit desperate now so let's try another way to look for infection.

Run Farbar Recovery Scan Tool

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flash drive into the infected PC.
  • restart the computer.
  • as soon as the BIOS is loaded begin tapping the F8 key until “Advanced Boot Options” appears.
  • follow the prompt to enter keyboard input method, and then the prompt to enter a password. If the machine does not have a password, simply click Enter
  • in the next menu, use the arrow keys on the keyboard to select Command Prompt and press Enter
  • in the command window type in notepad and press Enter
  • the notepad opens. Under “File” menu select Open
  • select "Computer" and find your flash drive letter and close the notepad
  • in the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
    Note: Replace letter e with the drive letter of your flash drive.
  • the tool will start to run.
  • when the tool opens click Yes to disclaimer.
  • press the Scan button.
  • it will produce a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI